From 8f698f0a646124ede518d3e255ef725de1239639 Mon Sep 17 00:00:00 2001
From: "Hou, Wenxing" <wenxing.hou@intel.com>
Date: Fri, 29 Mar 2024 10:32:42 +0800
Subject: CryptoPkg: Remove interdependence for RsaPssVerify

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4742

Remove interdependence for RsaPssVerify, only use original
mbedtls API.
Because APIs such as Sha512Init may be closed by the platform PCD.
And this patch optimize the hash flow.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yi Li <yi1.li@intel.com>
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
Reviewed-by: Yi Li <yi1.li@intel.com>
---
 .../Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c   | 74 ++++------------------
 1 file changed, 11 insertions(+), 63 deletions(-)

(limited to 'CryptoPkg')

diff --git a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
index 7927c34..ecd1bd1 100644
--- a/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
+++ b/CryptoPkg/Library/BaseCryptLibMbedTls/Pk/CryptRsaPss.c
@@ -11,6 +11,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 
 #include "InternalCryptLib.h"
 #include <mbedtls/rsa.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
 
 /**
   Verifies the RSA signature with RSASSA-PSS signature scheme defined in RFC 8017.
@@ -43,11 +45,8 @@ RsaPssVerify (
   )
 {
   INT32                Ret;
-  mbedtls_md_type_t    md_alg;
+  mbedtls_md_type_t    MdAlg;
   UINT8                HashValue[SHA512_DIGEST_SIZE];
-  BOOLEAN              Status;
-  UINTN                ShaCtxSize;
-  VOID                 *ShaCtx;
   mbedtls_rsa_context  *RsaKey;
 
   if (RsaContext == NULL) {
@@ -75,78 +74,27 @@ RsaPssVerify (
 
   switch (DigestLen) {
     case SHA256_DIGEST_SIZE:
-      md_alg     = MBEDTLS_MD_SHA256;
-      ShaCtxSize = Sha256GetContextSize ();
-      ShaCtx     = AllocateZeroPool (ShaCtxSize);
-
-      Status = Sha256Init (ShaCtx);
-      if (!Status) {
-        return FALSE;
-      }
-
-      Status = Sha256Update (ShaCtx, Message, MsgSize);
-      if (!Status) {
-        FreePool (ShaCtx);
+      MdAlg = MBEDTLS_MD_SHA256;
+      if (mbedtls_sha256 (Message, MsgSize, HashValue, FALSE) != 0) {
         return FALSE;
       }
 
-      Status = Sha256Final (ShaCtx, HashValue);
-      if (!Status) {
-        FreePool (ShaCtx);
-        return FALSE;
-      }
-
-      FreePool (ShaCtx);
       break;
 
     case SHA384_DIGEST_SIZE:
-      md_alg     = MBEDTLS_MD_SHA384;
-      ShaCtxSize = Sha384GetContextSize ();
-      ShaCtx     = AllocateZeroPool (ShaCtxSize);
-
-      Status = Sha384Init (ShaCtx);
-      if (!Status) {
-        return FALSE;
-      }
-
-      Status = Sha384Update (ShaCtx, Message, MsgSize);
-      if (!Status) {
-        FreePool (ShaCtx);
+      MdAlg = MBEDTLS_MD_SHA384;
+      if (mbedtls_sha512 (Message, MsgSize, HashValue, TRUE) != 0) {
         return FALSE;
       }
 
-      Status = Sha384Final (ShaCtx, HashValue);
-      if (!Status) {
-        FreePool (ShaCtx);
-        return FALSE;
-      }
-
-      FreePool (ShaCtx);
       break;
 
     case SHA512_DIGEST_SIZE:
-      md_alg     = MBEDTLS_MD_SHA512;
-      ShaCtxSize = Sha512GetContextSize ();
-      ShaCtx     = AllocateZeroPool (ShaCtxSize);
-
-      Status = Sha512Init (ShaCtx);
-      if (!Status) {
-        return FALSE;
-      }
-
-      Status = Sha512Update (ShaCtx, Message, MsgSize);
-      if (!Status) {
-        FreePool (ShaCtx);
-        return FALSE;
-      }
-
-      Status = Sha512Final (ShaCtx, HashValue);
-      if (!Status) {
-        FreePool (ShaCtx);
+      MdAlg = MBEDTLS_MD_SHA512;
+      if (mbedtls_sha512 (Message, MsgSize, HashValue, FALSE) != 0) {
         return FALSE;
       }
 
-      FreePool (ShaCtx);
       break;
 
     default:
@@ -157,11 +105,11 @@ RsaPssVerify (
     return FALSE;
   }
 
-  mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, md_alg);
+  mbedtls_rsa_set_padding (RsaContext, MBEDTLS_RSA_PKCS_V21, MdAlg);
 
   Ret = mbedtls_rsa_rsassa_pss_verify (
           RsaContext,
-          md_alg,
+          MdAlg,
           (UINT32)DigestLen,
           HashValue,
           Signature
-- 
cgit v1.1