Feature: ECIT - #272
Draft
Flickdm wants to merge 4 commits into
Draft
Conversation
Capture the design for GetCryptoOpCapability and its ECIT-facing contract: per-op handlers co-located with verify pipelines, runtime intersection of candidate OIDs with the linked provider, unordered-set payload semantics, and capability-vs-compliance separation (binary reports; CryptoConformanceApp validates against external profiles).
Per-op handler now enumerates the linked crypto provider at call time (EnumerateProviderSignatureOids over OpenSSL EVP_MD_do_all_provided + OBJ_find_sigid_by_algs; MbedTLS mirror) and filters through a small predicate exposed by the verify pipeline (IsAuthenticodeSigNidAccepted). No const OID arrays remain in the design; the provider is the list and the predicate is the policy, both read on every call.
Derives a bite-sized, TDD-driven, 9-task execution plan from the spec at docs/superpowers/specs/2026-06-01-ecit-capability-reporting-design.md. Plan structure: 1. Protocol surface + GUIDs + public header (no minor bump yet) 2. Test scaffolding (placeholder suite registered in BaseCryptLib host tests) 3. PKCS#7 op end-to-end (dispatcher + helper + handler, TDD) 4. Authenticode op (predicate + handler, TDD) 5. Null-variant handlers + non-DXE OpenSSL INF wiring 6. BaseCryptLibOnOneCrypto forwarder 7. OneCryptoBin protocol assignment + atomic minor-version bump 8. MbedTLS Null parity 9. Integration verification Documented deviation from spec: MINOR bump (1.0 -> 1.1) instead of MAJOR bump, justified by ONE_CRYPTO_PROTOCOL's own append-only convention and the existing ValidateCryptoVersion '<' comparison via CALL_CRYPTO_SERVICE. Minor bump lands atomically with the OneCryptoBin field assignment in Task 7 so consumers never observe Minor>=1 with an unassigned function pointer. Documented signature deviation: EnumerateProviderSignatureOids returns EFI_STATUS instead of the spec's VOID so per-op handlers can pass through EFI_BUFFER_TOO_SMALL cleanly. MU_BASECORE commits are explicitly scoped to that subtree's separate git work tree (each MU_BASECORE-affecting step uses 'cd MU_BASECORE && git commit'). Signed-off-by: Doug Flick <dougflick@microsoft.com>
Introduce the Extensible Crypto Information Table (ECIT) capability
reporting framework in BaseCryptLib. The framework enumerates the
signature algorithm OIDs supported by the linked OpenSSL provider
for PKCS#7 verify and Authenticode verify operations.
Architecture:
- CryptOpCapability.h declares the engine entry point, the per-op
signature-acceptance predicate typedef, and shared handler protos.
- Pk/CryptOpCapabilityCommon.c hosts the engine: state tracking
(Written vs Committed for ASan-clean two-pass sizing), Pass A
(legacy RSA/ECDSA OID enumeration) and Pass B (provider signature
enumeration with dedupe), and predicate-driven filtering.
- Pk/CryptPkcs7OpCapability.c contributes the PKCS#7 policy
(accept-all signature algorithms exposed by the provider).
- Pk/CryptAuthenticodeOpCapability.c contributes the Authenticode
policy (accept only digests in {sha1, sha256, sha384, sha512}).
- Info/CryptInfo.c routes GetCryptoOpCapability calls through a
slim dispatch table keyed on the operation GUID.
Live capability sets:
PKCS#7 verify (14 OIDs): RSA+MD5/SHA1/SHA224/SHA256/SHA384/SHA512,
ECDSA+SHA1/SHA224/SHA256/SHA384/SHA512,
ML-DSA-44/65/87
Authenticode ( 8 OIDs): RSA+SHA1/SHA256/SHA384/SHA512,
ECDSA+SHA1/SHA256/SHA384/SHA512
Adding a new operation requires a single new Pk/Crypt<Op>OpCapability.c
predicate+handler plus a one-line dispatch row.
Signed-off-by: Doug Flick <dougflick@microsoft.com>
mu-automation
Bot
added
the
impact:non-functional
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
🏗️ WORK IN PROGRESS 🏗️
Rough Draft and likely to change dramatically
This pull request introduces a new capability reporting mechanism to
BaseCryptLibinOpensslPkg, enabling runtime discovery of supported cryptographic signature algorithms for specific operations (such as PKCS#7 and Authenticode verification). The implementation avoids static OID allowlists, instead querying the linked OpenSSL provider to enumerate supported algorithms. The changes add a public dispatcher, per-operation handlers, and a shared engine for algorithm enumeration, along with the necessary wiring to the build system and GUID registration.ECIT Capability Reporting Implementation
CryptOpCapability.hthat defines the architecture for per-operation capability reporting, including the shared engine interface and per-op handler prototypes.Pk/CryptOpCapabilityCommon.c, which enumerates all signature algorithms the OpenSSL provider supports and emits their OIDs as a CSV payload, deduplicated and following the EFI sizing contract.Per-Operation Handlers
Pk/CryptPkcs7OpCapability.c(not shown) andPk/CryptAuthenticodeOpCapability.c, which implement per-op handlers for PKCS#7 and Authenticode verification, delegating to the shared engine with the appropriate acceptance predicate. The Authenticode handler is a strict subset of PKCS#7.Public Dispatcher and API
Info/CryptInfo.cto include a new public API,GetCryptoOpCapability, which dispatches based on GUID to the correct per-op handler and returns the runtime capability descriptor.gCryptoOpPkcs7VerifyGuid,gCryptoOpAuthenticodeVerifyGuid) in the INF file and hooked up the new source files for build integration. [1] [2] [3]These changes enable external consumers to query, at runtime, exactly which signature algorithms are supported for each cryptographic verification operation, ensuring accurate and up-to-date reporting that automatically tracks the linked OpenSSL provider's capabilities.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
How This Was Tested
<Describe the test(s) that were run to verify the changes.>
Integration Instructions
<Describe how these changes should be integrated. Use N/A if nothing is required.>