Tianocore/edk2.git/CryptoPkg/Library/BaseCryptLib, branch dependabot/github_actions/actions/setup-python-7

CryptoPkg/BaseCryptLib: Add SLH-DSA Support

2026-07-21T09:17:50+00:00

Created SLH-DSA API functions to configure public and private keys for SLH-DSA algorithm. This will allow users to sign and verify with SLH-DSA. Unit tests were added to confirm operation of the API. Signed-off-by: Michael G.A. Holland

CryptoPkg/BaseCryptLib: ML-DSA updates

2026-07-20T11:34:40+00:00

Include validation check for Context and ContextSize in signature function. Updated ReadMe to show ML-DSA support Signed-off-by: Michael G.A. Holland

CryptoPkg/BaseCryptLib: EdDsa updates

2026-07-20T03:23:22+00:00

Include validation checks for Context and ContextSize in sign and verify functions. Returned FALSE for EdDsaGeneratePubKey. Updated ReadMe to show EdDsa support Signed-off-by: Michael G.A. Holland

CryptoPkg/BaseCryptLib: Add ML-DSA Support

2026-07-14T03:26:52+00:00

Created ML-DSA API functions to configure public and private keys for ML-DSA algorithm. This will allow users to sign and verify with ML-DSA. Unit tests were add to confirm operation of the API. Signed-off-by: Michael G.A. Holland

CryptoPkg/BaseCryptLib: Add ED448 verification and signature fcns

2026-07-01T01:26:24+00:00

Implemented signature and verification functions for ED448; Updated documentation and unit tests to cover new verification functions Signed-off-by: Michael G.A. Holland

CryptoPkg: Enable SHA256 hash in SecCryptLib

2026-06-25T16:53:36+00:00

Enable CryptSha256 hash in SecCryptLib as this is required by Arm CCA. The hash algorithm used by the Arm CCA Realm Extensible Measurement (REM) registers is either SHA256 or SHA512. To enable measurements in the early boot phase enable SHA256 hash algorithm in SecCryptLib. Signed-off-by: Sami Mujawar

CryptoPkg: Added lite version openssl library

2026-06-15T08:54:47+00:00

Lite version OpensslLib base on OpensslLibFull but no-camellia, no -ecx and no-dh. It save the size about ~192KB. REF: Signed-off-by: Lee LonghaoX

CryptoPkg: Fix leaks and failure-path mutation of RSA-owned values

2026-05-29T03:12:15+00:00

RsaSetKey passed RSA-internal BIGNUMs (returned by RSA_get0_key / RSA_get0_factors / RSA_get0_crt_params as const) directly to BN_bin2bn, which mutates its destination in place. This violates the OpenSSL API contract and can leave RsaContext in a partially modified state on failure paths: BN_bin2bn has already overwritten one of n / e / d / p / q / dp / dq / qInv, the function then returns FALSE on a subsequent BN_dup or RSA_set0_* failure, and the caller has no indication that the RSA object was silently changed. The same paths also leaked temporary BIGNUMs allocated by BN_bin2bn or BN_new. This patch splits RsaSetKey into a small input-validating dispatcher plus three static helpers (RsaSetKeyNED, RsaSetKeyFactors, RsaSetKeyCrtParams), one per RSA_set0_* setter. Each helper: - Allocates a fresh BIGNUM for the slot being set via BN_bin2bn(BigNumber, BnSize, NULL); the NULL destination forces BN_bin2bn to allocate so no RSA-owned BIGNUM is mutated. - Reads the current RSA state via RSA_get0_* purely for inspection. - For slots not being set, passes NULL when RSA already has a value (preserves it) or supplies an empty BN_new() placeholder when RSA's slot is still NULL. - Atomically installs via RSA_set0_*, which takes ownership of every non-NULL argument on success and of none on failure. - Routes all exits through a single label that frees any locally held BIGNUM. Memory leaks in the early-return paths are fixed as a consequence. The previous BN_dup calls are no longer needed and are removed. Signed-off-by: Mingjie Shen

CryptoPkg: Add digest-based RSA-PSS sign and verify APIs

2026-04-07T12:26:54+00:00

Add RsaPssSignDigest() and RsaPssVerifyDigest() to BaseCryptLib for signing/verifying precomputed digests. Provide OpenSSL/MbedTLS/Null implementations, expose via EDKII_CRYPTO_PROTOCOL (v24), and add PCD controls for independent service enabling. Include unit tests. Signed-off-by: Anbazhagan Baraneedharan

CryptoPkg: BaseCryptLib: Reject empty X.509 cert when retrieving public key

2026-03-10T06:33:40+00:00

Explicitly reject zero-length X.509 certificate buffers when retrieving a public key. For this invalid case, the input context pointer is set to NULL as a defensive measure. Signed-off-by: Kun Qin