Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate_win.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #define PRArenaPool PLArenaPool  // Required by <blapi.h>.
 #include <blapi.h>  // Implement CalculateChainFingerprint() with NSS.
 
 #include "base/lazy_instance.h"
@@ skipping 1159 matching lines @@
   // private key.
   if (!CertSerializeCertificateStoreElement(cert_handle, 0, &buffer[0],
                                             &length)) {
     return false;
   }
 
   return pickle->WriteData(reinterpret_cast<const char*>(&buffer[0]),
                            length);
 }
 
+// static
+void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+                                       size_t* size_bits,
+                                       PublicKeyType* type) {
+  PCCRYPT_OID_INFO oid_info = CryptFindOIDInfo(
+      CRYPT_OID_INFO_OID_KEY,
+      cert_handle->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId,
+      CRYPT_SIGN_ALG_OID_GROUP_ID);

[Ryan Sleevi, 2011/12/13 05:45:35]

CRYPT_PUBKEY_ALG_OID_GROUP_ID

+  CHECK(oid_info);
+  CHECK(oid_info->dwGroupId == CRYPT_SIGN_ALG_OID_GROUP_ID);

[Ryan Sleevi, 2011/12/13 05:45:35]

CHECK_EQ(oid_info->dwGroupId, CRYPT_PUBKEY_ALG_OID_GROUP_ID)

+  CHECK(oid_info->ExtraInfo.cbData >= sizeof(DWORD));

[Ryan Sleevi, 2011/12/13 05:45:35]

Delete this CHECK (ExtraInfo.cbData may be 0 if no flags)

+  DWORD id = *reinterpret_cast<DWORD*>(oid_info->ExtraInfo.pbData);

[Ryan Sleevi, 2011/12/13 05:45:35]

Delete this (updated below at line 1197)

+
+  *size_bits = CertGetPublicKeyLength(
+      X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+      &cert_handle->pCertInfo->SubjectPublicKeyInfo);
+
+  switch (id) {

[Ryan Sleevi, 2011/12/13 05:45:35]

switch (id) -> switch (oid_info->AlgId) {

+    case CALG_RSA_SIGN:

[Ryan Sleevi, 2011/12/13 05:45:35]

add
case CALG_RSA_KEYX:

+      *type = kPublicKeyTypeRSA;
+      break;
+    case CALG_DSS_SIGN:
+      *type = kPublicKeyTypeDSA;
+      break;
+    case CALG_ECDSA:
+      *type = kPublicKeyTypeECDSA;
+      break;
+    case CALG_ECDH:
+      *type = kPublicKeyTypeECDH;
+      break;
+    default:
+      *type = kPublicKeyTypeUnknown;
+  }
+}
+
 }  // namespace net