Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate_mac.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 #include <time.h>
@@ skipping 1419 matching lines @@
                                                 Pickle* pickle) {
   CSSM_DATA cert_data;
   OSStatus status = SecCertificateGetData(cert_handle, &cert_data);
   if (status)
     return false;
 
   return pickle->WriteData(reinterpret_cast<char*>(cert_data.Data),
                            cert_data.Length);
 }
 
+//static
+void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+                                       size_t* size_bits,
+                                       PublicKeyType* type) {
+  SecKeyRef key;

[Ryan Sleevi, 2011/11/16 03:46:11]

base::mac::ScopedCFTypeRef<SecKeyRef> works handy here.

The only thing is you can't pass a pointer to it for the CopyPublicKey, so
something like

SecKeyRef key;
OSStatus status = SecCertificateCopyPublicKey(cert_handle, &key);
if (status != noErr) {
  NOTREACHED() ...
  return 0;
}
base::mac::ScopedCFType<SecKeyRef> scoped_key(key);

+  OSStatus status = SecCertificateCopyPublicKey(cert_handle, &key);
+  if (status) {
+    CFRelease(key);
+    NOTREACHED() << "SecCertificateCopyPublicKey failed: " << status;
+    return 0;
+  }
+
+  CSSM_KEY* cssm_key;
+  status = SecKeyGetCSSMKey(key, &cssm_key);
+  if (status) {
+    CFRelease(key);
+    NOTREACHED() << "SecKeyGetCSSMKey failed: " << status;
+    return 0;
+  }
+
+  CSSM_KEY_SIZE key_size;
+  status = CSSM_QueryKeySizeInBits(crypto::GetSharedCSPHandle(), NULL, cssm_key,

[Ryan Sleevi, 2011/11/16 03:46:11]

CSSM_KEY.Header has a LogicalKeySizeInBits member. I think that may save you the
call (and implicit lock) into CSSM land. I believe it should be said for all of
Apple's SecKeyRefs.

[Ryan Sleevi, 2011/11/16 03:47:03]

s/said/set/. Makes more sense now.

+                                   &key_size);
+  if (status) {
+    CFRelease(key);
+    NOTREACHED() << "CSSM_QueryKeySizeInBits failed: " << status;
+    return 0;
+  }
+
+  *size_bits = key_size.LogicalKeySizeInBits;
+
+  switch (cssm_key->KeyHeader.AlgorithmId) {
+    case CSSM_ALGID_RSA:
+      *type = PublicKeyType::RSA;
+      break;
+    case CSSM_ALGID_DSA:
+      *type = PublicKeyType::DSA;
+      break;
+    case CSSM_ALGID_ECDSA:
+      *type = PublicKeyType::ECDSA;
+      break;
+    case CSSM_ALGID_DH:
+      *type = PublicKeyType::DH;
+      break;
+    default:
+      *type = PublicKeyType::NONE;
+  }
+
+  CFRelease(key);
+}
+
 }  // namespace net