Skip to content

Commit

Permalink
SecurityPkg: RngDxe: Remove incorrect limitation on GetRng
Browse files Browse the repository at this point in the history
Removed from gEfiRngAlgorithmRaw an incorrect assumption that
Raw cannot return less than 256 bits. The DRNG Algorithms
should always use a 256 bit seed as per nist standards
however a caller is free to request less than 256 bits.
>
>     //
>    // When a DRBG is used on the output of a entropy source,
>    // its security level must be at least 256 bits according to UEFI Spec.
>    //
>    if (RNGValueLength < 32) {
>      return EFI_INVALID_PARAMETER;
>    }
>

AARCH64 platforms do not have this limitation and this brings both
implementations into alignment with each other and the spec.

Cc: Jiewen Yao <[email protected]>

Signed-off-by: Doug Flick [MSFT] <[email protected]>
  • Loading branch information
Doug Flick committed May 9, 2024
1 parent 48d40a5 commit 8dea763
Showing 1 changed file with 0 additions and 8 deletions.
8 changes: 0 additions & 8 deletions SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
Original file line number Diff line number Diff line change
Expand Up @@ -116,14 +116,6 @@ RngGetRNG (
// The "raw" algorithm is intended to provide entropy directly
//
if (CompareGuid (RNGAlgorithm, &gEfiRngAlgorithmRaw)) {
//
// When a DRBG is used on the output of a entropy source,
// its security level must be at least 256 bits according to UEFI Spec.
//
if (RNGValueLength < 32) {
return EFI_INVALID_PARAMETER;
}

Status = GenerateEntropy (RNGValueLength, RNGValue);
return Status;
}
Expand Down

0 comments on commit 8dea763

Please sign in to comment.