Remove certificates from Channel ID

net/ssl/channel_id_service.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/channel_id_service.h"
 
 #include <algorithm>
 #include <limits>
 
 #include "base/bind.h"
@@ skipping 70 matching lines @@
                              base::TimeDelta::FromMinutes(5),
                              50);
 }
 
 // On success, returns a ChannelID object and sets |*error| to OK.
 // Otherwise, returns NULL, and |*error| will be set to a net error code.
 // |serial_number| is passed in because base::RandInt cannot be called from an
 // unjoined thread, due to relying on a non-leaked LazyInstance
 scoped_ptr<ChannelIDStore::ChannelID> GenerateChannelID(
     const std::string& server_identifier,
-    uint32 serial_number,
     int* error) {
   scoped_ptr<ChannelIDStore::ChannelID> result;
 
   base::TimeTicks start = base::TimeTicks::Now();
   base::Time not_valid_before = base::Time::Now();
-  base::Time not_valid_after =
-      not_valid_before + base::TimeDelta::FromDays(kValidityPeriodInDays);
-  std::string der_cert;
-  std::vector<uint8> private_key_info;
-  scoped_ptr<crypto::ECPrivateKey> key;
-  if (!x509_util::CreateKeyAndChannelIDEC(server_identifier,
-                                          serial_number,
-                                          not_valid_before,
-                                          not_valid_after,
-                                          &key,
-                                          &der_cert)) {
-    DLOG(ERROR) << "Unable to create x509 cert for client";
-    *error = ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED;
+  scoped_ptr<crypto::ECPrivateKey> key(crypto::ECPrivateKey::Create());
+
+  if (!key) {
+    DLOG(ERROR) << "Unable to create channel ID key pair";
+    *error = ERR_KEY_GENERATION_FAILED;
     return result.Pass();
   }
 
-  if (!key->ExportEncryptedPrivateKey(ChannelIDService::kEPKIPassword,
-                                      1, &private_key_info)) {
-    DLOG(ERROR) << "Unable to export private key";
-    *error = ERR_PRIVATE_KEY_EXPORT_FAILED;
+  std::string private_key_out;
+  std::string public_key_out;
+  *error = ExportKeypair(key, &public_key_out, &private_key_out);
+  if (*error != OK)
     return result.Pass();
-  }
-
-  // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a
-  // std::string* to prevent this copying.
-  std::string key_out(private_key_info.begin(), private_key_info.end());
 
   result.reset(new ChannelIDStore::ChannelID(
-      server_identifier,
-      not_valid_before,
-      not_valid_after,
-      key_out,
-      der_cert));
+      server_identifier, not_valid_before, private_key_out, public_key_out));
   UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GenerateCertTime",
                              base::TimeTicks::Now() - start,
                              base::TimeDelta::FromMilliseconds(1),
                              base::TimeDelta::FromMinutes(5),
                              50);
   *error = OK;
   return result.Pass();
 }
 
 }  // namespace
 
+int CreateECPrivateKeyFromSerializedKey(
+    const std::string& public_key,
+    const std::string& private_key,
+    scoped_ptr<crypto::ECPrivateKey>* key_out) {
+  if (public_key.empty() || private_key.empty())
+    return ERR_UNEXPECTED;
+
+  std::vector<uint8> public_key_vector(public_key.size());
+  memcpy(&public_key_vector[0], public_key.data(), public_key.size());

[Ryan Sleevi, 2015/04/15 22:50:02]

DANGER: What if |public_key| is .empty()? This would be a fatal thing
(&public_key_vector[0] is undefined then)

It does seem like simply "fixing" ECPrivateKey to use base::StringPiece resolves
this, right? Do you want to go do that before this complexity?

[nharper, 2015/04/25 02:59:19]

If public_key or private_key is .empty(), then this function doesn't do anything
to key_out and returns ERR_UNEXPECTED (line 128).

My main concern with the complexity here is the memcpy - the rest is just ugly
conversions.

+  std::vector<uint8> private_key_vector(private_key.size());
+  memcpy(&private_key_vector[0], private_key.data(), private_key.size());
+  crypto::ECPrivateKey* key =
+      crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo(
+          ChannelIDService::kEPKIPassword, private_key_vector,
+          public_key_vector);
+  if (key == nullptr)
+    return ERR_UNEXPECTED;
+  key_out->reset(key);
+  return OK;
+}
+
+int ExportKeypair(scoped_ptr<crypto::ECPrivateKey>& key,

[Ryan Sleevi, 2015/04/15 22:50:02]

pass as const-ref

But really, you should be sending in a naked key, right?

crypto::ECPrivateKey* key

[nharper, 2015/04/25 02:59:19]

Changed to const-ref. Does the style guide have input as to whether I should use
const scoped_ptr<T>& vs T*? In the only callsite of this function (outside of
unittests), the key is a scoped_ptr<crypto::ECPrivateKey> instead of a raw
pointer (to facilitate deleting the object pointed to appropriately), and I
don't think there's any disagreement about using a scoped_ptr there. In the
unittests, using a scoped_ptr is handy because it takes care of deleting the
object when it goes out of scope at the end of the test case.

My reasoning for using scoped_ptr<crypto::ECPrivateKey>& here instead of
crypto::ECPrivateKey* is because it makes it easier on the callsite (since all
callers are using a scoped_ptr) - this way the caller doesn't have to call
.get() on the scoped_ptr.

I'm not that familiar with working with scoped_ptrs, so if convention suggests
doing things differently (or if I'm missing something), I'd be glad to change
it.

+                  std::string* public_key,
+                  std::string* private_key) {
+  std::vector<uint8> public_key_vector;
+  std::vector<uint8> private_key_vector;
+
+  if (!key)
+    return ERR_UNEXPECTED;
+
+  if (!key->ExportEncryptedPrivateKey(ChannelIDService::kEPKIPassword, 1,
+                                      &private_key_vector) ||
+      !key->ExportPublicKey(&public_key_vector)) {
+    DLOG(ERROR) << "Unable to export key";
+    return ERR_PRIVATE_KEY_EXPORT_FAILED;
+  }
+
+  // TODO(rkn): Perhaps ExportPrivateKey should be changed to output a
+  // std::string* to prevent this copying.
+  *public_key = std::string(public_key_vector.begin(), public_key_vector.end());

[Ryan Sleevi, 2015/04/15 22:50:02]

Does this work across platforms without throwing conversion errors about
signed/unsigned conversions?

[nharper, 2015/04/25 02:59:20]

This code was copied from the lhs of this diff (see line 120), so it should be
fine.

+  *private_key =
+      std::string(private_key_vector.begin(), private_key_vector.end());
+  return OK;
+}

[Ryan Sleevi, 2015/04/15 22:50:02]

Should match order in .h

[nharper, 2015/04/25 02:59:19]

Done.

+
 // Represents the output and result callback of a request.
 class ChannelIDServiceRequest {
  public:
   ChannelIDServiceRequest(base::TimeTicks request_start,
                           const CompletionCallback& callback,
-                          std::string* private_key,
-                          std::string* cert)
-      : request_start_(request_start),
-        callback_(callback),
-        private_key_(private_key),
-        cert_(cert) {
-  }
+                          scoped_ptr<crypto::ECPrivateKey>* key)
+      : request_start_(request_start), callback_(callback), key_(key) {}
 
   // Ensures that the result callback will never be made.
   void Cancel() {
     RecordGetChannelIDResult(ASYNC_CANCELLED);
     callback_.Reset();
-    private_key_ = NULL;
-    cert_ = NULL;
+    key_->reset();
   }
 
   // Copies the contents of |private_key| and |cert| to the caller's output
   // arguments and calls the callback.
   void Post(int error,
             const std::string& private_key,
-            const std::string& cert) {
+            const std::string& public_key) {
     switch (error) {
       case OK: {
         base::TimeDelta request_time = base::TimeTicks::Now() - request_start_;
         UMA_HISTOGRAM_CUSTOM_TIMES("DomainBoundCerts.GetCertTimeAsync",
                                    request_time,
                                    base::TimeDelta::FromMilliseconds(1),
                                    base::TimeDelta::FromMinutes(5),
                                    50);
         RecordGetChannelIDTime(request_time);
         RecordGetChannelIDResult(ASYNC_SUCCESS);
         break;
       }
       case ERR_KEY_GENERATION_FAILED:
         RecordGetChannelIDResult(ASYNC_FAILURE_KEYGEN);
         break;
       case ERR_ORIGIN_BOUND_CERT_GENERATION_FAILED:
         RecordGetChannelIDResult(ASYNC_FAILURE_CREATE_CERT);
         break;
       case ERR_PRIVATE_KEY_EXPORT_FAILED:
         RecordGetChannelIDResult(ASYNC_FAILURE_EXPORT_KEY);
         break;
       case ERR_INSUFFICIENT_RESOURCES:
         RecordGetChannelIDResult(WORKER_FAILURE);
         break;
       default:
         RecordGetChannelIDResult(ASYNC_FAILURE_UNKNOWN);
         break;
     }
     if (!callback_.is_null()) {
-      *private_key_ = private_key;
-      *cert_ = cert;
+      int err =
+          CreateECPrivateKeyFromSerializedKey(public_key, private_key, key_);
+      if (error == OK && err != OK)
+        error = err;
       callback_.Run(error);
     }
     delete this;
   }
 
   bool canceled() const { return callback_.is_null(); }
 
  private:
   base::TimeTicks request_start_;
   CompletionCallback callback_;
-  std::string* private_key_;
-  std::string* cert_;
+  scoped_ptr<crypto::ECPrivateKey>* key_;
 };
 
 // ChannelIDServiceWorker runs on a worker thread and takes care of the
 // blocking process of performing key generation. Will take care of deleting
 // itself once Start() is called.
 class ChannelIDServiceWorker {
  public:
   typedef base::Callback<void(
       const std::string&,
       int,
       scoped_ptr<ChannelIDStore::ChannelID>)> WorkerDoneCallback;
 
   ChannelIDServiceWorker(
       const std::string& server_identifier,
       const WorkerDoneCallback& callback)
       : server_identifier_(server_identifier),
-        serial_number_(base::RandInt(0, std::numeric_limits<int>::max())),
         origin_loop_(base::MessageLoopProxy::current()),
         callback_(callback) {
   }
 
   // Starts the worker on |task_runner|. If the worker fails to start, such as
   // if the task runner is shutting down, then it will take care of deleting
   // itself.
   bool Start(const scoped_refptr<base::TaskRunner>& task_runner) {
     DCHECK(origin_loop_->RunsTasksOnCurrentThread());
 
     return task_runner->PostTask(
         FROM_HERE,
         base::Bind(&ChannelIDServiceWorker::Run, base::Owned(this)));
   }
 
  private:
   void Run() {
     // Runs on a worker thread.
     int error = ERR_FAILED;
     scoped_ptr<ChannelIDStore::ChannelID> cert =
-        GenerateChannelID(server_identifier_, serial_number_, &error);
+        GenerateChannelID(server_identifier_, &error);
     DVLOG(1) << "GenerateCert " << server_identifier_ << " returned " << error;
 #if defined(USE_NSS)
     // Detach the thread from NSPR.
     // Calling NSS functions attaches the thread to NSPR, which stores
     // the NSPR thread ID in thread-specific data.
     // The threads in our thread pool terminate after we have called
     // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets
     // segfaults on shutdown when the threads' thread-specific data
     // destructors run.
     PR_DetachThread();
 #endif
     origin_loop_->PostTask(FROM_HERE,
                            base::Bind(callback_, server_identifier_, error,
                                       base::Passed(&cert)));
   }
 
   const std::string server_identifier_;
-  // Note that serial_number_ must be initialized on a non-worker thread
-  // (see documentation for GenerateCert).
-  uint32 serial_number_;
   scoped_refptr<base::SequencedTaskRunner> origin_loop_;
   WorkerDoneCallback callback_;
 
   DISALLOW_COPY_AND_ASSIGN(ChannelIDServiceWorker);
 };
 
 // A ChannelIDServiceJob is a one-to-one counterpart of an
 // ChannelIDServiceWorker. It lives only on the ChannelIDService's
 // origin message loop.
 class ChannelIDServiceJob {
  public:
   ChannelIDServiceJob(bool create_if_missing)
       : create_if_missing_(create_if_missing) {
   }
 
   ~ChannelIDServiceJob() {
     if (!requests_.empty())
       DeleteAllCanceled();
   }
 
   void AddRequest(ChannelIDServiceRequest* request,
                   bool create_if_missing = false) {
     create_if_missing_ |= create_if_missing;
     requests_.push_back(request);
   }
 
   void HandleResult(int error,
                     const std::string& private_key,
-                    const std::string& cert) {
-    PostAll(error, private_key, cert);
+                    const std::string& public_key) {
+    PostAll(error, private_key, public_key);
   }
 
   bool CreateIfMissing() const { return create_if_missing_; }
 
  private:
   void PostAll(int error,
                const std::string& private_key,
-               const std::string& cert) {
+               const std::string& public_key) {
     std::vector<ChannelIDServiceRequest*> requests;
     requests_.swap(requests);
 
     for (std::vector<ChannelIDServiceRequest*>::iterator
          i = requests.begin(); i != requests.end(); i++) {
-      (*i)->Post(error, private_key, cert);
+      (*i)->Post(error, private_key, public_key);
       // Post() causes the ChannelIDServiceRequest to delete itself.
     }
   }
 
   void DeleteAllCanceled() {
     for (std::vector<ChannelIDServiceRequest*>::iterator
          i = requests_.begin(); i != requests_.end(); i++) {
       if ((*i)->canceled()) {
         delete *i;
       } else {
@@ skipping 41 matching lines @@
   // members afterwards. Reset callback_ first.
   base::ResetAndReturn(&callback_).Run(result);
 }
 
 ChannelIDService::ChannelIDService(
     ChannelIDStore* channel_id_store,
     const scoped_refptr<base::TaskRunner>& task_runner)
     : channel_id_store_(channel_id_store),
       task_runner_(task_runner),
       requests_(0),
-      cert_store_hits_(0),
+      key_store_hits_(0),
       inflight_joins_(0),
       workers_created_(0),
       weak_ptr_factory_(this) {
   base::Time start = base::Time::Now();
   base::Time end = start + base::TimeDelta::FromDays(
       kValidityPeriodInDays + kSystemTimeValidityBufferInDays);
   is_system_time_valid_ = x509_util::IsSupportedValidityRange(start, end);

[Ryan Sleevi, 2015/04/15 22:50:02]

None of this is needed, is it, now that we're no longer bound by the
X509Certificate type. This also applies to the Service (and propogates through
the interface)

[nharper, 2015/04/25 02:59:19]

Done.

 }
 
 ChannelIDService::~ChannelIDService() {
   STLDeleteValues(&inflight_);
 }
 
 //static
 std::string ChannelIDService::GetDomainForHost(const std::string& host) {
   std::string domain =
       registry_controlled_domains::GetDomainAndRegistry(
           host, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
   if (domain.empty())
     return host;
   return domain;
 }
 
 int ChannelIDService::GetOrCreateChannelID(
     const std::string& host,
-    std::string* private_key,
-    std::string* cert,
+    scoped_ptr<crypto::ECPrivateKey>* key,
     const CompletionCallback& callback,
     RequestHandle* out_req) {
   DVLOG(1) << __FUNCTION__ << " " << host;
   DCHECK(CalledOnValidThread());
   base::TimeTicks request_start = base::TimeTicks::Now();
 
-  if (callback.is_null() || !private_key || !cert || host.empty()) {
+  if (callback.is_null() || !key || host.empty()) {
     RecordGetChannelIDResult(INVALID_ARGUMENT);
     return ERR_INVALID_ARGUMENT;
   }
 
   std::string domain = GetDomainForHost(host);
   if (domain.empty()) {
     RecordGetChannelIDResult(INVALID_ARGUMENT);
     return ERR_INVALID_ARGUMENT;
   }
 
   requests_++;
 
+  std::string public_key;
+  std::string private_key;

[Ryan Sleevi, 2015/04/15 22:50:02]

These two are unused, right?

[nharper, 2015/04/25 02:59:19]

Correct. Removed.

+
   // See if a request for the same domain is currently in flight.
   bool create_if_missing = true;
-  if (JoinToInFlightRequest(request_start, domain, private_key, cert,
-                            create_if_missing, callback, out_req)) {
+  if (JoinToInFlightRequest(request_start, domain, key, create_if_missing,
+                            callback, out_req)) {
     return ERR_IO_PENDING;
   }
 
-  int err = LookupChannelID(request_start, domain, private_key, cert,
-                                  create_if_missing, callback, out_req);
+  int err = LookupChannelID(request_start, domain, key, create_if_missing,
+                            callback, out_req);
   if (err == ERR_FILE_NOT_FOUND) {
     // Sync lookup did not find a valid cert.  Start generating a new one.
     workers_created_++;
     ChannelIDServiceWorker* worker = new ChannelIDServiceWorker(
         domain,
         base::Bind(&ChannelIDService::GeneratedChannelID,
                    weak_ptr_factory_.GetWeakPtr()));
     if (!worker->Start(task_runner_)) {
       // TODO(rkn): Log to the NetLog.
       LOG(ERROR) << "ChannelIDServiceWorker couldn't be started.";
       RecordGetChannelIDResult(WORKER_FAILURE);
       return ERR_INSUFFICIENT_RESOURCES;
     }
     // We are waiting for cert generation.  Create a job & request to track it.
     ChannelIDServiceJob* job = new ChannelIDServiceJob(create_if_missing);
     inflight_[domain] = job;
 
     ChannelIDServiceRequest* request = new ChannelIDServiceRequest(
-        request_start,
-        base::Bind(&RequestHandle::OnRequestComplete,
-                   base::Unretained(out_req)),
-        private_key,
-        cert);
+        request_start, base::Bind(&RequestHandle::OnRequestComplete,
+                                  base::Unretained(out_req)),
+        key);
     job->AddRequest(request);
     out_req->RequestStarted(this, request, callback);
     return ERR_IO_PENDING;
   }
 
   return err;
 }
 
-int ChannelIDService::GetChannelID(
-    const std::string& host,
-    std::string* private_key,
-    std::string* cert,
-    const CompletionCallback& callback,
-    RequestHandle* out_req) {
+int ChannelIDService::GetChannelID(const std::string& host,
+                                   scoped_ptr<crypto::ECPrivateKey>* key,
+                                   const CompletionCallback& callback,
+                                   RequestHandle* out_req) {
   DVLOG(1) << __FUNCTION__ << " " << host;
   DCHECK(CalledOnValidThread());
   base::TimeTicks request_start = base::TimeTicks::Now();
 
-  if (callback.is_null() || !private_key || !cert || host.empty()) {
+  if (callback.is_null() || !key || host.empty()) {
     RecordGetChannelIDResult(INVALID_ARGUMENT);
     return ERR_INVALID_ARGUMENT;
   }
 
   std::string domain = GetDomainForHost(host);
   if (domain.empty()) {
     RecordGetChannelIDResult(INVALID_ARGUMENT);
     return ERR_INVALID_ARGUMENT;
   }
 
   requests_++;
 
   // See if a request for the same domain currently in flight.
   bool create_if_missing = false;
-  if (JoinToInFlightRequest(request_start, domain, private_key, cert,
-                            create_if_missing, callback, out_req)) {
+  if (JoinToInFlightRequest(request_start, domain, key, create_if_missing,
+                            callback, out_req)) {
     return ERR_IO_PENDING;
   }
 
-  int err = LookupChannelID(request_start, domain, private_key, cert,
-                            create_if_missing, callback, out_req);
+  int err = LookupChannelID(request_start, domain, key, create_if_missing,
+                            callback, out_req);
   return err;
 }
 
-void ChannelIDService::GotChannelID(
-    int err,
-    const std::string& server_identifier,
-    base::Time expiration_time,
-    const std::string& key,
-    const std::string& cert) {
+void ChannelIDService::GotChannelID(int err,
+                                    const std::string& server_identifier,
+                                    const std::string& private_key,
+                                    const std::string& public_key) {
   DCHECK(CalledOnValidThread());
 
   std::map<std::string, ChannelIDServiceJob*>::iterator j;
   j = inflight_.find(server_identifier);
   if (j == inflight_.end()) {
     NOTREACHED();
     return;
   }
 
   if (err == OK) {
     // Async DB lookup found a valid cert.
-    DVLOG(1) << "Cert store had valid cert for " << server_identifier;
-    cert_store_hits_++;
+    DVLOG(1) << "Cert store had valid key for " << server_identifier;
+    key_store_hits_++;
     // ChannelIDServiceRequest::Post will do the histograms and stuff.
-    HandleResult(OK, server_identifier, key, cert);
+    HandleResult(OK, server_identifier, private_key, public_key);
     return;
   }
   // Async lookup failed or the certificate was missing. Return the error
   // directly, unless the certificate was missing and a request asked to create
   // one.
   if (err != ERR_FILE_NOT_FOUND || !j->second->CreateIfMissing()) {
-    HandleResult(err, server_identifier, key, cert);
+    HandleResult(err, server_identifier, private_key, public_key);
     return;
   }
   // At least one request asked to create a cert => start generating a new one.
   workers_created_++;
   ChannelIDServiceWorker* worker = new ChannelIDServiceWorker(
       server_identifier,
       base::Bind(&ChannelIDService::GeneratedChannelID,
                  weak_ptr_factory_.GetWeakPtr()));
   if (!worker->Start(task_runner_)) {
     // TODO(rkn): Log to the NetLog.
@@ skipping 16 matching lines @@
 
 void ChannelIDService::GeneratedChannelID(
     const std::string& server_identifier,
     int error,
     scoped_ptr<ChannelIDStore::ChannelID> cert) {
   DCHECK(CalledOnValidThread());
 
   if (error == OK) {
     // TODO(mattm): we should just Pass() the cert object to
     // SetChannelID().
-    channel_id_store_->SetChannelID(
-        cert->server_identifier(),
-        cert->creation_time(),
-        cert->expiration_time(),
-        cert->private_key(),
-        cert->cert());
+    channel_id_store_->SetChannelID(cert->server_identifier(),
+                                    cert->creation_time(), cert->private_key(),
+                                    cert->public_key());
 
-    HandleResult(error, server_identifier, cert->private_key(), cert->cert());
+    HandleResult(error, server_identifier, cert->private_key(),
+                 cert->public_key());
   } else {
     HandleResult(error, server_identifier, std::string(), std::string());
   }
 }
 
-void ChannelIDService::HandleResult(
-    int error,
-    const std::string& server_identifier,
-    const std::string& private_key,
-    const std::string& cert) {
+void ChannelIDService::HandleResult(int error,
+                                    const std::string& server_identifier,
+                                    const std::string& private_key,
+                                    const std::string& public_key) {
   DCHECK(CalledOnValidThread());
 
   std::map<std::string, ChannelIDServiceJob*>::iterator j;
   j = inflight_.find(server_identifier);
   if (j == inflight_.end()) {
     NOTREACHED();
     return;
   }
   ChannelIDServiceJob* job = j->second;
   inflight_.erase(j);
 
-  job->HandleResult(error, private_key, cert);
+  job->HandleResult(error, private_key, public_key);
   delete job;
 }
 
 bool ChannelIDService::JoinToInFlightRequest(
     const base::TimeTicks& request_start,
     const std::string& domain,
-    std::string* private_key,
-    std::string* cert,
+    scoped_ptr<crypto::ECPrivateKey>* key,
     bool create_if_missing,
     const CompletionCallback& callback,
     RequestHandle* out_req) {
   ChannelIDServiceJob* job = NULL;
   std::map<std::string, ChannelIDServiceJob*>::const_iterator j =
       inflight_.find(domain);
   if (j != inflight_.end()) {
     // A request for the same domain is in flight already. We'll attach our
     // callback, but we'll also mark it as requiring a cert if one's mising.
     job = j->second;
     inflight_joins_++;
 
     ChannelIDServiceRequest* request = new ChannelIDServiceRequest(
-        request_start,
-        base::Bind(&RequestHandle::OnRequestComplete,
-                   base::Unretained(out_req)),
-        private_key,
-        cert);
+        request_start, base::Bind(&RequestHandle::OnRequestComplete,
+                                  base::Unretained(out_req)),
+        key);
     job->AddRequest(request, create_if_missing);
     out_req->RequestStarted(this, request, callback);
     return true;
   }
   return false;
 }
 
-int ChannelIDService::LookupChannelID(
-    const base::TimeTicks& request_start,
-    const std::string& domain,
-    std::string* private_key,
-    std::string* cert,
-    bool create_if_missing,
-    const CompletionCallback& callback,
-    RequestHandle* out_req) {
+int ChannelIDService::LookupChannelID(const base::TimeTicks& request_start,
+                                      const std::string& domain,
+                                      scoped_ptr<crypto::ECPrivateKey>* key,
+                                      bool create_if_missing,
+                                      const CompletionCallback& callback,
+                                      RequestHandle* out_req) {
   // Check if a domain bound cert already exists for this domain. Note that
   // |expiration_time| is ignored, and expired certs are considered valid.
-  base::Time expiration_time;
+  std::string public_key;
+  std::string private_key;
   int err = channel_id_store_->GetChannelID(
-      domain,
-      &expiration_time  /* ignored */,
-      private_key,
-      cert,
+      domain, &private_key, &public_key,
       base::Bind(&ChannelIDService::GotChannelID,
                  weak_ptr_factory_.GetWeakPtr()));
 
   if (err == OK) {
+    err = CreateECPrivateKeyFromSerializedKey(public_key, private_key, key);
+    if (err != OK) {
+      return err;
+    }
     // Sync lookup found a valid cert.
-    DVLOG(1) << "Cert store had valid cert for " << domain;
-    cert_store_hits_++;
+    DVLOG(1) << "Cert store had valid key for " << domain;
+    key_store_hits_++;
     RecordGetChannelIDResult(SYNC_SUCCESS);
     base::TimeDelta request_time = base::TimeTicks::Now() - request_start;
     UMA_HISTOGRAM_TIMES("DomainBoundCerts.GetCertTimeSync", request_time);
     RecordGetChannelIDTime(request_time);
     return OK;
   }
 
   if (err == ERR_IO_PENDING) {
     // We are waiting for async DB lookup.  Create a job & request to track it.
     ChannelIDServiceJob* job = new ChannelIDServiceJob(create_if_missing);
     inflight_[domain] = job;
 
     ChannelIDServiceRequest* request = new ChannelIDServiceRequest(
-        request_start,
-        base::Bind(&RequestHandle::OnRequestComplete,
-                   base::Unretained(out_req)),
-        private_key,
-        cert);
+        request_start, base::Bind(&RequestHandle::OnRequestComplete,
+                                  base::Unretained(out_req)),
+        key);
     job->AddRequest(request);
     out_req->RequestStarted(this, request, callback);
     return ERR_IO_PENDING;
   }
 
   return err;
 }
 
 int ChannelIDService::cert_count() {
   return channel_id_store_->GetChannelIDCount();
 }
 
 }  // namespace net