Commit f475aff
committed
[Secure Boot KEK Update] MiTAC PK-Signed KEK Update - Correction
Ref: #374
These files were uploaded originally with the following ASN.1 structure,
which includes an outer `ContentInfo` SEQUENCE:
```
ContentInfo ::= SEQUENCE {
contentType id-signedData (1.2.840.113549.1.7.2),
content [0] SignedData { ... }
}
```
This is problematic because until recently, this was not supported by
EDK2 based firmware.
microsoft/mu_tiano_plus@37d3eb0
To achieve the most compatibility with existing firmware, the files have
been stripped of the outer ContentInfo envelope and stores the
**SignedData** SEQUENCE directly as `CertData`, starting at
`30 82 05 82 02 01 01 ...` (version=1, ...).
The `dwLength` field in `WIN_CERTIFICATE` was also decremented by 19 to
|reflect the shorter `CertData`. Everything else
(the `EFI_TIME`, GUID, `SignedData` contents, and the variable payload)
is byte-identical.1 parent f49d300 commit f475aff
2 files changed
Binary file not shown.
Binary file not shown.
0 commit comments