Tianocore/edk2.git/CryptoPkg/Library, branch master

CryptoPkg: Fix memcpy alias prototype to match the aliasee

2026-09-08T04:05:18+00:00

The memcpy alias in IntrinsicLib declares its count parameter as unsigned int while the aliasee __memcpy uses size_t. On 64-bit targets these are different widths. clang 23 diagnoses this through -Wattribute-alias: CopyMem.c:29:17: warning: alias and aliasee have different types 'void *(void *, const void *, unsigned int)' and 'void *(void *, const void *, size_t)' [-Wattribute-alias] and builds that treat warnings as errors fail, e.g. OVMF built with the CLANGDWARF toolchain in Yocto. Declare the alias with size_t so both signatures agree. Signed-off-by: Sunil Dora

CryptoPkg: Fix SIZE_MAX, UINTPTR_MAX and intptr_t definitions

2026-08-31T12:55:20+00:00

CrtLibSupport.h defines SIZE_MAX and UINTPTR_MAX as 32-bit constants on every target, even though the types they describe (size_t, uintptr_t) are typedefs of UINTN and so are 64-bit on X64, AARCH64, IA64, RISCV64 and LOONGARCH64. UINTPTR_MAX definition was controlled by "#if (UINT_MAX > 0xFFFFFFFFUL)", which can never be true, so it was always set to UINT32_MAX. Fix cannot just use MAX_UINTN because that isn't usable in preprocessor conditions. Instead, define SIZE_MAX and UINTPTR_MAX based on CPU. Without this, CryptoPkgMbedTls.dsc fails to build for AArch64: library/constant_time.c:58:5: error: invalid 'asm': invalid operand In addition, the wrong SIZE_MAX silently removes length-overflow checks that MbedTLS guards with "#if SIZE_MAX > UINT_MAX", including the ASN.1 length check in asn1write.c and the input length check in nist_kw.c, and selects 32-bit constant-time helper types in constant_time_internal.h. Also correct intptr_t, which was a typedef of the unsigned UINTN. The neighbouring ptrdiff_t and ssize_t already use INTN. TcgTpmPkg/Private/Include/Standard/CrtLibSupport.h is a byte-identical copy of this header and has the same defects. It is fixed by a separate patch so that each commit stays within a single package. Tested by building CryptoPkg/CryptoPkgMbedTls.dsc with GCC for AARCH64, X64 and IA32. AARCH64 does not build without this change; X64 and IA32 are unaffected. Signed-off-by: Doug Cook

CryptoPkg: Add Pkcs7Decrypt API

2026-08-28T12:37:18+00:00

Add support for a Pkcs7Decrypt API, mirroring the Pkcs7Encrypt API. I expect that the primary use of Pkcs7Decrypt would be for testing the Pkcs7Encrypt API, but maybe somebody will need it for real work someday. Signed-off-by: Doug Cook Committed-by: Doug Flick

CryptoPkg: Add Pkcs7Encrypt for BaseCryptLibMbedTls

2026-08-28T12:37:18+00:00

Add CryptPkcs7Encrypt.c with an MbedTLS-based Pkcs7Encrypt() implementation. Update BaseCryptLibMbedTls INF files (BaseCryptLib.inf, SmmCryptLib.inf, UnitTestHostBaseCryptLib.inf) to include the new source file, and update CryptoPkg/Readme.md accordingly. Signed-off-by: Doug Flick

CryptoPkg: Expose Pkcs7Encrypt via EDKII_CRYPTO_PROTOCOL

2026-08-28T12:37:18+00:00

Add EDKII_CRYPTO_PKCS7_ENCRYPT typedef and Pkcs7Encrypt member to the EDKII_CRYPTO_PROTOCOL structure. Bump protocol version to 25. Add CryptoServicePkcs7Encrypt wrapper in the Crypto driver and Pkcs7Encrypt wrapper in BaseCryptLibOnProtocolPpi. Add Pkcs7Encrypt PCD bit to PcdCryptoServiceFamilyEnable for independent service control. Update Readme.md feature table. Signed-off-by: Doug Flick

CryptoPkg: Add Pkcs7Encrypt OpenSSL and null implementations

2026-08-28T12:37:18+00:00

Add CryptPkcs7Encrypt.c with OpenSSL-based Pkcs7Encrypt() implementation using PKCS7_encrypt API. Add null stub implementations for library instances that do not support this function (PEI, Runtime, SEC, MbedTLS, Null). Update all BaseCryptLib INF files to include the new source files. Signed-off-by: Doug Flick

CryptoPkg: Merge CryptoPkgMbedTls into CryptoPkg DSC file

2026-08-28T07:30:11+00:00

Merge CryptoPkgMbedTls into CryptoPkg DSC. Null instances for SlhDsa, MlDsa, EdDsa since mbebtls not support. Fixing build error for mbedtls BaseCryptLib. Signed-off-by: Longhaox Lee

CryptoPkg/BaseCryptLib: add AARCH64 host unit test Rand source

2026-07-31T15:16:47+00:00

The host-based BaseCryptLib instance (UnitTestHostBaseCryptLib.inf) built Rand/CryptRandTsc.c only for IA32/X64. Add Rand/CryptRand.c for AARCH64 so the openssl-backed RandomSeed() is available when linking AARCH64 host tests, and advertise AARCH64 in VALID_ARCHITECTURES. Signed-off-by: Jeff Brasen

CryptoPkg: Match OpenSSL's default security level

2026-07-30T05:30:47+00:00

`TlsNew()` explicitly sets the default security level to 3. The current default in OpenSSL is security level 2 which is inherited by Linux distributions like Ubuntu 26.04. This is also the security level that was announced in https://edk2.groups.io/g/devel/topic/115039926. Signed-off-by: Jean-Tiare Le Bigot

CryptoPkg/BaseCryptLib: Add SLH-DSA Support

2026-07-21T09:17:50+00:00

Created SLH-DSA API functions to configure public and private keys for SLH-DSA algorithm. This will allow users to sign and verify with SLH-DSA. Unit tests were added to confirm operation of the API. Signed-off-by: Michael G.A. Holland