From 5396354b868bd6652600a654bba7df16701ac1cb Mon Sep 17 00:00:00 2001 From: Jiaqi Gao Date: Mon, 26 Apr 2021 12:31:15 +0800 Subject: SecurityPkg: Add constraints on PK strength REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3293 Add constraints on the key strength of enrolled platform key(PK), which must be greater than or equal to 2048 bit. PK key strength is required by Intel SDL and MSFT, etc. This limitation prevents user from using weak keys as PK. The original code to check the certificate file type is placed in a new function CheckX509Certificate(), which checks if the X.509 certificate meets the requirements of encode type, RSA-Key strengh, etc. Cc: Min Xu Cc: Jiewen Yao Signed-off-by: Jiaqi Gao Reviewed-by: Min Xu Acked-by: Jiewen Yao --- .../SecureBootConfigDxe/SecureBootConfigImpl.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h') diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h index 1fafae07ac..268f015e8e 100644 --- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h +++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h @@ -93,6 +93,27 @@ extern EFI_IFR_GUID_LABEL *mEndLabel; #define HASHALG_RAW 0x00000004 #define HASHALG_MAX 0x00000004 +// +// Certificate public key minimum size (bytes) +// +#define CER_PUBKEY_MIN_SIZE 256 + +// +// Types of errors may occur during certificate enrollment. +// +typedef enum { + None_Error = 0, + // + // Unsupported_type indicates the certificate type is not supported. + // + Unsupported_Type, + // + // Unqualified_key indicates the key strength of certificate is not + // strong enough. + // + Unqualified_Key, + Enroll_Error_Max +}ENROLL_KEY_ERROR; typedef struct { UINTN Signature; -- cgit v1.2.3