diff options
Diffstat (limited to 'BaseTools/Source/Python/Rsa2048Sha256Sign')
3 files changed, 406 insertions, 406 deletions
diff --git a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256GenerateKeys.py b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256GenerateKeys.py index 6c9b8c464e..8292b057c5 100644 --- a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256GenerateKeys.py +++ b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256GenerateKeys.py @@ -1,170 +1,170 @@ -## @file
-# This tool can be used to generate new RSA 2048 bit private/public key pairs
-# in a PEM file format using OpenSSL command line utilities that are installed
-# on the path specified by the system environment variable OPENSSL_PATH.
-# This tool can also optionally write one or more SHA 256 hashes of 2048 bit
-# public keys to a binary file, write one or more SHA 256 hashes of 2048 bit
-# public keys to a file in a C structure format, and in verbose mode display
-# one or more SHA 256 hashes of 2048 bit public keys in a C structure format
-# on STDOUT.
-# This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013
-#
-# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-
-'''
-Rsa2048Sha256GenerateKeys
-'''
-from __future__ import print_function
-
-import os
-import sys
-import argparse
-import subprocess
-from Common.BuildVersion import gBUILD_VERSION
-
-#
-# Globals for help information
-#
-__prog__ = 'Rsa2048Sha256GenerateKeys'
-__version__ = '%s Version %s' % (__prog__, '0.9 ' + gBUILD_VERSION)
-__copyright__ = 'Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.'
-__usage__ = '%s [options]' % (__prog__)
-
-
-if __name__ == '__main__':
- #
- # Create command line argument parser object
- #
- parser = argparse.ArgumentParser(prog=__prog__, usage=__usage__, description=__copyright__, conflict_handler='resolve')
- group = parser.add_mutually_exclusive_group(required=True)
- group.add_argument("--version", action='version', version=__version__)
- group.add_argument("-o", "--output", dest='OutputFile', type=argparse.FileType('wb'), metavar='filename', nargs='*', help="specify the output private key filename in PEM format")
- group.add_argument("-i", "--input", dest='InputFile', type=argparse.FileType('rb'), metavar='filename', nargs='*', help="specify the input private key filename in PEM format")
- parser.add_argument("--public-key-hash", dest='PublicKeyHashFile', type=argparse.FileType('wb'), help="specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in binary format")
- parser.add_argument("--public-key-hash-c", dest='PublicKeyHashCFile', type=argparse.FileType('wb'), help="specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in C structure format")
- parser.add_argument("-v", "--verbose", dest='Verbose', action="store_true", help="increase output messages")
- parser.add_argument("-q", "--quiet", dest='Quiet', action="store_true", help="reduce output messages")
- parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0, 10), default=0, help="set debug level")
-
- #
- # Parse command line arguments
- #
- args = parser.parse_args()
-
- #
- # Generate file path to Open SSL command
- #
- OpenSslCommand = 'openssl'
- try:
- OpenSslPath = os.environ['OPENSSL_PATH']
- OpenSslCommand = os.path.join(OpenSslPath, OpenSslCommand)
- if ' ' in OpenSslCommand:
- OpenSslCommand = '"' + OpenSslCommand + '"'
- except:
- pass
-
- #
- # Verify that Open SSL command is available
- #
- try:
- Process = subprocess.Popen('%s version' % (OpenSslCommand), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- except:
- print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH')
- sys.exit(1)
-
- Version = Process.communicate()
- if Process.returncode != 0:
- print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH')
- sys.exit(Process.returncode)
- print(Version[0].decode())
-
- args.PemFileName = []
-
- #
- # Check for output file argument
- #
- if args.OutputFile is not None:
- for Item in args.OutputFile:
- #
- # Save PEM filename and close output file
- #
- args.PemFileName.append(Item.name)
- Item.close()
-
- #
- # Generate private key and save it to output file in a PEM file format
- #
- Process = subprocess.Popen('%s genrsa -out %s 2048' % (OpenSslCommand, Item.name), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- Process.communicate()
- if Process.returncode != 0:
- print('ERROR: RSA 2048 key generation failed')
- sys.exit(Process.returncode)
-
- #
- # Check for input file argument
- #
- if args.InputFile is not None:
- for Item in args.InputFile:
- #
- # Save PEM filename and close input file
- #
- args.PemFileName.append(Item.name)
- Item.close()
-
- PublicKeyHash = bytearray()
- for Item in args.PemFileName:
- #
- # Extract public key from private key into STDOUT
- #
- Process = subprocess.Popen('%s rsa -in %s -modulus -noout' % (OpenSslCommand, Item), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- PublicKeyHexString = Process.communicate()[0].decode().split(b'=')[1].strip()
- if Process.returncode != 0:
- print('ERROR: Unable to extract public key from private key')
- sys.exit(Process.returncode)
- PublicKey = bytearray()
- for Index in range (0, len(PublicKeyHexString), 2):
- PublicKey = PublicKey + PublicKeyHexString[Index:Index + 2]
-
- #
- # Generate SHA 256 hash of RSA 2048 bit public key into STDOUT
- #
- Process = subprocess.Popen('%s dgst -sha256 -binary' % (OpenSslCommand), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- Process.stdin.write (PublicKey)
- PublicKeyHash = PublicKeyHash + Process.communicate()[0].decode()
- if Process.returncode != 0:
- print('ERROR: Unable to extract SHA 256 hash of public key')
- sys.exit(Process.returncode)
-
- #
- # Write SHA 256 hash of 2048 bit binary public key to public key hash file
- #
- try:
- args.PublicKeyHashFile.write (PublicKeyHash)
- args.PublicKeyHashFile.close ()
- except:
- pass
-
- #
- # Convert public key hash to a C structure string
- #
- PublicKeyHashC = '{'
- for Item in PublicKeyHash:
- PublicKeyHashC = PublicKeyHashC + '0x%02x, ' % (Item)
- PublicKeyHashC = PublicKeyHashC[:-2] + '}'
-
- #
- # Write SHA 256 of 2048 bit binary public key to public key hash C structure file
- #
- try:
- args.PublicKeyHashCFile.write (bytes(PublicKeyHashC))
- args.PublicKeyHashCFile.close ()
- except:
- pass
-
- #
- # If verbose is enabled display the public key in C structure format
- #
- if args.Verbose:
- print('PublicKeySha256 = ' + PublicKeyHashC)
+## @file +# This tool can be used to generate new RSA 2048 bit private/public key pairs +# in a PEM file format using OpenSSL command line utilities that are installed +# on the path specified by the system environment variable OPENSSL_PATH. +# This tool can also optionally write one or more SHA 256 hashes of 2048 bit +# public keys to a binary file, write one or more SHA 256 hashes of 2048 bit +# public keys to a file in a C structure format, and in verbose mode display +# one or more SHA 256 hashes of 2048 bit public keys in a C structure format +# on STDOUT. +# This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013 +# +# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR> +# SPDX-License-Identifier: BSD-2-Clause-Patent +# + +''' +Rsa2048Sha256GenerateKeys +''' +from __future__ import print_function + +import os +import sys +import argparse +import subprocess +from Common.BuildVersion import gBUILD_VERSION + +# +# Globals for help information +# +__prog__ = 'Rsa2048Sha256GenerateKeys' +__version__ = '%s Version %s' % (__prog__, '0.9 ' + gBUILD_VERSION) +__copyright__ = 'Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.' +__usage__ = '%s [options]' % (__prog__) + + +if __name__ == '__main__': + # + # Create command line argument parser object + # + parser = argparse.ArgumentParser(prog=__prog__, usage=__usage__, description=__copyright__, conflict_handler='resolve') + group = parser.add_mutually_exclusive_group(required=True) + group.add_argument("--version", action='version', version=__version__) + group.add_argument("-o", "--output", dest='OutputFile', type=argparse.FileType('wb'), metavar='filename', nargs='*', help="specify the output private key filename in PEM format") + group.add_argument("-i", "--input", dest='InputFile', type=argparse.FileType('rb'), metavar='filename', nargs='*', help="specify the input private key filename in PEM format") + parser.add_argument("--public-key-hash", dest='PublicKeyHashFile', type=argparse.FileType('wb'), help="specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in binary format") + parser.add_argument("--public-key-hash-c", dest='PublicKeyHashCFile', type=argparse.FileType('wb'), help="specify the public key hash filename that is SHA 256 hash of 2048 bit RSA public key in C structure format") + parser.add_argument("-v", "--verbose", dest='Verbose', action="store_true", help="increase output messages") + parser.add_argument("-q", "--quiet", dest='Quiet', action="store_true", help="reduce output messages") + parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0, 10), default=0, help="set debug level") + + # + # Parse command line arguments + # + args = parser.parse_args() + + # + # Generate file path to Open SSL command + # + OpenSslCommand = 'openssl' + try: + OpenSslPath = os.environ['OPENSSL_PATH'] + OpenSslCommand = os.path.join(OpenSslPath, OpenSslCommand) + if ' ' in OpenSslCommand: + OpenSslCommand = '"' + OpenSslCommand + '"' + except: + pass + + # + # Verify that Open SSL command is available + # + try: + Process = subprocess.Popen('%s version' % (OpenSslCommand), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + except: + print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH') + sys.exit(1) + + Version = Process.communicate() + if Process.returncode != 0: + print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH') + sys.exit(Process.returncode) + print(Version[0].decode()) + + args.PemFileName = [] + + # + # Check for output file argument + # + if args.OutputFile is not None: + for Item in args.OutputFile: + # + # Save PEM filename and close output file + # + args.PemFileName.append(Item.name) + Item.close() + + # + # Generate private key and save it to output file in a PEM file format + # + Process = subprocess.Popen('%s genrsa -out %s 2048' % (OpenSslCommand, Item.name), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + Process.communicate() + if Process.returncode != 0: + print('ERROR: RSA 2048 key generation failed') + sys.exit(Process.returncode) + + # + # Check for input file argument + # + if args.InputFile is not None: + for Item in args.InputFile: + # + # Save PEM filename and close input file + # + args.PemFileName.append(Item.name) + Item.close() + + PublicKeyHash = bytearray() + for Item in args.PemFileName: + # + # Extract public key from private key into STDOUT + # + Process = subprocess.Popen('%s rsa -in %s -modulus -noout' % (OpenSslCommand, Item), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + PublicKeyHexString = Process.communicate()[0].decode().split(b'=')[1].strip() + if Process.returncode != 0: + print('ERROR: Unable to extract public key from private key') + sys.exit(Process.returncode) + PublicKey = bytearray() + for Index in range (0, len(PublicKeyHexString), 2): + PublicKey = PublicKey + PublicKeyHexString[Index:Index + 2] + + # + # Generate SHA 256 hash of RSA 2048 bit public key into STDOUT + # + Process = subprocess.Popen('%s dgst -sha256 -binary' % (OpenSslCommand), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + Process.stdin.write (PublicKey) + PublicKeyHash = PublicKeyHash + Process.communicate()[0].decode() + if Process.returncode != 0: + print('ERROR: Unable to extract SHA 256 hash of public key') + sys.exit(Process.returncode) + + # + # Write SHA 256 hash of 2048 bit binary public key to public key hash file + # + try: + args.PublicKeyHashFile.write (PublicKeyHash) + args.PublicKeyHashFile.close () + except: + pass + + # + # Convert public key hash to a C structure string + # + PublicKeyHashC = '{' + for Item in PublicKeyHash: + PublicKeyHashC = PublicKeyHashC + '0x%02x, ' % (Item) + PublicKeyHashC = PublicKeyHashC[:-2] + '}' + + # + # Write SHA 256 of 2048 bit binary public key to public key hash C structure file + # + try: + args.PublicKeyHashCFile.write (bytes(PublicKeyHashC)) + args.PublicKeyHashCFile.close () + except: + pass + + # + # If verbose is enabled display the public key in C structure format + # + if args.Verbose: + print('PublicKeySha256 = ' + PublicKeyHashC) diff --git a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py index df05826282..d894a2ecd5 100644 --- a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py +++ b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py @@ -1,235 +1,235 @@ -## @file
-# This tool encodes and decodes GUIDed FFS sections or FMP capsule for a GUID type of
-# EFI_CERT_TYPE_RSA2048_SHA256_GUID defined in the UEFI 2.4 Specification as
-# {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf}}
-# This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013
-#
-# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
-# SPDX-License-Identifier: BSD-2-Clause-Patent
-#
-
-'''
-Rsa2048Sha256Sign
-'''
-from __future__ import print_function
-
-import os
-import sys
-import argparse
-import subprocess
-import uuid
-import struct
-import collections
-from Common.BuildVersion import gBUILD_VERSION
-
-#
-# Globals for help information
-#
-__prog__ = 'Rsa2048Sha256Sign'
-__version__ = '%s Version %s' % (__prog__, '0.9 ' + gBUILD_VERSION)
-__copyright__ = 'Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.'
-__usage__ = '%s -e|-d [options] <input_file>' % (__prog__)
-
-#
-# GUID for SHA 256 Hash Algorithm from UEFI Specification
-#
-EFI_HASH_ALGORITHM_SHA256_GUID = uuid.UUID('{51aa59de-fdf2-4ea3-bc63-875fb7842ee9}')
-
-#
-# Structure definition to unpack EFI_CERT_BLOCK_RSA_2048_SHA256 from UEFI 2.4 Specification
-#
-# typedef struct _EFI_CERT_BLOCK_RSA_2048_SHA256 {
-# EFI_GUID HashType;
-# UINT8 PublicKey[256];
-# UINT8 Signature[256];
-# } EFI_CERT_BLOCK_RSA_2048_SHA256;
-#
-EFI_CERT_BLOCK_RSA_2048_SHA256 = collections.namedtuple('EFI_CERT_BLOCK_RSA_2048_SHA256', ['HashType', 'PublicKey', 'Signature'])
-EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT = struct.Struct('16s256s256s')
-
-#
-# Filename of test signing private key that is stored in same directory as this tool
-#
-TEST_SIGNING_PRIVATE_KEY_FILENAME = 'TestSigningPrivateKey.pem'
-
-if __name__ == '__main__':
- #
- # Create command line argument parser object
- #
- parser = argparse.ArgumentParser(prog=__prog__, usage=__usage__, description=__copyright__, conflict_handler='resolve')
- group = parser.add_mutually_exclusive_group(required=True)
- group.add_argument("-e", action="store_true", dest='Encode', help='encode file')
- group.add_argument("-d", action="store_true", dest='Decode', help='decode file')
- group.add_argument("--version", action='version', version=__version__)
- parser.add_argument("-o", "--output", dest='OutputFile', type=str, metavar='filename', help="specify the output filename", required=True)
- parser.add_argument("--monotonic-count", dest='MonotonicCountStr', type=str, help="specify the MonotonicCount in FMP capsule.")
- parser.add_argument("--private-key", dest='PrivateKeyFile', type=argparse.FileType('rb'), help="specify the private key filename. If not specified, a test signing key is used.")
- parser.add_argument("-v", "--verbose", dest='Verbose', action="store_true", help="increase output messages")
- parser.add_argument("-q", "--quiet", dest='Quiet', action="store_true", help="reduce output messages")
- parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0, 10), default=0, help="set debug level")
- parser.add_argument(metavar="input_file", dest='InputFile', type=argparse.FileType('rb'), help="specify the input filename")
-
- #
- # Parse command line arguments
- #
- args = parser.parse_args()
-
- #
- # Generate file path to Open SSL command
- #
- OpenSslCommand = 'openssl'
- try:
- OpenSslPath = os.environ['OPENSSL_PATH']
- OpenSslCommand = os.path.join(OpenSslPath, OpenSslCommand)
- if ' ' in OpenSslCommand:
- OpenSslCommand = '"' + OpenSslCommand + '"'
- except:
- pass
-
- #
- # Verify that Open SSL command is available
- #
- try:
- Process = subprocess.Popen('%s version' % (OpenSslCommand), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- except:
- print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH')
- sys.exit(1)
-
- Version = Process.communicate()
- if Process.returncode != 0:
- print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH')
- sys.exit(Process.returncode)
- print(Version[0].decode('utf-8'))
-
- #
- # Read input file into a buffer and save input filename
- #
- args.InputFileName = args.InputFile.name
- args.InputFileBuffer = args.InputFile.read()
- args.InputFile.close()
-
- #
- # Save output filename and check if path exists
- #
- OutputDir = os.path.dirname(args.OutputFile)
- if not os.path.exists(OutputDir):
- print('ERROR: The output path does not exist: %s' % OutputDir)
- sys.exit(1)
- args.OutputFileName = args.OutputFile
-
- #
- # Save private key filename and close private key file
- #
- try:
- args.PrivateKeyFileName = args.PrivateKeyFile.name
- args.PrivateKeyFile.close()
- except:
- try:
- #
- # Get path to currently executing script or executable
- #
- if hasattr(sys, 'frozen'):
- RsaToolPath = sys.executable
- else:
- RsaToolPath = sys.argv[0]
- if RsaToolPath.startswith('"'):
- RsaToolPath = RsaToolPath[1:]
- if RsaToolPath.endswith('"'):
- RsaToolPath = RsaToolPath[:-1]
- args.PrivateKeyFileName = os.path.join(os.path.dirname(os.path.realpath(RsaToolPath)), TEST_SIGNING_PRIVATE_KEY_FILENAME)
- args.PrivateKeyFile = open(args.PrivateKeyFileName, 'rb')
- args.PrivateKeyFile.close()
- except:
- print('ERROR: test signing private key file %s missing' % (args.PrivateKeyFileName))
- sys.exit(1)
-
- #
- # Extract public key from private key into STDOUT
- #
- Process = subprocess.Popen('%s rsa -in "%s" -modulus -noout' % (OpenSslCommand, args.PrivateKeyFileName), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- PublicKeyHexString = Process.communicate()[0].split(b'=')[1].strip()
- PublicKeyHexString = PublicKeyHexString.decode('utf-8')
- PublicKey = ''
- while len(PublicKeyHexString) > 0:
- PublicKey = PublicKey + PublicKeyHexString[0:2]
- PublicKeyHexString=PublicKeyHexString[2:]
- if Process.returncode != 0:
- sys.exit(Process.returncode)
-
- if args.MonotonicCountStr:
- try:
- if args.MonotonicCountStr.upper().startswith('0X'):
- args.MonotonicCountValue = int(args.MonotonicCountStr, 16)
- else:
- args.MonotonicCountValue = int(args.MonotonicCountStr)
- except:
- pass
-
- if args.Encode:
- FullInputFileBuffer = args.InputFileBuffer
- if args.MonotonicCountStr:
- format = "%dsQ" % len(args.InputFileBuffer)
- FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue)
- #
- # Sign the input file using the specified private key and capture signature from STDOUT
- #
- Process = subprocess.Popen('%s dgst -sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- Signature = Process.communicate(input=FullInputFileBuffer)[0]
- if Process.returncode != 0:
- sys.exit(Process.returncode)
-
- #
- # Write output file that contains hash GUID, Public Key, Signature, and Input data
- #
- args.OutputFile = open(args.OutputFileName, 'wb')
- args.OutputFile.write(EFI_HASH_ALGORITHM_SHA256_GUID.bytes_le)
- args.OutputFile.write(bytearray.fromhex(str(PublicKey)))
- args.OutputFile.write(Signature)
- args.OutputFile.write(args.InputFileBuffer)
- args.OutputFile.close()
-
- if args.Decode:
- #
- # Parse Hash Type, Public Key, and Signature from the section header
- #
- Header = EFI_CERT_BLOCK_RSA_2048_SHA256._make(EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.unpack_from(args.InputFileBuffer))
- args.InputFileBuffer = args.InputFileBuffer[EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.size:]
-
- #
- # Verify that the Hash Type matches the expected SHA256 type
- #
- if uuid.UUID(bytes_le = Header.HashType) != EFI_HASH_ALGORITHM_SHA256_GUID:
- print('ERROR: unsupport hash GUID')
- sys.exit(1)
-
- #
- # Verify the public key
- #
- if Header.PublicKey != bytearray.fromhex(PublicKey):
- print('ERROR: Public key in input file does not match public key from private key file')
- sys.exit(1)
-
- FullInputFileBuffer = args.InputFileBuffer
- if args.MonotonicCountStr:
- format = "%dsQ" % len(args.InputFileBuffer)
- FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue)
-
- #
- # Write Signature to output file
- #
- open(args.OutputFileName, 'wb').write(Header.Signature)
-
- #
- # Verify signature
- #
- Process = subprocess.Popen('%s dgst -sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
- Process.communicate(input=FullInputFileBuffer)
- if Process.returncode != 0:
- print('ERROR: Verification failed')
- os.remove (args.OutputFileName)
- sys.exit(Process.returncode)
-
- #
- # Save output file contents from input file
- #
- open(args.OutputFileName, 'wb').write(args.InputFileBuffer)
+## @file +# This tool encodes and decodes GUIDed FFS sections or FMP capsule for a GUID type of +# EFI_CERT_TYPE_RSA2048_SHA256_GUID defined in the UEFI 2.4 Specification as +# {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf}} +# This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013 +# +# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR> +# SPDX-License-Identifier: BSD-2-Clause-Patent +# + +''' +Rsa2048Sha256Sign +''' +from __future__ import print_function + +import os +import sys +import argparse +import subprocess +import uuid +import struct +import collections +from Common.BuildVersion import gBUILD_VERSION + +# +# Globals for help information +# +__prog__ = 'Rsa2048Sha256Sign' +__version__ = '%s Version %s' % (__prog__, '0.9 ' + gBUILD_VERSION) +__copyright__ = 'Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.' +__usage__ = '%s -e|-d [options] <input_file>' % (__prog__) + +# +# GUID for SHA 256 Hash Algorithm from UEFI Specification +# +EFI_HASH_ALGORITHM_SHA256_GUID = uuid.UUID('{51aa59de-fdf2-4ea3-bc63-875fb7842ee9}') + +# +# Structure definition to unpack EFI_CERT_BLOCK_RSA_2048_SHA256 from UEFI 2.4 Specification +# +# typedef struct _EFI_CERT_BLOCK_RSA_2048_SHA256 { +# EFI_GUID HashType; +# UINT8 PublicKey[256]; +# UINT8 Signature[256]; +# } EFI_CERT_BLOCK_RSA_2048_SHA256; +# +EFI_CERT_BLOCK_RSA_2048_SHA256 = collections.namedtuple('EFI_CERT_BLOCK_RSA_2048_SHA256', ['HashType', 'PublicKey', 'Signature']) +EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT = struct.Struct('16s256s256s') + +# +# Filename of test signing private key that is stored in same directory as this tool +# +TEST_SIGNING_PRIVATE_KEY_FILENAME = 'TestSigningPrivateKey.pem' + +if __name__ == '__main__': + # + # Create command line argument parser object + # + parser = argparse.ArgumentParser(prog=__prog__, usage=__usage__, description=__copyright__, conflict_handler='resolve') + group = parser.add_mutually_exclusive_group(required=True) + group.add_argument("-e", action="store_true", dest='Encode', help='encode file') + group.add_argument("-d", action="store_true", dest='Decode', help='decode file') + group.add_argument("--version", action='version', version=__version__) + parser.add_argument("-o", "--output", dest='OutputFile', type=str, metavar='filename', help="specify the output filename", required=True) + parser.add_argument("--monotonic-count", dest='MonotonicCountStr', type=str, help="specify the MonotonicCount in FMP capsule.") + parser.add_argument("--private-key", dest='PrivateKeyFile', type=argparse.FileType('rb'), help="specify the private key filename. If not specified, a test signing key is used.") + parser.add_argument("-v", "--verbose", dest='Verbose', action="store_true", help="increase output messages") + parser.add_argument("-q", "--quiet", dest='Quiet', action="store_true", help="reduce output messages") + parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0, 10), default=0, help="set debug level") + parser.add_argument(metavar="input_file", dest='InputFile', type=argparse.FileType('rb'), help="specify the input filename") + + # + # Parse command line arguments + # + args = parser.parse_args() + + # + # Generate file path to Open SSL command + # + OpenSslCommand = 'openssl' + try: + OpenSslPath = os.environ['OPENSSL_PATH'] + OpenSslCommand = os.path.join(OpenSslPath, OpenSslCommand) + if ' ' in OpenSslCommand: + OpenSslCommand = '"' + OpenSslCommand + '"' + except: + pass + + # + # Verify that Open SSL command is available + # + try: + Process = subprocess.Popen('%s version' % (OpenSslCommand), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + except: + print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH') + sys.exit(1) + + Version = Process.communicate() + if Process.returncode != 0: + print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH') + sys.exit(Process.returncode) + print(Version[0].decode('utf-8')) + + # + # Read input file into a buffer and save input filename + # + args.InputFileName = args.InputFile.name + args.InputFileBuffer = args.InputFile.read() + args.InputFile.close() + + # + # Save output filename and check if path exists + # + OutputDir = os.path.dirname(args.OutputFile) + if not os.path.exists(OutputDir): + print('ERROR: The output path does not exist: %s' % OutputDir) + sys.exit(1) + args.OutputFileName = args.OutputFile + + # + # Save private key filename and close private key file + # + try: + args.PrivateKeyFileName = args.PrivateKeyFile.name + args.PrivateKeyFile.close() + except: + try: + # + # Get path to currently executing script or executable + # + if hasattr(sys, 'frozen'): + RsaToolPath = sys.executable + else: + RsaToolPath = sys.argv[0] + if RsaToolPath.startswith('"'): + RsaToolPath = RsaToolPath[1:] + if RsaToolPath.endswith('"'): + RsaToolPath = RsaToolPath[:-1] + args.PrivateKeyFileName = os.path.join(os.path.dirname(os.path.realpath(RsaToolPath)), TEST_SIGNING_PRIVATE_KEY_FILENAME) + args.PrivateKeyFile = open(args.PrivateKeyFileName, 'rb') + args.PrivateKeyFile.close() + except: + print('ERROR: test signing private key file %s missing' % (args.PrivateKeyFileName)) + sys.exit(1) + + # + # Extract public key from private key into STDOUT + # + Process = subprocess.Popen('%s rsa -in "%s" -modulus -noout' % (OpenSslCommand, args.PrivateKeyFileName), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + PublicKeyHexString = Process.communicate()[0].split(b'=')[1].strip() + PublicKeyHexString = PublicKeyHexString.decode('utf-8') + PublicKey = '' + while len(PublicKeyHexString) > 0: + PublicKey = PublicKey + PublicKeyHexString[0:2] + PublicKeyHexString=PublicKeyHexString[2:] + if Process.returncode != 0: + sys.exit(Process.returncode) + + if args.MonotonicCountStr: + try: + if args.MonotonicCountStr.upper().startswith('0X'): + args.MonotonicCountValue = int(args.MonotonicCountStr, 16) + else: + args.MonotonicCountValue = int(args.MonotonicCountStr) + except: + pass + + if args.Encode: + FullInputFileBuffer = args.InputFileBuffer + if args.MonotonicCountStr: + format = "%dsQ" % len(args.InputFileBuffer) + FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue) + # + # Sign the input file using the specified private key and capture signature from STDOUT + # + Process = subprocess.Popen('%s dgst -sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + Signature = Process.communicate(input=FullInputFileBuffer)[0] + if Process.returncode != 0: + sys.exit(Process.returncode) + + # + # Write output file that contains hash GUID, Public Key, Signature, and Input data + # + args.OutputFile = open(args.OutputFileName, 'wb') + args.OutputFile.write(EFI_HASH_ALGORITHM_SHA256_GUID.bytes_le) + args.OutputFile.write(bytearray.fromhex(str(PublicKey))) + args.OutputFile.write(Signature) + args.OutputFile.write(args.InputFileBuffer) + args.OutputFile.close() + + if args.Decode: + # + # Parse Hash Type, Public Key, and Signature from the section header + # + Header = EFI_CERT_BLOCK_RSA_2048_SHA256._make(EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.unpack_from(args.InputFileBuffer)) + args.InputFileBuffer = args.InputFileBuffer[EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.size:] + + # + # Verify that the Hash Type matches the expected SHA256 type + # + if uuid.UUID(bytes_le = Header.HashType) != EFI_HASH_ALGORITHM_SHA256_GUID: + print('ERROR: unsupport hash GUID') + sys.exit(1) + + # + # Verify the public key + # + if Header.PublicKey != bytearray.fromhex(PublicKey): + print('ERROR: Public key in input file does not match public key from private key file') + sys.exit(1) + + FullInputFileBuffer = args.InputFileBuffer + if args.MonotonicCountStr: + format = "%dsQ" % len(args.InputFileBuffer) + FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue) + + # + # Write Signature to output file + # + open(args.OutputFileName, 'wb').write(Header.Signature) + + # + # Verify signature + # + Process = subprocess.Popen('%s dgst -sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True) + Process.communicate(input=FullInputFileBuffer) + if Process.returncode != 0: + print('ERROR: Verification failed') + os.remove (args.OutputFileName) + sys.exit(Process.returncode) + + # + # Save output file contents from input file + # + open(args.OutputFileName, 'wb').write(args.InputFileBuffer) diff --git a/BaseTools/Source/Python/Rsa2048Sha256Sign/TestSigningPublicKey.txt b/BaseTools/Source/Python/Rsa2048Sha256Sign/TestSigningPublicKey.txt index 7d97162782..f538f8b4e3 100644 --- a/BaseTools/Source/Python/Rsa2048Sha256Sign/TestSigningPublicKey.txt +++ b/BaseTools/Source/Python/Rsa2048Sha256Sign/TestSigningPublicKey.txt @@ -1 +1 @@ -{0x91, 0x29, 0xc4, 0xbd, 0xea, 0x6d, 0xda, 0xb3, 0xaa, 0x6f, 0x50, 0x16, 0xfc, 0xdb, 0x4b, 0x7e, 0x3c, 0xd6, 0xdc, 0xa4, 0x7a, 0x0e, 0xdd, 0xe6, 0x15, 0x8c, 0x73, 0x96, 0xa2, 0xd4, 0xa6, 0x4d}
+{0x91, 0x29, 0xc4, 0xbd, 0xea, 0x6d, 0xda, 0xb3, 0xaa, 0x6f, 0x50, 0x16, 0xfc, 0xdb, 0x4b, 0x7e, 0x3c, 0xd6, 0xdc, 0xa4, 0x7a, 0x0e, 0xdd, 0xe6, 0x15, 0x8c, 0x73, 0x96, 0xa2, 0xd4, 0xa6, 0x4d} |