Changed OAuth token+secret encryption to use supplemental user key.

chrome/browser/chromeos/login/parallel_authenticator.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/parallel_authenticator.h"
 
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/rand_util.h"
 #include "base/string_number_conversions.h"
 #include "base/string_util.h"
 #include "base/synchronization/lock.h"
+#include "chrome/browser/chromeos/cros/cert_library.h"
 #include "chrome/browser/chromeos/cros/cryptohome_library.h"
 #include "chrome/browser/chromeos/login/auth_response_handler.h"
 #include "chrome/browser/chromeos/login/authentication_notification_details.h"
 #include "chrome/browser/chromeos/login/login_status_consumer.h"
 #include "chrome/browser/chromeos/login/ownership_service.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_paths.h"
@@ skipping 655 matching lines @@
   SetLocalaccount(localaccount);
 }
 
 void ParallelAuthenticator::SetLocalaccount(const std::string& new_name) {
   localaccount_ = new_name;
   {  // extra braces for clarity about AutoLock scope.
     base::AutoLock for_this_block(localaccount_lock_);
     checked_for_localaccount_ = true;
   }
 }
-
 std::string ParallelAuthenticator::EncryptToken(const std::string& token) {
-  // TODO(zelidrag): Replace salt with
-  scoped_ptr<crypto::SymmetricKey> key(
-      crypto::SymmetricKey::DeriveKeyFromPassword(
-          crypto::SymmetricKey::AES, UserSupplementalKeyAsAscii(),
-          SaltAsAscii(), 1000, 256));
-  crypto::Encryptor encryptor;
-  if (!encryptor.Init(key.get(), crypto::Encryptor::CTR, std::string()))
+  std::string encoded_token;
+  if (!CrosLibrary::Get()->GetCertLibrary()->EncryptWithSupplementalUserKey(
+      token, &encoded_token)) {
     return std::string();
-
-  std::string nonce = SaltAsAscii().substr(0, kKeySize);
-  std::string encoded_token;
-  CHECK(encryptor.SetCounter(nonce));
-  if (!encryptor.Encrypt(token, &encoded_token))
-    return std::string();
-
+  }
   return StringToLowerASCII(base::HexEncode(
       reinterpret_cast<const void*>(encoded_token.data()),
       encoded_token.size()));
 }
 
 std::string ParallelAuthenticator::DecryptToken(
     const std::string& encrypted_token_hex) {
   std::vector<uint8> encrypted_token_bytes;
   if (!base::HexStringToBytes(encrypted_token_hex, &encrypted_token_bytes))
     return std::string();
+  std::string encrypted_token(
+      reinterpret_cast<char*>(encrypted_token_bytes.data()),
+                              encrypted_token_bytes.size());

[wtc, 2011/09/02 22:31:08]

Nit: this argument should be left-aligned with the
"reinterpret_cast" above.

[zel, 2011/09/03 01:52:22]

Done.

+  std::string token;
+  if (!CrosLibrary::Get()->GetCertLibrary()->DecryptWithSupplementalUserKey(
+      encrypted_token, &token)) {
+    return std::string();
+  }
+  return token;
+}
+
+std::string ParallelAuthenticator::DecryptLegacyToken(
+    const std::string& encrypted_token_hex) {
+  std::vector<uint8> encrypted_token_bytes;
+  if (!base::HexStringToBytes(encrypted_token_hex, &encrypted_token_bytes))
+    return std::string();
 
   std::string encrypted_token(
       reinterpret_cast<char*>(encrypted_token_bytes.data()),
                               encrypted_token_bytes.size());
   scoped_ptr<crypto::SymmetricKey> key(
       crypto::SymmetricKey::DeriveKeyFromPassword(
           crypto::SymmetricKey::AES, UserSupplementalKeyAsAscii(),
           SaltAsAscii(), 1000, 256));
   crypto::Encryptor encryptor;
   if (!encryptor.Init(key.get(), crypto::Encryptor::CTR, std::string()))
@@ skipping 37 matching lines @@
 }
 
 void ParallelAuthenticator::ResolveLoginCompletionStatus() {
   // Shortcut online state resolution process.
   current_state_->RecordOnlineLoginStatus(GaiaAuthConsumer::ClientLoginResult(),
                                           LoginFailure::None());
   Resolve();
 }
 
 }  // namespace chromeos