CryptoPkg: add AeadAesGcm to Crypto Service.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4036

Signed-off-by: Qi Zhang <qi1.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Xiaoyu Lu <xiaoyu1.lu@intel.com>
Cc: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

5 files changed, 282 insertions, 2 deletions

diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc
index 417804f64f..79c6a4eeae 100644
--- a/CryptoPkg/CryptoPkg.dsc
+++ b/CryptoPkg/CryptoPkg.dsc
@@ -215,6 +215,8 @@
   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.Init                        | TRUE

   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcEncrypt                  | TRUE

   gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.Aes.Services.CbcDecrypt                  | TRUE

+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Services.Encrypt              | TRUE

+  gEfiCryptoPkgTokenSpaceGuid.PcdCryptoServiceFamilyEnable.AeadAesGcm.Services.Decrypt              | TRUE

 !endif

 

 ###################################################################################################

diff --git a/CryptoPkg/Driver/Crypto.c b/CryptoPkg/Driver/Crypto.c
index b54e59fd07..9562dfeec5 100644
--- a/CryptoPkg/Driver/Crypto.c
+++ b/CryptoPkg/Driver/Crypto.c
@@ -4938,6 +4938,95 @@ CryptoServiceParallelHash256HashAll (
   return CALL_BASECRYPTLIB (ParallelHash.Services.HashAll, ParallelHash256HashAll, (Input, InputByteLen, BlockSize, Output, OutputByteLen, Customization, CustomByteLen), FALSE);

 }

 

+/**

+  Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).

+

+  IvSize must be 12, otherwise FALSE is returned.

+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.

+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.

+

+  @param[in]   Key         Pointer to the encryption key.

+  @param[in]   KeySize     Size of the encryption key in bytes.

+  @param[in]   Iv          Pointer to the IV value.

+  @param[in]   IvSize      Size of the IV value in bytes.

+  @param[in]   AData       Pointer to the additional authenticated data (AAD).

+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.

+  @param[in]   DataIn      Pointer to the input data buffer to be encrypted.

+  @param[in]   DataInSize  Size of the input data buffer in bytes.

+  @param[out]  TagOut      Pointer to a buffer that receives the authentication tag output.

+  @param[in]   TagSize     Size of the authentication tag in bytes.

+  @param[out]  DataOut     Pointer to a buffer that receives the encryption output.

+  @param[out]  DataOutSize Size of the output data buffer in bytes.

+

+  @retval TRUE   AEAD AES-GCM authenticated encryption succeeded.

+  @retval FALSE  AEAD AES-GCM authenticated encryption failed.

+

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceAeadAesGcmEncrypt (

+  IN   CONST UINT8  *Key,

+  IN   UINTN        KeySize,

+  IN   CONST UINT8  *Iv,

+  IN   UINTN        IvSize,

+  IN   CONST UINT8  *AData,

+  IN   UINTN        ADataSize,

+  IN   CONST UINT8  *DataIn,

+  IN   UINTN        DataInSize,

+  OUT  UINT8        *TagOut,

+  IN   UINTN        TagSize,

+  OUT  UINT8        *DataOut,

+  OUT  UINTN        *DataOutSize

+  )

+{

+  return CALL_BASECRYPTLIB (AeadAesGcm.Services.Encrypt, AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);

+}

+

+/**

+  Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).

+

+  IvSize must be 12, otherwise FALSE is returned.

+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.

+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.

+  If additional authenticated data verification fails, FALSE is returned.

+

+  @param[in]   Key         Pointer to the encryption key.

+  @param[in]   KeySize     Size of the encryption key in bytes.

+  @param[in]   Iv          Pointer to the IV value.

+  @param[in]   IvSize      Size of the IV value in bytes.

+  @param[in]   AData       Pointer to the additional authenticated data (AAD).

+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.

+  @param[in]   DataIn      Pointer to the input data buffer to be decrypted.

+  @param[in]   DataInSize  Size of the input data buffer in bytes.

+  @param[in]   Tag         Pointer to a buffer that contains the authentication tag.

+  @param[in]   TagSize     Size of the authentication tag in bytes.

+  @param[out]  DataOut     Pointer to a buffer that receives the decryption output.

+  @param[out]  DataOutSize Size of the output data buffer in bytes.

+

+  @retval TRUE   AEAD AES-GCM authenticated decryption succeeded.

+  @retval FALSE  AEAD AES-GCM authenticated decryption failed.

+

+**/

+BOOLEAN

+EFIAPI

+CryptoServiceAeadAesGcmDecrypt (

+  IN   CONST UINT8  *Key,

+  IN   UINTN        KeySize,

+  IN   CONST UINT8  *Iv,

+  IN   UINTN        IvSize,

+  IN   CONST UINT8  *AData,

+  IN   UINTN        ADataSize,

+  IN   CONST UINT8  *DataIn,

+  IN   UINTN        DataInSize,

+  IN   CONST UINT8  *Tag,

+  IN   UINTN        TagSize,

+  OUT  UINT8        *DataOut,

+  OUT  UINTN        *DataOutSize

+  )

+{

+  return CALL_BASECRYPTLIB (AeadAesGcm.Services.Decrypt, AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);

+}

+

 const EDKII_CRYPTO_PROTOCOL  mEdkiiCrypto = {

   /// Version

   CryptoServiceGetCryptoVersion,

@@ -5159,5 +5248,8 @@ const EDKII_CRYPTO_PROTOCOL  mEdkiiCrypto = {
   CryptoServiceHkdfSha256Expand,

   CryptoServiceHkdfSha384ExtractAndExpand,

   CryptoServiceHkdfSha384Extract,

-  CryptoServiceHkdfSha384Expand

+  CryptoServiceHkdfSha384Expand,

+  /// Aead Aes GCM

+  CryptoServiceAeadAesGcmEncrypt,

+  CryptoServiceAeadAesGcmDecrypt

 };

diff --git a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
index 5caf597421..8a8d7c179d 100644
--- a/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
+++ b/CryptoPkg/Include/Pcd/PcdCryptoServiceFamilyEnable.h
@@ -319,6 +319,13 @@ typedef struct {
     } Services;

     UINT32    Family;

   } ParallelHash;

+  union {

+    struct {

+      UINT8    Encrypt : 1;

+      UINT8    Decrypt : 1;

+    } Services;

+    UINT32    Family;

+  } AeadAesGcm;

 } PCD_CRYPTO_SERVICE_FAMILY_ENABLE;

 

 #endif

diff --git a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
index 6a57daea6a..eaf9ad0550 100644
--- a/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
+++ b/CryptoPkg/Library/BaseCryptLibOnProtocolPpi/CryptLib.c
@@ -1553,6 +1553,99 @@ AesCbcDecrypt (
 }

 

 // =====================================================================================

+//    Authenticated Encryption with Associated Data (AEAD) Cryptography Primitive

+// =====================================================================================

+

+/**

+  Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).

+

+  IvSize must be 12, otherwise FALSE is returned.

+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.

+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.

+

+  @param[in]   Key         Pointer to the encryption key.

+  @param[in]   KeySize     Size of the encryption key in bytes.

+  @param[in]   Iv          Pointer to the IV value.

+  @param[in]   IvSize      Size of the IV value in bytes.

+  @param[in]   AData       Pointer to the additional authenticated data (AAD).

+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.

+  @param[in]   DataIn      Pointer to the input data buffer to be encrypted.

+  @param[in]   DataInSize  Size of the input data buffer in bytes.

+  @param[out]  TagOut      Pointer to a buffer that receives the authentication tag output.

+  @param[in]   TagSize     Size of the authentication tag in bytes.

+  @param[out]  DataOut     Pointer to a buffer that receives the encryption output.

+  @param[out]  DataOutSize Size of the output data buffer in bytes.

+

+  @retval TRUE   AEAD AES-GCM authenticated encryption succeeded.

+  @retval FALSE  AEAD AES-GCM authenticated encryption failed.

+

+**/

+BOOLEAN

+EFIAPI

+AeadAesGcmEncrypt (

+  IN   CONST UINT8  *Key,

+  IN   UINTN        KeySize,

+  IN   CONST UINT8  *Iv,

+  IN   UINTN        IvSize,

+  IN   CONST UINT8  *AData,

+  IN   UINTN        ADataSize,

+  IN   CONST UINT8  *DataIn,

+  IN   UINTN        DataInSize,

+  OUT  UINT8        *TagOut,

+  IN   UINTN        TagSize,

+  OUT  UINT8        *DataOut,

+  OUT  UINTN        *DataOutSize

+  )

+{

+  CALL_CRYPTO_SERVICE (AeadAesGcmEncrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, TagOut, TagSize, DataOut, DataOutSize), FALSE);

+}

+

+/**

+  Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).

+

+  IvSize must be 12, otherwise FALSE is returned.

+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.

+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.

+  If additional authenticated data verification fails, FALSE is returned.

+

+  @param[in]   Key         Pointer to the encryption key.

+  @param[in]   KeySize     Size of the encryption key in bytes.

+  @param[in]   Iv          Pointer to the IV value.

+  @param[in]   IvSize      Size of the IV value in bytes.

+  @param[in]   AData       Pointer to the additional authenticated data (AAD).

+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.

+  @param[in]   DataIn      Pointer to the input data buffer to be decrypted.

+  @param[in]   DataInSize  Size of the input data buffer in bytes.

+  @param[in]   Tag         Pointer to a buffer that contains the authentication tag.

+  @param[in]   TagSize     Size of the authentication tag in bytes.

+  @param[out]  DataOut     Pointer to a buffer that receives the decryption output.

+  @param[out]  DataOutSize Size of the output data buffer in bytes.

+

+  @retval TRUE   AEAD AES-GCM authenticated decryption succeeded.

+  @retval FALSE  AEAD AES-GCM authenticated decryption failed.

+

+**/

+BOOLEAN

+EFIAPI

+AeadAesGcmDecrypt (

+  IN   CONST UINT8  *Key,

+  IN   UINTN        KeySize,

+  IN   CONST UINT8  *Iv,

+  IN   UINTN        IvSize,

+  IN   CONST UINT8  *AData,

+  IN   UINTN        ADataSize,

+  IN   CONST UINT8  *DataIn,

+  IN   UINTN        DataInSize,

+  IN   CONST UINT8  *Tag,

+  IN   UINTN        TagSize,

+  OUT  UINT8        *DataOut,

+  OUT  UINTN        *DataOutSize

+  )

+{

+  CALL_CRYPTO_SERVICE (AeadAesGcmDecrypt, (Key, KeySize, Iv, IvSize, AData, ADataSize, DataIn, DataInSize, Tag, TagSize, DataOut, DataOutSize), FALSE);

+}

+

+// =====================================================================================

 //    Asymmetric Cryptography Primitive

 // =====================================================================================

 

diff --git a/CryptoPkg/Private/Protocol/Crypto.h b/CryptoPkg/Private/Protocol/Crypto.h
index da726e8381..a66be2c388 100644
--- a/CryptoPkg/Private/Protocol/Crypto.h
+++ b/CryptoPkg/Private/Protocol/Crypto.h
@@ -21,7 +21,7 @@
 /// the EDK II Crypto Protocol is extended, this version define must be

 /// increased.

 ///

-#define EDKII_CRYPTO_VERSION  10

+#define EDKII_CRYPTO_VERSION  11

 

 ///

 /// EDK II Crypto Protocol forward declaration

@@ -3805,6 +3805,89 @@ BOOLEAN
   IN       UINTN  CustomByteLen

   );

 

+/**

+  Performs AEAD AES-GCM authenticated encryption on a data buffer and additional authenticated data (AAD).

+

+  IvSize must be 12, otherwise FALSE is returned.

+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.

+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.

+

+  @param[in]   Key         Pointer to the encryption key.

+  @param[in]   KeySize     Size of the encryption key in bytes.

+  @param[in]   Iv          Pointer to the IV value.

+  @param[in]   IvSize      Size of the IV value in bytes.

+  @param[in]   AData       Pointer to the additional authenticated data (AAD).

+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.

+  @param[in]   DataIn      Pointer to the input data buffer to be encrypted.

+  @param[in]   DataInSize  Size of the input data buffer in bytes.

+  @param[out]  TagOut      Pointer to a buffer that receives the authentication tag output.

+  @param[in]   TagSize     Size of the authentication tag in bytes.

+  @param[out]  DataOut     Pointer to a buffer that receives the encryption output.

+  @param[out]  DataOutSize Size of the output data buffer in bytes.

+

+  @retval TRUE   AEAD AES-GCM authenticated encryption succeeded.

+  @retval FALSE  AEAD AES-GCM authenticated encryption failed.

+

+**/

+typedef

+BOOLEAN

+(EFIAPI *EDKII_AEAD_AES_GCM_ENCRYPT)(

+  IN   CONST UINT8  *Key,

+  IN   UINTN        KeySize,

+  IN   CONST UINT8  *Iv,

+  IN   UINTN        IvSize,

+  IN   CONST UINT8  *AData,

+  IN   UINTN        ADataSize,

+  IN   CONST UINT8  *DataIn,

+  IN   UINTN        DataInSize,

+  OUT  UINT8        *TagOut,

+  IN   UINTN        TagSize,

+  OUT  UINT8        *DataOut,

+  OUT  UINTN        *DataOutSize

+  );

+

+/**

+  Performs AEAD AES-GCM authenticated decryption on a data buffer and additional authenticated data (AAD).

+

+  IvSize must be 12, otherwise FALSE is returned.

+  KeySize must be 16, 24 or 32, otherwise FALSE is returned.

+  TagSize must be 12, 13, 14, 15, 16, otherwise FALSE is returned.

+  If additional authenticated data verification fails, FALSE is returned.

+

+  @param[in]   Key         Pointer to the encryption key.

+  @param[in]   KeySize     Size of the encryption key in bytes.

+  @param[in]   Iv          Pointer to the IV value.

+  @param[in]   IvSize      Size of the IV value in bytes.

+  @param[in]   AData       Pointer to the additional authenticated data (AAD).

+  @param[in]   ADataSize   Size of the additional authenticated data (AAD) in bytes.

+  @param[in]   DataIn      Pointer to the input data buffer to be decrypted.

+  @param[in]   DataInSize  Size of the input data buffer in bytes.

+  @param[in]   Tag         Pointer to a buffer that contains the authentication tag.

+  @param[in]   TagSize     Size of the authentication tag in bytes.

+  @param[out]  DataOut     Pointer to a buffer that receives the decryption output.

+  @param[out]  DataOutSize Size of the output data buffer in bytes.

+

+  @retval TRUE   AEAD AES-GCM authenticated decryption succeeded.

+  @retval FALSE  AEAD AES-GCM authenticated decryption failed.

+

+**/

+typedef

+BOOLEAN

+(EFIAPI *EDKII_AEAD_AES_GCM_DECRYPT)(

+  IN   CONST UINT8  *Key,

+  IN   UINTN        KeySize,

+  IN   CONST UINT8  *Iv,

+  IN   UINTN        IvSize,

+  IN   CONST UINT8  *AData,

+  IN   UINTN        ADataSize,

+  IN   CONST UINT8  *DataIn,

+  IN   UINTN        DataInSize,

+  IN   CONST UINT8  *Tag,

+  IN   UINTN        TagSize,

+  OUT  UINT8        *DataOut,

+  OUT  UINTN        *DataOutSize

+  );

+

 ///

 /// EDK II Crypto Protocol

 ///

@@ -4010,6 +4093,9 @@ struct _EDKII_CRYPTO_PROTOCOL {
   EDKII_CRYPTO_HKDF_SHA_384_EXTRACT_AND_EXPAND       HkdfSha384ExtractAndExpand;

   EDKII_CRYPTO_HKDF_SHA_384_EXTRACT                  HkdfSha384Extract;

   EDKII_CRYPTO_HKDF_SHA_384_EXPAND                   HkdfSha384Expand;

+  /// AEAD AES-GCM

+  EDKII_AEAD_AES_GCM_ENCRYPT                         AeadAesGcmEncrypt;

+  EDKII_AEAD_AES_GCM_DECRYPT                         AeadAesGcmDecrypt;

 };

 

 extern GUID  gEdkiiCryptoProtocolGuid;