[edk2-devel] [PATCH v7 3/4] SecurityPkg: set SM3 bit in TPM 2.0 hash mask by default

[Imran Desai]

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=1781
GITHUB: https://github.com/idesai/edk2/tree/enable_sm3_measured_boot_v6

EDK2 Support for SM3 digest algorithm is needed to enable TPM with SM3 PCR
banks. This digest algorithm is part of the China Crypto algorithm suite.
This integration has dependency on the openssl_1_1_1b integration into
edk2.

This patch sets SM3 bit in TPM2.0 hash mask by default.

Cc: Chao Zhang <chao.b.zhang at intel.com>
Cc: Jiewen Yao <jiewen.yao at intel.com>
Cc: Jian Wang <jian.j.wang at intel.com>

Signed-off-by: Imran Desai <imran.desai at intel.com>
Reviewed-by: Jian J Wang <jian.j.wang at intel.com>
---
 SecurityPkg/SecurityPkg.dec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index b9c04a3d13d1..d2f6a6fd1293 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -453,9 +453,10 @@ [PcdsDynamic, PcdsDynamicEx]
   #    BIT1  -  SHA256.<BR>
   #    BIT2  -  SHA384.<BR>
   #    BIT3  -  SHA512.<BR>
+  #    BIT4  -  SM3_256.<BR>
   # @Prompt Hash mask for TPM 2.0
-  # @ValidRange 0x80000001 | 0x00000000 - 0x0000000F
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000000F|UINT32|0x00010010
+  # @ValidRange 0x80000001 | 0x00000000 - 0x0000001F
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000001F|UINT32|0x00010010
 
   ## This PCD indicated final BIOS supported Hash mask.
   #    Bios may choose to register a subset of PcdTpm2HashMask.
-- 
2.17.0


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#43977): https://edk2.groups.io/g/devel/message/43977
Mute This Topic: https://groups.io/mt/32520443/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-