diff options
-rw-r--r-- | MdePkg/Include/Protocol/Pkcs7Verify.h | 10 | ||||
-rw-r--r-- | SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c | 8 |
2 files changed, 17 insertions, 1 deletions
diff --git a/MdePkg/Include/Protocol/Pkcs7Verify.h b/MdePkg/Include/Protocol/Pkcs7Verify.h index ca5ec75..eaeda48 100644 --- a/MdePkg/Include/Protocol/Pkcs7Verify.h +++ b/MdePkg/Include/Protocol/Pkcs7Verify.h @@ -6,7 +6,7 @@ PKCS#7 is a general-purpose cryptographic standard (defined by RFC2315,
available at http://tools.ietf.org/html/rfc2315).
-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials are licensed and made available under
the terms and conditions of the BSD License that accompanies this distribution.
The full text of the license may be found at
@@ -140,6 +140,14 @@ EFI_STATUS verifies the signature of the content is valid and signing certificate was not revoked
and is contained within a list of trusted signers.
+ Note: because this function uses hashes and the specification contains a variety of
+ hash choices, you should be aware that the check against the RevokedDb list
+ will improperly succeed if the signature is revoked using a different hash
+ algorithm. For this reason, you should either cycle through all UEFI supported
+ hashes to see if one is forbidden, or rely on a single hash choice only if the
+ UEFI signature authority only signs and revokes with a single hash (at time
+ of writing, this hash choice is SHA256).
+
@param[in] This Pointer to EFI_PKCS7_VERIFY_PROTOCOL instance.
@param[in] Signature Points to buffer containing ASN.1 DER-encoded PKCS
detached signature.
diff --git a/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c b/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c index 0da549a..ac83e6d 100644 --- a/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c +++ b/SecurityPkg/Pkcs7Verify/Pkcs7VerifyDxe/Pkcs7VerifyDxe.c @@ -1321,6 +1321,14 @@ _Exit: verifies the signature of the content is valid and signing certificate was not revoked
and is contained within a list of trusted signers.
+ Note: because this function uses hashes and the specification contains a variety of
+ hash choices, you should be aware that the check against the RevokedDb list
+ will improperly succeed if the signature is revoked using a different hash
+ algorithm. For this reason, you should either cycle through all UEFI supported
+ hashes to see if one is forbidden, or rely on a single hash choice only if the
+ UEFI signature authority only signs and revokes with a single hash (at time
+ of writing, this hash choice is SHA256).
+
@param[in] This Pointer to EFI_PKCS7_VERIFY_PROTOCOL instance.
@param[in] Signature Points to buffer containing ASN.1 DER-encoded PKCS
detached signature.
|