UEFI Hash Protocol for Cryptographic Digests

The UEFI Hash Protocol provides a standardized interface within the Unified Extensible Firmware Interface (UEFI) environment to compute cryptographic digests of data and executable images. By offering native cryptographic hashing services before the operating system loads, the protocol ensures that platform firmware, bootloaders, and pre-boot applications can verify data integrity, enforce Secure Boot policies, and measure boot components without bundling redundant cryptographic libraries into every driver.

Core Purpose of the UEFI Hash Protocol

In the UEFI architecture, the Hash Protocol (EFI_HASH_PROTOCOL and its successor EFI_HASH2_PROTOCOL) serves as a central service for creating cryptographic hashes. Instead of requiring each boot application, driver, or utility to implement independent hashing algorithms, the UEFI specification exposes this protocol as a platform-level abstraction.

The protocol abstracts the underlying cryptographic implementation—whether provided by software libraries or hardware cryptographic accelerators—and exposes uniform functions to callers. Its primary functions include:

  • GetHashSize(): Determines the output digest size for a specified cryptographic algorithm (such as SHA-256 or SHA-512).
  • Hash(): Processes a contiguous stream of input data and returns the resulting cryptographic digest using a requested algorithm.

Role in Secure Boot and Signature Verification

The primary application of cryptographic digests in UEFI is verifying the integrity and authenticity of boot images. During the Secure Boot process:

  1. Image Analysis: The firmware reads an executable (e.g., an OS loader or option ROM) and hashes its contents, excluding platform-specific digital signature metadata according to the Authenticode standard.
  2. Database Comparison: The resulting digest is cross-referenced with authorized databases (db) or revoked signature databases (dbx).
  3. Execution Gating: If the digest matches a revoked entry in dbx, execution is halted immediately. If it matches a trusted entry or has a valid signature anchored to a trusted Key Exchange Key (KEK) or Platform Key (PK), the image is allowed to execute.

Role in Measured Boot and Platform Attestation

The Hash Protocol also underpins Measured Boot, where each stage of the boot sequence measures the next before passing control:

  • TPM Integration: Cryptographic digests calculated via hashing services are extended into the Platform Configuration Registers (PCRs) of a Trusted Platform Module (TPM).
  • Audit Logging: The digests are recorded in the TCG (Trusted Computing Group) event log, providing an immutable cryptographic record of all firmware code, drivers, and configuration states initialized during boot.
  • Remote Attestation: These measurements allow external verifiers or the operating system to prove that the system booted into a known, uncompromised state.

Architectural Advantages

  • Reduced Footprint: Pre-boot storage space is constrained. Centralizing hashing services eliminates code duplication across UEFI drivers.
  • Hardware Acceleration: Firmware implementations can seamlessly route hash requests to hardware security engines (e.g., crypto engines built into chipsets), improving performance during boot.
  • Algorithm Flexibility: The protocol uses GUIDs (Globally Unique Identifiers) to identify hash algorithms, allowing firmware to easily adopt newer, collision-resistant algorithms as older standards become deprecated.