| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "content/child/webcrypto/nss/rsa_hashed_algorithm_nss.h" | |
| 6 | |
| 7 #include <secasn1.h> | |
| 8 | |
| 9 #include "base/logging.h" | |
| 10 #include "content/child/webcrypto/crypto_data.h" | |
| 11 #include "content/child/webcrypto/generate_key_result.h" | |
| 12 #include "content/child/webcrypto/jwk.h" | |
| 13 #include "content/child/webcrypto/nss/key_nss.h" | |
| 14 #include "content/child/webcrypto/nss/util_nss.h" | |
| 15 #include "content/child/webcrypto/status.h" | |
| 16 #include "content/child/webcrypto/webcrypto_util.h" | |
| 17 #include "crypto/scoped_nss_types.h" | |
| 18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" | |
| 19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" | |
| 20 | |
| 21 namespace content { | |
| 22 | |
| 23 namespace webcrypto { | |
| 24 | |
| 25 namespace { | |
| 26 | |
| 27 #if defined(USE_NSS) && !defined(OS_CHROMEOS) | |
| 28 Status ErrorRsaPrivateKeyImportNotSupported() { | |
| 29 return Status::ErrorUnsupported( | |
| 30 "NSS version must be at least 3.16.2 for RSA private key import. See " | |
| 31 "http://crbug.com/380424"); | |
| 32 } | |
| 33 | |
| 34 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is | |
| 35 // a security problem for RSA private key import from JWK which uses a | |
| 36 // CKA_ID based on the public modulus to retrieve the private key. | |
| 37 Status NssSupportsRsaPrivateKeyImport() { | |
| 38 if (!NSS_VersionCheck("3.16.2")) | |
| 39 return ErrorRsaPrivateKeyImportNotSupported(); | |
| 40 | |
| 41 // Also ensure that the version of Softoken is 3.16.2 or later. | |
| 42 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); | |
| 43 CK_SLOT_INFO info = {}; | |
| 44 if (PK11_GetSlotInfo(slot.get(), &info) != SECSuccess) | |
| 45 return ErrorRsaPrivateKeyImportNotSupported(); | |
| 46 | |
| 47 // CK_SLOT_INFO.hardwareVersion contains the major.minor | |
| 48 // version info for Softoken in the corresponding .major/.minor | |
| 49 // fields, and .firmwareVersion contains the patch.build | |
| 50 // version info (in the .major/.minor fields) | |
| 51 if ((info.hardwareVersion.major > 3) || | |
| 52 (info.hardwareVersion.major == 3 && | |
| 53 (info.hardwareVersion.minor > 16 || | |
| 54 (info.hardwareVersion.minor == 16 && | |
| 55 info.firmwareVersion.major >= 2)))) { | |
| 56 return Status::Success(); | |
| 57 } | |
| 58 | |
| 59 return ErrorRsaPrivateKeyImportNotSupported(); | |
| 60 } | |
| 61 #else | |
| 62 Status NssSupportsRsaPrivateKeyImport() { | |
| 63 return Status::Success(); | |
| 64 } | |
| 65 #endif | |
| 66 | |
| 67 bool CreateRsaHashedPublicKeyAlgorithm( | |
| 68 blink::WebCryptoAlgorithmId rsa_algorithm, | |
| 69 blink::WebCryptoAlgorithmId hash_algorithm, | |
| 70 SECKEYPublicKey* key, | |
| 71 blink::WebCryptoKeyAlgorithm* key_algorithm) { | |
| 72 // TODO(eroman): What about other key types rsaPss, rsaOaep. | |
| 73 if (!key || key->keyType != rsaKey) | |
| 74 return false; | |
| 75 | |
| 76 unsigned int modulus_length_bits = SECKEY_PublicKeyStrength(key) * 8; | |
| 77 CryptoData public_exponent(key->u.rsa.publicExponent.data, | |
| 78 key->u.rsa.publicExponent.len); | |
| 79 | |
| 80 *key_algorithm = blink::WebCryptoKeyAlgorithm::createRsaHashed( | |
| 81 rsa_algorithm, modulus_length_bits, public_exponent.bytes(), | |
| 82 public_exponent.byte_length(), hash_algorithm); | |
| 83 return true; | |
| 84 } | |
| 85 | |
| 86 bool CreateRsaHashedPrivateKeyAlgorithm( | |
| 87 blink::WebCryptoAlgorithmId rsa_algorithm, | |
| 88 blink::WebCryptoAlgorithmId hash_algorithm, | |
| 89 SECKEYPrivateKey* key, | |
| 90 blink::WebCryptoKeyAlgorithm* key_algorithm) { | |
| 91 crypto::ScopedSECKEYPublicKey public_key(SECKEY_ConvertToPublicKey(key)); | |
| 92 if (!public_key) | |
| 93 return false; | |
| 94 return CreateRsaHashedPublicKeyAlgorithm(rsa_algorithm, hash_algorithm, | |
| 95 public_key.get(), key_algorithm); | |
| 96 } | |
| 97 | |
| 98 // From PKCS#1 [http://tools.ietf.org/html/rfc3447]: | |
| 99 // | |
| 100 // RSAPrivateKey ::= SEQUENCE { | |
| 101 // version Version, | |
| 102 // modulus INTEGER, -- n | |
| 103 // publicExponent INTEGER, -- e | |
| 104 // privateExponent INTEGER, -- d | |
| 105 // prime1 INTEGER, -- p | |
| 106 // prime2 INTEGER, -- q | |
| 107 // exponent1 INTEGER, -- d mod (p-1) | |
| 108 // exponent2 INTEGER, -- d mod (q-1) | |
| 109 // coefficient INTEGER, -- (inverse of q) mod p | |
| 110 // otherPrimeInfos OtherPrimeInfos OPTIONAL | |
| 111 // } | |
| 112 // | |
| 113 // Note that otherPrimeInfos is only applicable for version=1. Since NSS | |
| 114 // doesn't use multi-prime can safely use version=0. | |
| 115 struct RSAPrivateKey { | |
| 116 SECItem version; | |
| 117 SECItem modulus; | |
| 118 SECItem public_exponent; | |
| 119 SECItem private_exponent; | |
| 120 SECItem prime1; | |
| 121 SECItem prime2; | |
| 122 SECItem exponent1; | |
| 123 SECItem exponent2; | |
| 124 SECItem coefficient; | |
| 125 }; | |
| 126 | |
| 127 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo | |
| 128 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we | |
| 129 // provide a fallback implementation. | |
| 130 #if defined(USE_NSS) | |
| 131 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { | |
| 132 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, | |
| 133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, | |
| 134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, | |
| 135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, | |
| 136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, | |
| 137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, | |
| 138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, | |
| 139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, | |
| 140 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, | |
| 141 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, | |
| 142 {0}}; | |
| 143 #endif // defined(USE_NSS) | |
| 144 | |
| 145 // On success |value| will be filled with data which must be freed by | |
| 146 // SECITEM_FreeItem(value, PR_FALSE); | |
| 147 bool ReadUint(SECKEYPrivateKey* key, | |
| 148 CK_ATTRIBUTE_TYPE attribute, | |
| 149 SECItem* value) { | |
| 150 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); | |
| 151 | |
| 152 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order | |
| 153 // for the ASN.1 encoding to be correct, the items must be of type | |
| 154 // siUnsignedInteger. | |
| 155 value->type = siUnsignedInteger; | |
| 156 | |
| 157 return rv == SECSuccess; | |
| 158 } | |
| 159 | |
| 160 // Fills |out| with the RSA private key properties. Returns true on success. | |
| 161 // Regardless of the return value, the caller must invoke FreeRSAPrivateKey() | |
| 162 // to free up any allocated memory. | |
| 163 // | |
| 164 // The passed in RSAPrivateKey must be zero-initialized. | |
| 165 bool InitRSAPrivateKey(SECKEYPrivateKey* key, RSAPrivateKey* out) { | |
| 166 if (key->keyType != rsaKey) | |
| 167 return false; | |
| 168 | |
| 169 // Everything should be zero-ed out. These are just some spot checks. | |
| 170 DCHECK(!out->version.data); | |
| 171 DCHECK(!out->version.len); | |
| 172 DCHECK(!out->modulus.data); | |
| 173 DCHECK(!out->modulus.len); | |
| 174 | |
| 175 // Always use version=0 since not using multi-prime. | |
| 176 if (!SEC_ASN1EncodeInteger(NULL, &out->version, 0)) | |
| 177 return false; | |
| 178 | |
| 179 if (!ReadUint(key, CKA_MODULUS, &out->modulus)) | |
| 180 return false; | |
| 181 if (!ReadUint(key, CKA_PUBLIC_EXPONENT, &out->public_exponent)) | |
| 182 return false; | |
| 183 if (!ReadUint(key, CKA_PRIVATE_EXPONENT, &out->private_exponent)) | |
| 184 return false; | |
| 185 if (!ReadUint(key, CKA_PRIME_1, &out->prime1)) | |
| 186 return false; | |
| 187 if (!ReadUint(key, CKA_PRIME_2, &out->prime2)) | |
| 188 return false; | |
| 189 if (!ReadUint(key, CKA_EXPONENT_1, &out->exponent1)) | |
| 190 return false; | |
| 191 if (!ReadUint(key, CKA_EXPONENT_2, &out->exponent2)) | |
| 192 return false; | |
| 193 if (!ReadUint(key, CKA_COEFFICIENT, &out->coefficient)) | |
| 194 return false; | |
| 195 | |
| 196 return true; | |
| 197 } | |
| 198 | |
| 199 struct FreeRsaPrivateKey { | |
| 200 void operator()(RSAPrivateKey* out) { | |
| 201 SECITEM_FreeItem(&out->version, PR_FALSE); | |
| 202 SECITEM_FreeItem(&out->modulus, PR_FALSE); | |
| 203 SECITEM_FreeItem(&out->public_exponent, PR_FALSE); | |
| 204 SECITEM_FreeItem(&out->private_exponent, PR_FALSE); | |
| 205 SECITEM_FreeItem(&out->prime1, PR_FALSE); | |
| 206 SECITEM_FreeItem(&out->prime2, PR_FALSE); | |
| 207 SECITEM_FreeItem(&out->exponent1, PR_FALSE); | |
| 208 SECITEM_FreeItem(&out->exponent2, PR_FALSE); | |
| 209 SECITEM_FreeItem(&out->coefficient, PR_FALSE); | |
| 210 } | |
| 211 }; | |
| 212 | |
| 213 typedef scoped_ptr<CERTSubjectPublicKeyInfo, | |
| 214 crypto::NSSDestroyer<CERTSubjectPublicKeyInfo, | |
| 215 SECKEY_DestroySubjectPublicKeyInfo>> | |
| 216 ScopedCERTSubjectPublicKeyInfo; | |
| 217 | |
| 218 struct DestroyGenericObject { | |
| 219 void operator()(PK11GenericObject* o) const { | |
| 220 if (o) | |
| 221 PK11_DestroyGenericObject(o); | |
| 222 } | |
| 223 }; | |
| 224 | |
| 225 typedef scoped_ptr<PK11GenericObject, DestroyGenericObject> | |
| 226 ScopedPK11GenericObject; | |
| 227 | |
| 228 // Helper to add an attribute to a template. | |
| 229 void AddAttribute(CK_ATTRIBUTE_TYPE type, | |
| 230 void* value, | |
| 231 unsigned long length, | |
| 232 std::vector<CK_ATTRIBUTE>* templ) { | |
| 233 CK_ATTRIBUTE attribute = {type, value, length}; | |
| 234 templ->push_back(attribute); | |
| 235 } | |
| 236 | |
| 237 void AddAttribute(CK_ATTRIBUTE_TYPE type, | |
| 238 const CryptoData& data, | |
| 239 std::vector<CK_ATTRIBUTE>* templ) { | |
| 240 CK_ATTRIBUTE attribute = { | |
| 241 type, const_cast<unsigned char*>(data.bytes()), data.byte_length()}; | |
| 242 templ->push_back(attribute); | |
| 243 } | |
| 244 | |
| 245 void AddAttribute(CK_ATTRIBUTE_TYPE type, | |
| 246 const std::string& data, | |
| 247 std::vector<CK_ATTRIBUTE>* templ) { | |
| 248 AddAttribute(type, CryptoData(data), templ); | |
| 249 } | |
| 250 | |
| 251 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { | |
| 252 if (key->keyType != rsaKey) | |
| 253 return Status::ErrorUnsupported(); | |
| 254 | |
| 255 // TODO(rsleevi): Implement OAEP support according to the spec. | |
| 256 | |
| 257 #if defined(USE_NSS) | |
| 258 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. | |
| 259 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; | |
| 260 const int kPrivateKeyInfoVersion = 0; | |
| 261 | |
| 262 SECKEYPrivateKeyInfo private_key_info = {}; | |
| 263 RSAPrivateKey rsa_private_key = {}; | |
| 264 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( | |
| 265 &rsa_private_key); | |
| 266 | |
| 267 // http://crbug.com/366427: the spec does not define any other failures for | |
| 268 // exporting, so none of the subsequent errors are spec compliant. | |
| 269 if (!InitRSAPrivateKey(key, &rsa_private_key)) | |
| 270 return Status::OperationError(); | |
| 271 | |
| 272 crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE)); | |
| 273 if (!arena.get()) | |
| 274 return Status::OperationError(); | |
| 275 | |
| 276 if (!SEC_ASN1EncodeItem(arena.get(), &private_key_info.privateKey, | |
| 277 &rsa_private_key, RSAPrivateKeyTemplate)) { | |
| 278 return Status::OperationError(); | |
| 279 } | |
| 280 | |
| 281 if (SECSuccess != SECOID_SetAlgorithmID(arena.get(), | |
| 282 &private_key_info.algorithm, | |
| 283 algorithm, NULL)) { | |
| 284 return Status::OperationError(); | |
| 285 } | |
| 286 | |
| 287 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, | |
| 288 kPrivateKeyInfoVersion)) { | |
| 289 return Status::OperationError(); | |
| 290 } | |
| 291 | |
| 292 crypto::ScopedSECItem encoded_key( | |
| 293 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, | |
| 294 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); | |
| 295 #else // defined(USE_NSS) | |
| 296 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); | |
| 297 #endif // defined(USE_NSS) | |
| 298 | |
| 299 if (!encoded_key.get()) | |
| 300 return Status::OperationError(); | |
| 301 | |
| 302 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); | |
| 303 return Status::Success(); | |
| 304 } | |
| 305 | |
| 306 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, | |
| 307 bool extractable, | |
| 308 blink::WebCryptoKeyUsageMask usages, | |
| 309 const JwkRsaInfo& params, | |
| 310 blink::WebCryptoKey* key) { | |
| 311 Status status = NssSupportsRsaPrivateKeyImport(); | |
| 312 if (status.IsError()) | |
| 313 return status; | |
| 314 | |
| 315 CK_OBJECT_CLASS obj_class = CKO_PRIVATE_KEY; | |
| 316 CK_KEY_TYPE key_type = CKK_RSA; | |
| 317 CK_BBOOL ck_false = CK_FALSE; | |
| 318 | |
| 319 std::vector<CK_ATTRIBUTE> key_template; | |
| 320 | |
| 321 AddAttribute(CKA_CLASS, &obj_class, sizeof(obj_class), &key_template); | |
| 322 AddAttribute(CKA_KEY_TYPE, &key_type, sizeof(key_type), &key_template); | |
| 323 AddAttribute(CKA_TOKEN, &ck_false, sizeof(ck_false), &key_template); | |
| 324 AddAttribute(CKA_SENSITIVE, &ck_false, sizeof(ck_false), &key_template); | |
| 325 AddAttribute(CKA_PRIVATE, &ck_false, sizeof(ck_false), &key_template); | |
| 326 | |
| 327 // Required properties by JWA. | |
| 328 AddAttribute(CKA_MODULUS, params.n, &key_template); | |
| 329 AddAttribute(CKA_PUBLIC_EXPONENT, params.e, &key_template); | |
| 330 AddAttribute(CKA_PRIVATE_EXPONENT, params.d, &key_template); | |
| 331 | |
| 332 // Manufacture a CKA_ID so the created key can be retrieved later as a | |
| 333 // SECKEYPrivateKey using FindKeyByKeyID(). Unfortunately there isn't a more | |
| 334 // direct way to do this in NSS. | |
| 335 // | |
| 336 // For consistency with other NSS key creation methods, set the CKA_ID to | |
| 337 // PK11_MakeIDFromPubKey(). There are some problems with | |
| 338 // this approach: | |
| 339 // | |
| 340 // (1) Prior to NSS 3.16.2, there is no parameter validation when creating | |
| 341 // private keys. It is therefore possible to construct a key using the | |
| 342 // known public modulus, and where all the other parameters are bogus. | |
| 343 // FindKeyByKeyID() returns the first key matching the ID. So this would | |
| 344 // effectively allow an attacker to retrieve a private key of their | |
| 345 // choice. | |
| 346 // | |
| 347 // (2) The ID space is shared by different key types. So theoretically | |
| 348 // possible to retrieve a key of the wrong type which has a matching | |
| 349 // CKA_ID. In practice I am told this is not likely except for small key | |
| 350 // sizes, since would require constructing keys with the same public | |
| 351 // data. | |
| 352 // | |
| 353 // (3) FindKeyByKeyID() doesn't necessarily return the object that was just | |
| 354 // created by CreateGenericObject. If the pre-existing key was | |
| 355 // provisioned with flags incompatible with WebCrypto (for instance | |
| 356 // marked sensitive) then this will break things. | |
| 357 SECItem modulus_item = MakeSECItemForBuffer(CryptoData(params.n)); | |
| 358 crypto::ScopedSECItem object_id(PK11_MakeIDFromPubKey(&modulus_item)); | |
| 359 AddAttribute(CKA_ID, CryptoData(object_id->data, object_id->len), | |
| 360 &key_template); | |
| 361 | |
| 362 // Optional properties by JWA, however guaranteed to be present by Chromium's | |
| 363 // implementation. | |
| 364 AddAttribute(CKA_PRIME_1, params.p, &key_template); | |
| 365 AddAttribute(CKA_PRIME_2, params.q, &key_template); | |
| 366 AddAttribute(CKA_EXPONENT_1, params.dp, &key_template); | |
| 367 AddAttribute(CKA_EXPONENT_2, params.dq, &key_template); | |
| 368 AddAttribute(CKA_COEFFICIENT, params.qi, &key_template); | |
| 369 | |
| 370 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); | |
| 371 | |
| 372 ScopedPK11GenericObject key_object(PK11_CreateGenericObject( | |
| 373 slot.get(), &key_template[0], key_template.size(), PR_FALSE)); | |
| 374 | |
| 375 if (!key_object) | |
| 376 return Status::OperationError(); | |
| 377 | |
| 378 crypto::ScopedSECKEYPrivateKey private_key_tmp( | |
| 379 PK11_FindKeyByKeyID(slot.get(), object_id.get(), NULL)); | |
| 380 | |
| 381 // PK11_FindKeyByKeyID() may return a handle to an existing key, rather than | |
| 382 // the object created by PK11_CreateGenericObject(). | |
| 383 crypto::ScopedSECKEYPrivateKey private_key( | |
| 384 SECKEY_CopyPrivateKey(private_key_tmp.get())); | |
| 385 | |
| 386 if (!private_key) | |
| 387 return Status::OperationError(); | |
| 388 | |
| 389 blink::WebCryptoKeyAlgorithm key_algorithm; | |
| 390 if (!CreateRsaHashedPrivateKeyAlgorithm( | |
| 391 algorithm.id(), algorithm.rsaHashedImportParams()->hash().id(), | |
| 392 private_key.get(), &key_algorithm)) { | |
| 393 return Status::ErrorUnexpected(); | |
| 394 } | |
| 395 | |
| 396 std::vector<uint8_t> pkcs8_data; | |
| 397 status = ExportKeyPkcs8Nss(private_key.get(), &pkcs8_data); | |
| 398 if (status.IsError()) | |
| 399 return status; | |
| 400 | |
| 401 scoped_ptr<PrivateKeyNss> key_handle( | |
| 402 new PrivateKeyNss(private_key.Pass(), CryptoData(pkcs8_data))); | |
| 403 | |
| 404 *key = blink::WebCryptoKey::create(key_handle.release(), | |
| 405 blink::WebCryptoKeyTypePrivate, | |
| 406 extractable, key_algorithm, usages); | |
| 407 return Status::Success(); | |
| 408 } | |
| 409 | |
| 410 Status ExportKeySpkiNss(SECKEYPublicKey* key, std::vector<uint8_t>* buffer) { | |
| 411 const crypto::ScopedSECItem spki_der( | |
| 412 SECKEY_EncodeDERSubjectPublicKeyInfo(key)); | |
| 413 if (!spki_der) | |
| 414 return Status::OperationError(); | |
| 415 | |
| 416 buffer->assign(spki_der->data, spki_der->data + spki_der->len); | |
| 417 return Status::Success(); | |
| 418 } | |
| 419 | |
| 420 Status ImportRsaPublicKey(const blink::WebCryptoAlgorithm& algorithm, | |
| 421 bool extractable, | |
| 422 blink::WebCryptoKeyUsageMask usages, | |
| 423 const CryptoData& modulus_data, | |
| 424 const CryptoData& exponent_data, | |
| 425 blink::WebCryptoKey* key) { | |
| 426 if (!modulus_data.byte_length()) | |
| 427 return Status::ErrorImportRsaEmptyModulus(); | |
| 428 | |
| 429 if (!exponent_data.byte_length()) | |
| 430 return Status::ErrorImportRsaEmptyExponent(); | |
| 431 | |
| 432 DCHECK(modulus_data.bytes()); | |
| 433 DCHECK(exponent_data.bytes()); | |
| 434 | |
| 435 // NSS does not provide a way to create an RSA public key directly from the | |
| 436 // modulus and exponent values, but it can import an DER-encoded ASN.1 blob | |
| 437 // with these values and create the public key from that. The code below | |
| 438 // follows the recommendation described in | |
| 439 // https://developer.mozilla.org/en-US/docs/NSS/NSS_Tech_Notes/nss_tech_note7 | |
| 440 | |
| 441 // Pack the input values into a struct compatible with NSS ASN.1 encoding, and | |
| 442 // set up an ASN.1 encoder template for it. | |
| 443 struct RsaPublicKeyData { | |
| 444 SECItem modulus; | |
| 445 SECItem exponent; | |
| 446 }; | |
| 447 const RsaPublicKeyData pubkey_in = { | |
| 448 {siUnsignedInteger, | |
| 449 const_cast<unsigned char*>(modulus_data.bytes()), | |
| 450 modulus_data.byte_length()}, | |
| 451 {siUnsignedInteger, | |
| 452 const_cast<unsigned char*>(exponent_data.bytes()), | |
| 453 exponent_data.byte_length()}}; | |
| 454 const SEC_ASN1Template rsa_public_key_template[] = { | |
| 455 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RsaPublicKeyData)}, | |
| 456 { | |
| 457 SEC_ASN1_INTEGER, offsetof(RsaPublicKeyData, modulus), | |
| 458 }, | |
| 459 { | |
| 460 SEC_ASN1_INTEGER, offsetof(RsaPublicKeyData, exponent), | |
| 461 }, | |
| 462 { | |
| 463 0, }}; | |
| 464 | |
| 465 // DER-encode the public key. | |
| 466 crypto::ScopedSECItem pubkey_der( | |
| 467 SEC_ASN1EncodeItem(NULL, NULL, &pubkey_in, rsa_public_key_template)); | |
| 468 if (!pubkey_der) | |
| 469 return Status::OperationError(); | |
| 470 | |
| 471 // Import the DER-encoded public key to create an RSA SECKEYPublicKey. | |
| 472 crypto::ScopedSECKEYPublicKey pubkey( | |
| 473 SECKEY_ImportDERPublicKey(pubkey_der.get(), CKK_RSA)); | |
| 474 if (!pubkey) | |
| 475 return Status::OperationError(); | |
| 476 | |
| 477 blink::WebCryptoKeyAlgorithm key_algorithm; | |
| 478 if (!CreateRsaHashedPublicKeyAlgorithm( | |
| 479 algorithm.id(), algorithm.rsaHashedImportParams()->hash().id(), | |
| 480 pubkey.get(), &key_algorithm)) { | |
| 481 return Status::ErrorUnexpected(); | |
| 482 } | |
| 483 | |
| 484 std::vector<uint8_t> spki_data; | |
| 485 Status status = ExportKeySpkiNss(pubkey.get(), &spki_data); | |
| 486 if (status.IsError()) | |
| 487 return status; | |
| 488 | |
| 489 scoped_ptr<PublicKeyNss> key_handle( | |
| 490 new PublicKeyNss(pubkey.Pass(), CryptoData(spki_data))); | |
| 491 | |
| 492 *key = blink::WebCryptoKey::create(key_handle.release(), | |
| 493 blink::WebCryptoKeyTypePublic, extractable, | |
| 494 key_algorithm, usages); | |
| 495 return Status::Success(); | |
| 496 } | |
| 497 | |
| 498 } // namespace | |
| 499 | |
| 500 Status RsaHashedAlgorithm::GenerateKey( | |
| 501 const blink::WebCryptoAlgorithm& algorithm, | |
| 502 bool extractable, | |
| 503 blink::WebCryptoKeyUsageMask combined_usages, | |
| 504 GenerateKeyResult* result) const { | |
| 505 blink::WebCryptoKeyUsageMask public_usages = 0; | |
| 506 blink::WebCryptoKeyUsageMask private_usages = 0; | |
| 507 | |
| 508 Status status = GetUsagesForGenerateAsymmetricKey( | |
| 509 combined_usages, all_public_key_usages_, all_private_key_usages_, | |
| 510 &public_usages, &private_usages); | |
| 511 if (status.IsError()) | |
| 512 return status; | |
| 513 | |
| 514 unsigned int public_exponent = 0; | |
| 515 unsigned int modulus_length_bits = 0; | |
| 516 status = GetRsaKeyGenParameters(algorithm.rsaHashedKeyGenParams(), | |
| 517 &public_exponent, &modulus_length_bits); | |
| 518 if (status.IsError()) | |
| 519 return status; | |
| 520 | |
| 521 crypto::ScopedPK11Slot slot(PK11_GetInternalKeySlot()); | |
| 522 if (!slot) | |
| 523 return Status::OperationError(); | |
| 524 | |
| 525 PK11RSAGenParams rsa_gen_params; | |
| 526 rsa_gen_params.keySizeInBits = modulus_length_bits; | |
| 527 rsa_gen_params.pe = public_exponent; | |
| 528 | |
| 529 // The usages are enforced at the WebCrypto layer, so it isn't necessary to | |
| 530 // create keys with limited usages. | |
| 531 const CK_FLAGS operation_flags_mask = kAllOperationFlags; | |
| 532 | |
| 533 // The private key must be marked as insensitive and extractable, otherwise it | |
| 534 // cannot later be exported in unencrypted form or structured-cloned. | |
| 535 const PK11AttrFlags attribute_flags = | |
| 536 PK11_ATTR_INSENSITIVE | PK11_ATTR_EXTRACTABLE; | |
| 537 | |
| 538 // Note: NSS does not generate an sec_public_key if the call below fails, | |
| 539 // so there is no danger of a leaked sec_public_key. | |
| 540 SECKEYPublicKey* sec_public_key; | |
| 541 crypto::ScopedSECKEYPrivateKey scoped_sec_private_key( | |
| 542 PK11_GenerateKeyPairWithOpFlags(slot.get(), CKM_RSA_PKCS_KEY_PAIR_GEN, | |
| 543 &rsa_gen_params, &sec_public_key, | |
| 544 attribute_flags, generate_flags_, | |
| 545 operation_flags_mask, NULL)); | |
| 546 if (!scoped_sec_private_key) | |
| 547 return Status::OperationError(); | |
| 548 | |
| 549 blink::WebCryptoKeyAlgorithm key_algorithm; | |
| 550 if (!CreateRsaHashedPublicKeyAlgorithm( | |
| 551 algorithm.id(), algorithm.rsaHashedKeyGenParams()->hash().id(), | |
| 552 sec_public_key, &key_algorithm)) { | |
| 553 return Status::ErrorUnexpected(); | |
| 554 } | |
| 555 | |
| 556 std::vector<uint8_t> spki_data; | |
| 557 status = ExportKeySpkiNss(sec_public_key, &spki_data); | |
| 558 if (status.IsError()) | |
| 559 return status; | |
| 560 | |
| 561 scoped_ptr<PublicKeyNss> public_key_handle(new PublicKeyNss( | |
| 562 crypto::ScopedSECKEYPublicKey(sec_public_key), CryptoData(spki_data))); | |
| 563 | |
| 564 std::vector<uint8_t> pkcs8_data; | |
| 565 status = ExportKeyPkcs8Nss(scoped_sec_private_key.get(), &pkcs8_data); | |
| 566 if (status.IsError()) | |
| 567 return status; | |
| 568 | |
| 569 scoped_ptr<PrivateKeyNss> private_key_handle( | |
| 570 new PrivateKeyNss(scoped_sec_private_key.Pass(), CryptoData(pkcs8_data))); | |
| 571 | |
| 572 blink::WebCryptoKey public_key = blink::WebCryptoKey::create( | |
| 573 public_key_handle.release(), blink::WebCryptoKeyTypePublic, true, | |
| 574 key_algorithm, public_usages); | |
| 575 | |
| 576 blink::WebCryptoKey private_key = blink::WebCryptoKey::create( | |
| 577 private_key_handle.release(), blink::WebCryptoKeyTypePrivate, extractable, | |
| 578 key_algorithm, private_usages); | |
| 579 | |
| 580 result->AssignKeyPair(public_key, private_key); | |
| 581 return Status::Success(); | |
| 582 } | |
| 583 | |
| 584 Status RsaHashedAlgorithm::VerifyKeyUsagesBeforeImportKey( | |
| 585 blink::WebCryptoKeyFormat format, | |
| 586 blink::WebCryptoKeyUsageMask usages) const { | |
| 587 return VerifyUsagesBeforeImportAsymmetricKey(format, all_public_key_usages_, | |
| 588 all_private_key_usages_, usages); | |
| 589 } | |
| 590 | |
| 591 Status RsaHashedAlgorithm::ImportKeyPkcs8( | |
| 592 const CryptoData& key_data, | |
| 593 const blink::WebCryptoAlgorithm& algorithm, | |
| 594 bool extractable, | |
| 595 blink::WebCryptoKeyUsageMask usages, | |
| 596 blink::WebCryptoKey* key) const { | |
| 597 Status status = NssSupportsRsaPrivateKeyImport(); | |
| 598 if (status.IsError()) | |
| 599 return status; | |
| 600 | |
| 601 crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE)); | |
| 602 if (!arena.get()) | |
| 603 return Status::OperationError(); | |
| 604 | |
| 605 // The binary blob 'key_data' is expected to be a DER-encoded ASN.1 PKCS#8 | |
| 606 // private key info object. Excess data is illegal, but NSS silently accepts | |
| 607 // it, so first ensure that 'key_data' consists of a single ASN.1 element. | |
| 608 SECItem key_item = MakeSECItemForBuffer(key_data); | |
| 609 SECItem pki_der; | |
| 610 if (SEC_QuickDERDecodeItem(arena.get(), &pki_der, | |
| 611 SEC_ASN1_GET(SEC_AnyTemplate), | |
| 612 &key_item) != SECSuccess) { | |
| 613 return Status::DataError(); | |
| 614 } | |
| 615 | |
| 616 SECKEYPrivateKey* seckey_private_key = NULL; | |
| 617 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); | |
| 618 if (PK11_ImportDERPrivateKeyInfoAndReturnKey(slot.get(), &pki_der, | |
| 619 NULL, // nickname | |
| 620 NULL, // publicValue | |
| 621 false, // isPerm | |
| 622 false, // isPrivate | |
| 623 KU_ALL, // usage | |
| 624 &seckey_private_key, | |
| 625 NULL) != SECSuccess) { | |
| 626 return Status::DataError(); | |
| 627 } | |
| 628 DCHECK(seckey_private_key); | |
| 629 crypto::ScopedSECKEYPrivateKey private_key(seckey_private_key); | |
| 630 | |
| 631 const KeyType sec_key_type = SECKEY_GetPrivateKeyType(private_key.get()); | |
| 632 if (sec_key_type != rsaKey) | |
| 633 return Status::DataError(); | |
| 634 | |
| 635 blink::WebCryptoKeyAlgorithm key_algorithm; | |
| 636 if (!CreateRsaHashedPrivateKeyAlgorithm( | |
| 637 algorithm.id(), algorithm.rsaHashedImportParams()->hash().id(), | |
| 638 private_key.get(), &key_algorithm)) { | |
| 639 return Status::ErrorUnexpected(); | |
| 640 } | |
| 641 | |
| 642 // TODO(eroman): This is probably going to be the same as the input. | |
| 643 std::vector<uint8_t> pkcs8_data; | |
| 644 status = ExportKeyPkcs8Nss(private_key.get(), &pkcs8_data); | |
| 645 if (status.IsError()) | |
| 646 return status; | |
| 647 | |
| 648 scoped_ptr<PrivateKeyNss> key_handle( | |
| 649 new PrivateKeyNss(private_key.Pass(), CryptoData(pkcs8_data))); | |
| 650 | |
| 651 *key = blink::WebCryptoKey::create(key_handle.release(), | |
| 652 blink::WebCryptoKeyTypePrivate, | |
| 653 extractable, key_algorithm, usages); | |
| 654 | |
| 655 return Status::Success(); | |
| 656 } | |
| 657 | |
| 658 Status RsaHashedAlgorithm::ImportKeySpki( | |
| 659 const CryptoData& key_data, | |
| 660 const blink::WebCryptoAlgorithm& algorithm, | |
| 661 bool extractable, | |
| 662 blink::WebCryptoKeyUsageMask usages, | |
| 663 blink::WebCryptoKey* key) const { | |
| 664 // The binary blob 'key_data' is expected to be a DER-encoded ASN.1 Subject | |
| 665 // Public Key Info. Decode this to a CERTSubjectPublicKeyInfo. | |
| 666 SECItem spki_item = MakeSECItemForBuffer(key_data); | |
| 667 const ScopedCERTSubjectPublicKeyInfo spki( | |
| 668 SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item)); | |
| 669 if (!spki) | |
| 670 return Status::DataError(); | |
| 671 | |
| 672 crypto::ScopedSECKEYPublicKey sec_public_key( | |
| 673 SECKEY_ExtractPublicKey(spki.get())); | |
| 674 if (!sec_public_key) | |
| 675 return Status::DataError(); | |
| 676 | |
| 677 const KeyType sec_key_type = SECKEY_GetPublicKeyType(sec_public_key.get()); | |
| 678 if (sec_key_type != rsaKey) | |
| 679 return Status::DataError(); | |
| 680 | |
| 681 blink::WebCryptoKeyAlgorithm key_algorithm; | |
| 682 if (!CreateRsaHashedPublicKeyAlgorithm( | |
| 683 algorithm.id(), algorithm.rsaHashedImportParams()->hash().id(), | |
| 684 sec_public_key.get(), &key_algorithm)) { | |
| 685 return Status::ErrorUnexpected(); | |
| 686 } | |
| 687 | |
| 688 // TODO(eroman): This is probably going to be the same as the input. | |
| 689 std::vector<uint8_t> spki_data; | |
| 690 Status status = ExportKeySpkiNss(sec_public_key.get(), &spki_data); | |
| 691 if (status.IsError()) | |
| 692 return status; | |
| 693 | |
| 694 scoped_ptr<PublicKeyNss> key_handle( | |
| 695 new PublicKeyNss(sec_public_key.Pass(), CryptoData(spki_data))); | |
| 696 | |
| 697 *key = blink::WebCryptoKey::create(key_handle.release(), | |
| 698 blink::WebCryptoKeyTypePublic, extractable, | |
| 699 key_algorithm, usages); | |
| 700 | |
| 701 return Status::Success(); | |
| 702 } | |
| 703 | |
| 704 Status RsaHashedAlgorithm::ExportKeyPkcs8(const blink::WebCryptoKey& key, | |
| 705 std::vector<uint8_t>* buffer) const { | |
| 706 if (key.type() != blink::WebCryptoKeyTypePrivate) | |
| 707 return Status::ErrorUnexpectedKeyType(); | |
| 708 *buffer = PrivateKeyNss::Cast(key)->pkcs8_data(); | |
| 709 return Status::Success(); | |
| 710 } | |
| 711 | |
| 712 Status RsaHashedAlgorithm::ExportKeySpki(const blink::WebCryptoKey& key, | |
| 713 std::vector<uint8_t>* buffer) const { | |
| 714 if (key.type() != blink::WebCryptoKeyTypePublic) | |
| 715 return Status::ErrorUnexpectedKeyType(); | |
| 716 *buffer = PublicKeyNss::Cast(key)->spki_data(); | |
| 717 return Status::Success(); | |
| 718 } | |
| 719 | |
| 720 Status RsaHashedAlgorithm::ImportKeyJwk( | |
| 721 const CryptoData& key_data, | |
| 722 const blink::WebCryptoAlgorithm& algorithm, | |
| 723 bool extractable, | |
| 724 blink::WebCryptoKeyUsageMask usages, | |
| 725 blink::WebCryptoKey* key) const { | |
| 726 const char* jwk_algorithm = | |
| 727 GetJwkAlgorithm(algorithm.rsaHashedImportParams()->hash().id()); | |
| 728 | |
| 729 if (!jwk_algorithm) | |
| 730 return Status::ErrorUnexpected(); | |
| 731 | |
| 732 JwkRsaInfo jwk; | |
| 733 Status status = | |
| 734 ReadRsaKeyJwk(key_data, jwk_algorithm, extractable, usages, &jwk); | |
| 735 if (status.IsError()) | |
| 736 return status; | |
| 737 | |
| 738 // Once the key type is known, verify the usages. | |
| 739 status = CheckKeyCreationUsages( | |
| 740 jwk.is_private_key ? all_private_key_usages_ : all_public_key_usages_, | |
| 741 usages, !jwk.is_private_key); | |
| 742 if (status.IsError()) | |
| 743 return status; | |
| 744 | |
| 745 return jwk.is_private_key | |
| 746 ? ImportRsaPrivateKey(algorithm, extractable, usages, jwk, key) | |
| 747 : ImportRsaPublicKey(algorithm, extractable, usages, | |
| 748 CryptoData(jwk.n), CryptoData(jwk.e), key); | |
| 749 } | |
| 750 | |
| 751 Status RsaHashedAlgorithm::ExportKeyJwk(const blink::WebCryptoKey& key, | |
| 752 std::vector<uint8_t>* buffer) const { | |
| 753 const char* jwk_algorithm = | |
| 754 GetJwkAlgorithm(key.algorithm().rsaHashedParams()->hash().id()); | |
| 755 | |
| 756 if (!jwk_algorithm) | |
| 757 return Status::ErrorUnexpected(); | |
| 758 | |
| 759 switch (key.type()) { | |
| 760 case blink::WebCryptoKeyTypePublic: { | |
| 761 SECKEYPublicKey* nss_key = PublicKeyNss::Cast(key)->key(); | |
| 762 if (nss_key->keyType != rsaKey) | |
| 763 return Status::ErrorUnsupported(); | |
| 764 | |
| 765 WriteRsaPublicKeyJwk(SECItemToCryptoData(nss_key->u.rsa.modulus), | |
| 766 SECItemToCryptoData(nss_key->u.rsa.publicExponent), | |
| 767 jwk_algorithm, key.extractable(), key.usages(), | |
| 768 buffer); | |
| 769 | |
| 770 return Status::Success(); | |
| 771 } | |
| 772 | |
| 773 case blink::WebCryptoKeyTypePrivate: { | |
| 774 SECKEYPrivateKey* nss_key = PrivateKeyNss::Cast(key)->key(); | |
| 775 RSAPrivateKey key_props = {}; | |
| 776 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key(&key_props); | |
| 777 | |
| 778 if (!InitRSAPrivateKey(nss_key, &key_props)) | |
| 779 return Status::OperationError(); | |
| 780 | |
| 781 WriteRsaPrivateKeyJwk(SECItemToCryptoData(key_props.modulus), | |
| 782 SECItemToCryptoData(key_props.public_exponent), | |
| 783 SECItemToCryptoData(key_props.private_exponent), | |
| 784 SECItemToCryptoData(key_props.prime1), | |
| 785 SECItemToCryptoData(key_props.prime2), | |
| 786 SECItemToCryptoData(key_props.exponent1), | |
| 787 SECItemToCryptoData(key_props.exponent2), | |
| 788 SECItemToCryptoData(key_props.coefficient), | |
| 789 jwk_algorithm, key.extractable(), key.usages(), | |
| 790 buffer); | |
| 791 | |
| 792 return Status::Success(); | |
| 793 } | |
| 794 default: | |
| 795 return Status::ErrorUnexpected(); | |
| 796 } | |
| 797 } | |
| 798 | |
| 799 Status RsaHashedAlgorithm::SerializeKeyForClone( | |
| 800 const blink::WebCryptoKey& key, | |
| 801 blink::WebVector<uint8_t>* key_data) const { | |
| 802 key_data->assign(static_cast<KeyNss*>(key.handle())->serialized_key_data()); | |
| 803 return Status::Success(); | |
| 804 } | |
| 805 | |
| 806 // TODO(eroman): Defer import to the crypto thread. http://crbug.com/430763 | |
| 807 Status RsaHashedAlgorithm::DeserializeKeyForClone( | |
| 808 const blink::WebCryptoKeyAlgorithm& algorithm, | |
| 809 blink::WebCryptoKeyType type, | |
| 810 bool extractable, | |
| 811 blink::WebCryptoKeyUsageMask usages, | |
| 812 const CryptoData& key_data, | |
| 813 blink::WebCryptoKey* key) const { | |
| 814 blink::WebCryptoAlgorithm import_algorithm = CreateRsaHashedImportAlgorithm( | |
| 815 algorithm.id(), algorithm.rsaHashedParams()->hash().id()); | |
| 816 | |
| 817 Status status; | |
| 818 | |
| 819 switch (type) { | |
| 820 case blink::WebCryptoKeyTypePublic: | |
| 821 status = | |
| 822 ImportKeySpki(key_data, import_algorithm, extractable, usages, key); | |
| 823 break; | |
| 824 case blink::WebCryptoKeyTypePrivate: | |
| 825 status = | |
| 826 ImportKeyPkcs8(key_data, import_algorithm, extractable, usages, key); | |
| 827 break; | |
| 828 default: | |
| 829 return Status::ErrorUnexpected(); | |
| 830 } | |
| 831 | |
| 832 // There is some duplicated information in the serialized format used by | |
| 833 // structured clone (since the KeyAlgorithm is serialized separately from the | |
| 834 // key data). Use this extra information to further validate what was | |
| 835 // deserialized from the key data. | |
| 836 | |
| 837 if (algorithm.id() != key->algorithm().id()) | |
| 838 return Status::ErrorUnexpected(); | |
| 839 | |
| 840 if (key->type() != type) | |
| 841 return Status::ErrorUnexpected(); | |
| 842 | |
| 843 if (algorithm.rsaHashedParams()->modulusLengthBits() != | |
| 844 key->algorithm().rsaHashedParams()->modulusLengthBits()) { | |
| 845 return Status::ErrorUnexpected(); | |
| 846 } | |
| 847 | |
| 848 if (algorithm.rsaHashedParams()->publicExponent().size() != | |
| 849 key->algorithm().rsaHashedParams()->publicExponent().size() || | |
| 850 0 != | |
| 851 memcmp(algorithm.rsaHashedParams()->publicExponent().data(), | |
| 852 key->algorithm().rsaHashedParams()->publicExponent().data(), | |
| 853 key->algorithm().rsaHashedParams()->publicExponent().size())) { | |
| 854 return Status::ErrorUnexpected(); | |
| 855 } | |
| 856 | |
| 857 return Status::Success(); | |
| 858 } | |
| 859 | |
| 860 } // namespace webcrypto | |
| 861 | |
| 862 } // namespace content | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1077273002:
html_viewer: Move webcrypto to a place where html_viewer can use it. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master