American Megatrends, Inc.

Aptio Cryptographic Library

Copyright AMI

Copyright WPA Supplicant crypt library

Release Notes

© American Megatrends, Inc.


Copyright

WPA Supplicant Crypto Library

Copyright (c) 2003-2009, Jouni Malinen <j@w1.fi> and contributors

All Rights Reserved.

License

-------

This software may be distributed, used, and modified under the terms of BSD license:

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the redistribution.

3. Neither the name(s) of the above-listed copyright holder(s) nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


Release Notes - NDA Required

Information:

THIS MODULE INCLUDES 3rd PARTY OPEN SOURCE LIBRARY.

Component Name: Aptio Cryptographic library

Component Type: PEI, DXE BS, DXE RT driver

AMI BIOS Core: Aptio 4.6.5.x

Location on SourceSafe: SS: Alaska;$/Alaska/BIN/Modules/CryptoPkg/Lib/;

Label: 4.6.5.x_CRYPTOAPI_020

Date: 01-17-2014

Component Description:

Aptio Crypto library provides basic Crypto operations:

Rsa2048, MD5, Sha256, Sha1, x509, PKCS7, PKCS1, ASN.1 DER, PEM

APIs and function description is given in “Functions. Tables and Variables” section inside this Help file.

This Crypto library uses 3-rd party Open Source library code. Please refer to the “3rd Party Code…” section below.

AMI Build Tools:

Tools Label: 4.5.5_TOOLS_35, Dated: 2011-03-29

Visual eBios: RSS.5.70, Dated: 2010-10-06

New features added in this label:

General Bug Fixes:

CryptoLib(x64,Pei).lib

1. Pkcs7 certificate chain validate. Fixed a bug with falsely identify match for leaf certificates if only Issuer names were a match

2. x509. Fix for Bleichenbacher's Pkcs#1v1.5 RSA signature vulnerability: Hash field must be aligned to right of the decoded sig.

An obscure condition possible only for rsa key e = 3

EIP addressed in this label:

Files changed for EIP fixes:

CryptoLib(x64,Pei).lib

Known issues and limitations in this label:

3rd Party Code Present in Component:

Aptio Crypto Library is based on Open Source crypto library (wpa_supplicant).

This Crypto library module is based on Open standard Crypto library – wpa_supplicant and is built to function under UEFI environment.

It is dual-licensed under both the GPL version 2 and BSD license. Either license may be used at your option.

Current supported wpa_supplicant source version for UEFI Crypto Library is wpa_supplicant-0.6.10

http://hostap.epitest.fi/releases/wpa_supplicant-0.6.10.tar.gz

WPA stands for Wi-Fi Protected Access, a wireless encryption standard.

Wpa_supplicant is a well-known open source implementation of WPA and WPA2 (IEEE 802.11i / RSN).

It is suitable for both desktop/laptop computers and embedded systems.

The core library provides basic TLS/crypto implementation for:

-X.509 certificate processing

-PKCS #1

-ASN.1

-RSA

-bignum

(See http://hostap.epitest.fi/wpa_supplicant/ for more information for wpa_supplicant).

================================================================================

Copyright (c) 2003-2009, Jouni Malinen <j@w1.fi> and contributors

All Rights Reserved.

=============

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. Neither the name(s) of the above-listed copyright holder(s) nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

Release History:

4.6.5.x_CRYPTOAPI_019

CryptoLib(x64,Pei).lib: Fix provided for SCT tests that may use corrupted certificate during SetVariable() update: do a full leaf certificate binary comparison and not just the public key portion

4.6.5.x_CRYPTOAPI_018

EIP#138512; 136764; 137431; 135555 and 134210:

1. SCT issue reported due to improper parameter check public_key==NIULL ptr vs *public_key==NULL inside Pkcs7_x509_return_cert_pubKey()

2. Can't launch some OEM signed Efi utilities: Checking a value of uninitialized field SignedData->tstInfo->authAttr.auth_attrib_start inside Pkcs7_certificate_validate_digest()

4.6.5.x_CRYPTOAPI_017

1. EIP#118850: Implement support for UEFI2.4 ECR 1009: Certificate Revocation Storage reduction and Timestamp Support.

4.6.5.x_CRYPTOAPI_016; no changes

4.6.5.x_CRYPTOAPI_015

CryptoLib(x64,Pei).lib Pkcs7_x509_certificate_chain_validate(): Bug fix for leaf cert pub key much: must use "signer->pubkey" not "cert->pubkey"

4.6.5.x_CRYPTOAPI_014

EIP#110853: WHCK test secure boot logo test error with 4.6.5.0_CRYPTOAPI_008 and 4.6.5.1_SECUREBOOT_WIN8_12

CryptoLib(x64,Pei).lib

Pkcs7_x509_certificate_chain_validate(): Only verify public key match for leaf certificate tests. Other parameters like timestamp, CA basic constrain fields are ignored anyway

x509_certificate_parse(): Extract true cert size from its ASN1 header -Don't allocate new buffer for the signature block- update cert->sign_value pointer with the address within x509 Cert blob.

4.6.5.x_CRYPTOAPI_013

EIP#108747: Library files are built in debug mode in the latest label 4.6.5.x_CRYPTOAPI_012. Removed traces when library is linked in release mode.

4.6.5.x_CRYPTOAPI_012

EIP#102807: Ignore leaf certificate signature validation error if its public key matches the one found in a trusted certificate pool.

EIP#105015: Request to implement Pkcs7# Certificate signing in Aptio Fw Capsule update packages

EIP#106441: REF-28581: SCT Execution - Auth Variable Error. Add MD5 Hash algorithm.

4.6.5.x_CRYPTOAPI_011

EIP#104639: Failed to process Microsoft Test Signed bootmgfw.efi. Pkcs7_validate logic changed to process all certs in the cert store. Old logic skipped through the chain until Signing cert match found

EIP#104046: Findings from Security review on Aptio4 Image verification.

Include the fix for item #1: malloc() - check for potential mem heap overflow : max allocation mem size must be less then the max number of Pages that can stored within UINT8 = 256*256=64kb

4.6.5_CRYPTOAPI_010

EIP#101406: Secure Boot Manual Logo test: Fail. Msft KEK leaf certificate has expired on 9/16/2012. According to Microsoft communication: UEFI Secure Boot should ignore certificate expiration and this test case should continue to function

Cryptlib(x64).lib x509_certificate_chain_validate(): ignore Time Stamp test results as UEFI FW cannot provide a reliable time source as a reference clock. For all x509 Key certificates this checking will be ignored

4.6.5_CRYPTOAPI_009

Pkcs7.c

1. Optimized Pkcs7_x509_certificate_chain_validate() to handle test for leaf certificates

2. Pkcs7_return_cerificate_ptr(). run chain_validate if CA cert ptr is NULL.

3. Pkcs7_x509_return_Cert_pubKey(). Add input parameter checks

4. Add new lib function: Pkcs7_x509_return_Cert_pubKey() to return a pointer within x509 certificate to a public key.

x509v3.c : x509_parse_public_key(): not allocate new pool for public key cert. use a pointer within Pkcs7 cert

libtommath.h: mp_exptmod_fast: use globally defined M instead of using it on stack

4.6.5_CRYPTOAPI_006 Excluded Pkcs#7 and x509 support from PEI Crypto Lib

4.6.5_CRYPTOAPI_004 PKCS#7 Certificate parser optionally supporting format of the SignedData structure described in UEFI 2.3.1 Spec for Time Based Authenticated Variables. This format is being interpreted in order to comply with Alpha version of SCT Test for Authenticated Variables.

© American Megatrends Inc.


Function by File Name

AMIBIOS Function Reference

By File Name

The following is a list of the source files.
For a list in alphabetical order, see In Alphabetical Order.

  • BaseCryptLib.h
  • CryptLib.h
Built on 14:27:19 01/17/14


BaseCryptLib.h

Description:
Defines base cryptographic library APIs compatible with EDK2 BaseCryptLib.
The Base Cryptographic Library provides implementations of basic cryptography
primitives (SHA-1, SHA-256, RSA, etc) for UEFI security functionality enabling.

The following functions are used in the file: BaseCryptLib.h.

Function | Description
Pkcs7Verify | Verifies the validility of a PKCS#7 signed data as described in "PKCS #7: Cryptographic Message Syntax Standard". If P7Data is NULL, then ASSERT().
RsaFree | Release the specified RSA Context.
RsaNew | Allocates and Initializes one RSA Context for subsequent use.
RsaPkcs1Verify | Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in RSA PKCS#1. If RsaContext is NULL, then ASSERT(). If MessageHash is NULL, then ASSERT(). If Signature is NULL, then ASSERT(). If HashLength is not equal to the size of SHA-1 or SHA-256 digest, then ASSERT().
RsaSetKey | Sets the tag-designated RSA key component into the established RSA context from the user-specified nonnegative integer (octet string format represented in RSA PKCS#1). If RsaContext is NULL, then ASSERT().
Sha1Final | Completes SHA-1 hash computation and retrieves the digest value into the specified memory. After this function has been called, the SHA-1 context cannot be used again. If Sha1Context is NULL, then ASSERT(). If HashValue is NULL, then ASSERT().
Sha1GetContextSize | Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
Sha1Init | Initializes user-supplied memory pointed by Sha1Context as the SHA-1 hash context for subsequent use. If Sha1Context is NULL, then ASSERT().
Sha256Final | Completes SHA-256 hash computation and retrieves the digest value into the specified memory. After this function has been called, the SHA-256 context cannot be used again. If Sha256Context is NULL, then ASSERT(). If HashValue is NULL, then ASSERT().
Sha256GetContextSize | Retrieves the size, in bytes, of the context buffer required for SHA256 hash operations.
Sha256Init | Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for subsequent use. If Sha256Context is NULL, then ASSERT().


Pkcs7Verify in the BaseCryptLib.h

Function : Pkcs7Verify

File: BaseCryptLib.h
Description:
Verifies the validility of a PKCS#7 signed data as described in
"PKCS #7: Cryptographic Message Syntax Standard".
If P7Data is NULL, then ASSERT().
Input:
@param[in]  P7Data       Pointer to the PKCS#7 message to verify.
@param[in]  P7Length     Length of the PKCS#7 message in bytes.
@param[in]  TrustedCert  Pointer to a trusted/root certificate encoded in DER, which
            is used for certificate chain verification.
@param[in]  CertLength   Length of the trusted certificate in bytes.
@param[in]  InData       Pointer to the content to be verified.
@param[in]  DataLength   Length of InData in bytes.
Output:
@return  TRUE  The specified PKCS#7 signed data is valid.
@return  FALSE Invalid PKCS#7 signed data.


RsaFree in the BaseCryptLib.h

Function : RsaFree

File: BaseCryptLib.h
Description:
Release the specified RSA Context.
Input:
param[in]  RsaContext  Pointer to the RSA context to be released.
Output:


RsaNew in the BaseCryptLib.h

Function : RsaNew

File: BaseCryptLib.h
Description:
Allocates and Initializes one RSA Context for subsequent use.
Input:
Output:
Pointer to the RSA Context that has been initialized.
If the allocations fails, RsaNew() returns NULL.


RsaPkcs1Verify in the BaseCryptLib.h

Function : RsaPkcs1Verify

File: BaseCryptLib.h
Description:
Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in
RSA PKCS#1.
If RsaContext is NULL, then ASSERT().
If MessageHash is NULL, then ASSERT().
If Signature is NULL, then ASSERT().
If HashLength is not equal to the size of SHA-1 or SHA-256 digest, then ASSERT().
Input:
@param[in]  RsaContext   Pointer to RSA context for signature verification.
@param[in]  MessageHash  Pointer to octet message hash to be checked.
@param[in]  HashLength   Length of the message hash in bytes.
@param[in]  Signature    Pointer to RSA PKCS1-v1_5 signature to be verified.
@param[in]  SigLength    Length of signature in bytes.
Output:
@return  TRUE   Valid signature encoded in PKCS1-v1_5.
@return  FALSE  Invalid signature or invalid RSA context.


RsaSetKey in the BaseCryptLib.h

Function : RsaSetKey

File: BaseCryptLib.h
Description:
Sets the tag-designated RSA key component into the established RSA context from
the user-specified nonnegative integer (octet string format represented in RSA
PKCS#1).   If RsaContext is NULL, then ASSERT().
Input:
@param[in, out]  RsaContext  Pointer to RSA context being set.
@param[in]       KeyTag      Tag of RSA key component being set.
@param[in]       BigNumber   Pointer to octet integer buffer.
@param[in]       BnLength    Length of big number buffer in bytes.
Output:
@return  TRUE   RSA key component was set successfully.
@return  FALSE  Invalid RSA key component tag.


Sha1Final in the BaseCryptLib.h

Function : Sha1Final

File: BaseCryptLib.h
Description:
Completes SHA-1 hash computation and retrieves the digest value into the specified
 memory. After this function has been called, the SHA-1 context cannot be used again.
If Sha1Context is NULL, then ASSERT().
If HashValue is NULL, then ASSERT().
Input:
param[in, out]  Sha1Context  Pointer to the SHA-1 context
param[out]      HashValue    Pointer to a buffer that receives the SHA-1 digest
                value (20 bytes).
Output:
TRUE  SHA-1 digest computation succeeded.


Sha1GetContextSize in the BaseCryptLib.h

Function : Sha1GetContextSize

File: BaseCryptLib.h
Description:
Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
Input:
none
Output:
The size, in bytes, of the context buffer required for SHA-1 hash operations.


Sha1Init in the BaseCryptLib.h

Function : Sha1Init

File: BaseCryptLib.h
Description:
Initializes user-supplied memory pointed by Sha1Context as the SHA-1 hash context for
subsequent use. If Sha1Context is NULL, then ASSERT().
Input:
param[in, out]  Sha1Context  Pointer to the SHA-1 Context being initialized.
Output:
retval TRUE  SHA-1 initialization succeeded.


Sha256Final in the BaseCryptLib.h

Function : Sha256Final

File: BaseCryptLib.h
Description:
Completes SHA-256 hash computation and retrieves the digest value into the specified
memory. After this function has been called, the SHA-256 context cannot be used again.
If Sha256Context is NULL, then ASSERT().
If HashValue is NULL, then ASSERT().
Input:
param[in, out]  Sha256Context  Pointer to SHA-256 context
param[out]      HashValue      Pointer to a buffer that receives the SHA-256 digest
                  value (32 bytes).
Output:
TRUE  SHA-256 digest computation succeeded.


Sha256GetContextSize in the BaseCryptLib.h

Function : Sha256GetContextSize

File: BaseCryptLib.h
Description:
Retrieves the size, in bytes, of the context buffer required for SHA256 hash operations.
Input:
none
Output:
The size, in bytes, of the context buffer required for SHA256 hash operations.


Sha256Init in the BaseCryptLib.h

Function : Sha256Init

File: BaseCryptLib.h
Description:
Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for
subsequent use. If Sha256Context is NULL, then ASSERT().
Input:
param[in, out]  Sha256Context  Pointer to the SHA-1 Context being initialized.
Output:
retval TRUE  SHA-256 context initialization succeeded.


CryptLib.h

Description:
Defines Aptio cryptographic library APIs.
This Cryptographic Library provides implementations of basic and extended cryptography
primitives (SHA-1, SHA-256, RSA, x509, PKCS7, ASN1.1) for UEFI security functionality enabling.

The following functions are used in the file: CryptLib.h.

Function | Description
base64_decode | Do in-place decoding of base-64 data of LENGTH in BUFFER.
crypto_import_asn1_public_key | Imports RSA2048 public key from ASN.1 DER format into internal crypto_rsa_key data structure
crypto_import_rsa2048_public_key | Imports RSA2048 public key binary from RAW format into internal crypto_rsa_key data structure
crypto_rsa_exptmod | RSA modular exponentiation
InitCRmm | Initializes Crypo Memory Manager
md5_vector | MD5 hash for data vector
os_mktime |
Pkcs7_certificate_validate_digest | Verify certificate signature
Pkcs7_certificate_validate_timestamp_digest | Validate RFC6131 TimeStampToken digest
Pkcs7_parse_Authenticode_certificate | Parse a Pkcs7 Authenticode certificate in DER format Caller is responsible for freeing the returned certificate by calling Pkcs7_certificate_free().
Pkcs7_return_cerificate_ptr | Return pointer within DER buffer to: 1. Signing certificate 2. Root CA certificate that is used to sign Signing certificate
Pkcs7_return_digestAlgorithm | Return digestAlgorithm type
PKCS7_return_signing_cerificate | Return certificate with signer's public key
Pkcs7_return_timestamp_signing_cerificate | Return timestamps root signing certificate
Pkcs7_x509_certificate_chain_validate | Validate Pkcs7 certificate chain
Pkcs7_x509_certificate_chain_validate_with_timestamp | Common routine to validate Pkcs7 certificate chain and revoked time stamped certs Supported RFC6131 TimeStampToken format
Pkcs7_x509_return_Cert_pubKey | Extract n-Modulus from an x509 Key certificate
Pkcs7_x509_return_signing_Key | Extract n-Modulus of a Signing Key from x509 certificate
pkcs_1_pss_decode | PKCS #1 v2.00 PSS sig decode
pkcs_1_v1_5_decode | Strip PKCS #1 header
ResetCRmm | Resets Crypto Memory Manager. Clears mem heap and descriptors
RuntimeCryptLibConstructorInSMM | Init Crypto lib internal state. This function is called from outside of SMM during SMM registration.
set_crypt_efitime | updates the local value of crypto EfiTime
sha1_vector | SHA-1 hash for data vector
sha256_vector | SHA256 hash for data vector
wpa_set_trace_level | sets the debug message print mode
x509_certificate_chain_validate | Validate X.509 certificate chain
x509_certificate_parse | Parse a X.509 certificate in DER format Caller is responsible for freeing the returned certificate by calling x509_certificate_free().


base64_decode in the CryptLib.h

Function : base64_decode

File: CryptLib.h
Description:
Do in-place decoding of base-64 data of LENGTH in BUFFER.
Input:
buffer       - Data to be decoded
length       - Length of the data to be decoded
Output:
New length of the buffer bytes of decoded data,
or -1 n failure


crypto_import_asn1_public_key in the CryptLib.h

Function : crypto_import_asn1_public_key

File: CryptLib.h
Description:
Imports RSA2048 public key from ASN.1 DER format into
internal crypto_rsa_key data structure
Input:
key       - Pointer to public key buffer
len       - Size of key buffer
Output:
Pointer to Key data structure crypto_rsa_key
NULL if failed to import Key


crypto_import_rsa2048_public_key in the CryptLib.h

Function : crypto_import_rsa2048_public_key

File: CryptLib.h
Description:
Imports RSA2048 public key binary from RAW format into internal crypto_rsa_key data structure
Input:
KeyN      - Pointer to N public modulus buffer
KeyE      - Pointer to E public exponent buffer
LenN      - Size of KeyN buffer (must be 256)
LenE      - Size of KeyE buffer
Output:
Pointer to Key data structure crypto_rsa_key
NULL if failed to import Key


crypto_rsa_exptmod in the CryptLib.h

Function : crypto_rsa_exptmod

File: CryptLib.h
Description:
RSA modular exponentiation
Input:
in: Input data
inlen: Input data length
out: Buffer for output data
outlen: Maximum size of the output buffer and used size on success
key: RSA key
use_private: 1 = Use RSA private key, 0 = Use RSA public key
Output:
0 on success, -1 on failure


InitCRmm in the CryptLib.h

Function : InitCRmm

File: CryptLib.h
Description:
Initializes Crypo Memory Manager


md5_vector in the CryptLib.h

Function : md5_vector

File: CryptLib.h
Description:
MD5 hash for data vector
Input:
num_elem: Number of elements in the data vector
addr: Pointers to the data areas
len: Lengths of the data blocks
mac: Buffer for the hash
Output:
none


os_mktime in the CryptLib.h

Function : os_mktime

File: CryptLib.h
Input:
year: Four digit year
month: Month (1 .. 12)
day: Day of month (1 .. 31)
hour: Hour (0 .. 23)
min: Minute (0 .. 59)
sec: Second (0 .. 60)
@t: Buffer for returning calendar time representation
(seconds since 1970-01-01 00:00:00)
Output:
int
0 on success, -1 on failure

Note: The result is in seconds from Epoch, i.e., in UTC, not in local time
which is used by POSIX mktime().


Pkcs7_certificate_validate_digest in the CryptLib.h

Function : Pkcs7_certificate_validate_digest

File: CryptLib.h
Description:
Verify certificate signature
Input:
SignedData: Complete PKCS certificate
SignCert: Signing certificate containing the public key
Output:
0 if cert has a valid signature that was signed by the issuer, -1 if not


Pkcs7_certificate_validate_timestamp_digest in the CryptLib.h

Function : Pkcs7_certificate_validate_timestamp_digest

File: CryptLib.h
Description:
Validate RFC6131 TimeStampToken digest
Input:
PKCS7 Certificate
Output:
0 if chain is valid, -1 if not


Pkcs7_parse_Authenticode_certificate in the CryptLib.h

Function : Pkcs7_parse_Authenticode_certificate

File: CryptLib.h
Description:
Parse a Pkcs7 Authenticode certificate in DER format
Caller is responsible for freeing the returned certificate by calling
Pkcs7_certificate_free().
Input:
buf: Pointer to the Pkcs7 Authenticode SignedData in DER format
len: Buffer length
Output:
Pointer to the parsed certificate or %NULL on failure


Pkcs7_return_cerificate_ptr in the CryptLib.h

Function : Pkcs7_return_cerificate_ptr

File: CryptLib.h
Description:
Return pointer within DER buffer to:
1. Signing certificate
2. Root CA certificate that is used to sign Signing certificate
Input:
SignedData: List of trusted certificates
Output:
cert if chain is valid, -1 if not found


Pkcs7_return_digestAlgorithm in the CryptLib.h

Function : Pkcs7_return_digestAlgorithm

File: CryptLib.h
Description:
Return digestAlgorithm type
Input:
PKCS7cert: Pkcs7 certificate structure
Output:
cert if chain is valid, -1 if not found


PKCS7_return_signing_cerificate in the CryptLib.h

Function : PKCS7_return_signing_cerificate

File: CryptLib.h
Description:
Return certificate with signer's public key
Input:
SignedData: List of trusted certificates
Output:
cert if chain is valid, NULL if not found


Pkcs7_return_timestamp_signing_cerificate in the CryptLib.h

Function : Pkcs7_return_timestamp_signing_cerificate

File: CryptLib.h
Description:
Return timestamps root signing certificate
Input:
SignedData: List of trusted certificates
Output:
cert if chain is valid, NULL if not found


Pkcs7_x509_certificate_chain_validate in the CryptLib.h

Function : Pkcs7_x509_certificate_chain_validate

File: CryptLib.h
Description:
Validate Pkcs7 certificate chain
Input:
trusted: List of trusted certificates
chain: Certificate chain to be validated (first chain must be issued by
igned by the second certificate in the chain and so on)
reason: Buffer for returning failure reason (X509_VALIDATE_*)
Output:
0 if chain is valid, -1 if not


Pkcs7_x509_certificate_chain_validate_with_timestamp in the CryptLib.h

Function : Pkcs7_x509_certificate_chain_validate_with_timestamp

File: CryptLib.h
Description:
Common routine to validate Pkcs7 certificate chain and revoked time stamped certs
        Supported RFC6131 TimeStampToken format
Input:
SignedData: Pkcs7 certificate chain to be validated (first chain must be issued by
signed by the second certificate in the chain and so on)
trusted   : List of trusted x509 certificates
revokeInfo: Hash certificate
action: Buffer for returning either result of operation or intermediate data, e.g TimeOfSigning
Output:
0 if chain is valid, -1 if not


Pkcs7_x509_return_Cert_pubKey in the CryptLib.h

Function : Pkcs7_x509_return_Cert_pubKey

File: CryptLib.h
Description:
Extract n-Modulus from an x509 Key certificate
Input:
pCert: DER encoded x509 certificate
Output:
0-key present, -1 if not found


Pkcs7_x509_return_signing_Key in the CryptLib.h

Function : Pkcs7_x509_return_signing_Key

File: CryptLib.h
Description:
Extract n-Modulus of a Signing Key from x509 certificate
Input:
SignedData: Pkcs7 certificate structure
Output:
0-key present, -1 if not found


pkcs_1_pss_decode in the CryptLib.h

Function : pkcs_1_pss_decode

File: CryptLib.h
Description:
PKCS #1 v2.00 PSS sig decode
Input:
msghash         The hash to verify
msghashlen      The length of the hash (octets)
sig             The signature data (encoded data)
siglen          The length of the signature data (octets)
saltlen         The length of the salt used (octets)
modulus_bitlen  The bit length of the RSA modulus
Output:
CRYPT_OK if successful (even if the comparison failed)


pkcs_1_v1_5_decode in the CryptLib.h

Function : pkcs_1_v1_5_decode

File: CryptLib.h
Description:
Strip PKCS #1 header
Input:
Sig              The encoded data to decode
siglen          The length of the encoded data (octets)
Output:
CRYPT_OK if successful


ResetCRmm in the CryptLib.h

Function : ResetCRmm

File: CryptLib.h
Description:
Resets Crypto Memory Manager. Clears mem heap and descriptors


RuntimeCryptLibConstructorInSMM in the CryptLib.h

Function : RuntimeCryptLibConstructorInSMM

File: CryptLib.h
Description:
Init Crypto lib internal state.
This function is called from outside of SMM during SMM registration.
Input:
IN EFI_HANDLE       ImageHandle
IN EFI_SYSTEM_TABLE *SystemTable
Output:
EFI_STATUS


set_crypt_efitime in the CryptLib.h

Function : set_crypt_efitime

File: CryptLib.h
Description:
updates the local value of crypto EfiTime
Input:
*EFI_TIME
Output:
none


sha1_vector in the CryptLib.h

Function : sha1_vector

File: CryptLib.h
Description:
SHA-1 hash for data vector
Input:
num_elem: Number of elements in the data vector
addr: Pointers to the data areas
len: Lengths of the data blocks
mac: Buffer for the hash
Output:
none


sha256_vector in the CryptLib.h

Function : sha256_vector

File: CryptLib.h
Description:
SHA256 hash for data vector
Input:
num_elem: Number of elements in the data vector
addr: Pointers to the data areas
len: Lengths of the data blocks
mac: Buffer for the hash
Output:
none


wpa_set_trace_level in the CryptLib.h

Function : wpa_set_trace_level

File: CryptLib.h
Description:
sets the debug message print mode
Input:
level: print level: 0 - no messages, 1 - minimal, 2 - full
Output:
none


x509_certificate_chain_validate in the CryptLib.h

Function : x509_certificate_chain_validate

File: CryptLib.h
Description:
Validate X.509 certificate chain
Input:
trusted: List of trusted certificates
chain: Certificate chain to be validated (first chain must be issued by
igned by the second certificate in the chain and so on)
reason: Buffer for returning failure reason (X509_VALIDATE_*)
Output:
0 if chain is valid, -1 if not


x509_certificate_parse in the CryptLib.h

Function : x509_certificate_parse

File: CryptLib.h
Description:
Parse a X.509 certificate in DER format
Caller is responsible for freeing the returned certificate by calling
x509_certificate_free().
Input:
buf: Pointer to the X.509 certificate in DER format
len: Buffer length
Output:
Pointer to the parsed certificate or %NULL on failure


Functions in Alphabetical Order

In Alphabetical Order

The following topics provide a list in alphabetical order.
For a list by file name, see By File Name.

  • B
  • C
  • I
  • M
  • O
  • P
  • R
  • S
  • W
  • X


Functions in Alphabetical Order

B

Function | Description
base64_decode | Do in-place decoding of base-64 data of LENGTH in BUFFER.


Functions in Alphabetical Order

C

Function | Description
crypto_import_asn1_public_key | Imports RSA2048 public key from ASN.1 DER format into internal crypto_rsa_key data structure
crypto_import_rsa2048_public_key | Imports RSA2048 public key binary from RAW format into internal crypto_rsa_key data structure
crypto_rsa_exptmod | RSA modular exponentiation


Functions in Alphabetical Order

I

Function | Description
InitCRmm | Initializes Crypo Memory Manager


Functions in Alphabetical Order

M

Function | Description
md5_vector | MD5 hash for data vector


Functions in Alphabetical Order

O

Function | Description
os_mktime |


Functions in Alphabetical Order

P

Function | Description
Pkcs7_certificate_validate_digest | Verify certificate signature
Pkcs7_certificate_validate_timestamp_digest | Validate RFC6131 TimeStampToken digest
Pkcs7_parse_Authenticode_certificate | Parse a Pkcs7 Authenticode certificate in DER format Caller is responsible for freeing the returned certificate by calling Pkcs7_certificate_free().
Pkcs7_return_cerificate_ptr | Return pointer within DER buffer to: 1. Signing certificate 2. Root CA certificate that is used to sign Signing certificate
Pkcs7_return_digestAlgorithm | Return digestAlgorithm type
PKCS7_return_signing_cerificate | Return certificate with signer's public key
Pkcs7_return_timestamp_signing_cerificate | Return timestamps root signing certificate
Pkcs7_x509_certificate_chain_validate | Validate Pkcs7 certificate chain
Pkcs7_x509_certificate_chain_validate_with_timestamp | Common routine to validate Pkcs7 certificate chain and revoked time stamped certs Supported RFC6131 TimeStampToken format
Pkcs7_x509_return_Cert_pubKey | Extract n-Modulus from an x509 Key certificate
Pkcs7_x509_return_signing_Key | Extract n-Modulus of a Signing Key from x509 certificate
Pkcs7Verify | Verifies the validility of a PKCS#7 signed data as described in "PKCS #7: Cryptographic Message Syntax Standard". If P7Data is NULL, then ASSERT().
pkcs_1_pss_decode | PKCS #1 v2.00 PSS sig decode
pkcs_1_v1_5_decode | Strip PKCS #1 header


Functions in Alphabetical Order

R

Function | Description
ResetCRmm | Resets Crypto Memory Manager. Clears mem heap and descriptors
RsaFree | Release the specified RSA Context.
RsaNew | Allocates and Initializes one RSA Context for subsequent use.
RsaPkcs1Verify | Verifies the RSA-SSA signature with EMSA-PKCS1-v1_5 encoding scheme defined in RSA PKCS#1. If RsaContext is NULL, then ASSERT(). If MessageHash is NULL, then ASSERT(). If Signature is NULL, then ASSERT(). If HashLength is not equal to the size of SHA-1 or SHA-256 digest, then ASSERT().
RsaSetKey | Sets the tag-designated RSA key component into the established RSA context from the user-specified nonnegative integer (octet string format represented in RSA PKCS#1). If RsaContext is NULL, then ASSERT().
RuntimeCryptLibConstructorInSMM | Init Crypto lib internal state. This function is called from outside of SMM during SMM registration.


Functions in Alphabetical Order

S

Function | Description
set_crypt_efitime | updates the local value of crypto EfiTime
sha1_vector | SHA-1 hash for data vector
Sha1Final | Completes SHA-1 hash computation and retrieves the digest value into the specified memory. After this function has been called, the SHA-1 context cannot be used again. If Sha1Context is NULL, then ASSERT(). If HashValue is NULL, then ASSERT().
Sha1GetContextSize | Retrieves the size, in bytes, of the context buffer required for SHA-1 hash operations.
Sha1Init | Initializes user-supplied memory pointed by Sha1Context as the SHA-1 hash context for subsequent use. If Sha1Context is NULL, then ASSERT().
sha256_vector | SHA256 hash for data vector
Sha256Final | Completes SHA-256 hash computation and retrieves the digest value into the specified memory. After this function has been called, the SHA-256 context cannot be used again. If Sha256Context is NULL, then ASSERT(). If HashValue is NULL, then ASSERT().
Sha256GetContextSize | Retrieves the size, in bytes, of the context buffer required for SHA256 hash operations.
Sha256Init | Initializes user-supplied memory pointed by Sha256Context as SHA-256 hash context for subsequent use. If Sha256Context is NULL, then ASSERT().


Functions in Alphabetical Order

W

Function | Description
wpa_set_trace_level | sets the debug message print mode


Functions in Alphabetical Order

X

Function | Description
x509_certificate_chain_validate | Validate X.509 certificate chain
x509_certificate_parse | Parse a X.509 certificate in DER format Caller is responsible for freeing the returned certificate by calling x509_certificate_free().


General Information


Copyright

American Megatrends, Inc.
5555 Oakbrook Parkway
Suite 200
Norcross, GA 30093 (USA)

Copyright (c) 1999-2014 American Megatrends, Inc. All Rights Reserved.

This publication contains proprietary information, which is protected by copyright. No part of this publication may be reproduced, transcribed, stored in a retrieval system, translated into any language or computer language, or transmitted in any form whatsoever without the prior written consent of the publisher, American Megatrends, Inc.

American Megatrends, Inc. retains the right to update, change, modify this publication at any time, without notice.

For Additional Information

Call American Megatrends BIOS Sales Department at 1-800-828-9264 for additional information.

Limitations of Liability

In no event shall American Megatrends be held liable for any loss, expenses, or damages of any kind whatsoever, whether direct, indirect, incidental, or consequential, arising from the design or use of this product or the support materials provided with the product.

Limited Warranty

No warranties are made, either expressed or implied, with regard to the contents of this work, its merchantability, or fitness for a particular use. American Megatrends assumes no responsibility for errors and omissions or for the uses made of the material contained herein or reader decisions based on such use.

Trademark and Copyright Acknowledgments

All product names used in this publication are for identification purposes only and are trademarks of their respective Companies.