OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/child/webcrypto/nss/rsa_hashed_algorithm_nss.h" | 5 #include "content/child/webcrypto/nss/rsa_hashed_algorithm_nss.h" |
6 | 6 |
7 #include <secasn1.h> | 7 #include <secasn1.h> |
8 | 8 |
9 #include "base/logging.h" | 9 #include "base/logging.h" |
10 #include "content/child/webcrypto/crypto_data.h" | 10 #include "content/child/webcrypto/crypto_data.h" |
11 #include "content/child/webcrypto/generate_key_result.h" | 11 #include "content/child/webcrypto/generate_key_result.h" |
12 #include "content/child/webcrypto/jwk.h" | 12 #include "content/child/webcrypto/jwk.h" |
13 #include "content/child/webcrypto/nss/key_nss.h" | 13 #include "content/child/webcrypto/nss/key_nss.h" |
14 #include "content/child/webcrypto/nss/util_nss.h" | 14 #include "content/child/webcrypto/nss/util_nss.h" |
15 #include "content/child/webcrypto/status.h" | 15 #include "content/child/webcrypto/status.h" |
16 #include "content/child/webcrypto/webcrypto_util.h" | 16 #include "content/child/webcrypto/webcrypto_util.h" |
17 #include "crypto/scoped_nss_types.h" | 17 #include "crypto/scoped_nss_types.h" |
18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" | 18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" |
19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" | 19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" |
20 | 20 |
21 namespace content { | 21 namespace content { |
22 | 22 |
23 namespace webcrypto { | 23 namespace webcrypto { |
24 | 24 |
25 namespace { | 25 namespace { |
26 | 26 |
27 #if defined(USE_NSS) && !defined(OS_CHROMEOS) | 27 #if defined(USE_NSS_CERTS) && !defined(OS_CHROMEOS) |
28 Status ErrorRsaPrivateKeyImportNotSupported() { | 28 Status ErrorRsaPrivateKeyImportNotSupported() { |
29 return Status::ErrorUnsupported( | 29 return Status::ErrorUnsupported( |
30 "NSS version must be at least 3.16.2 for RSA private key import. See " | 30 "NSS version must be at least 3.16.2 for RSA private key import. See " |
31 "http://crbug.com/380424"); | 31 "http://crbug.com/380424"); |
32 } | 32 } |
33 | 33 |
34 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is | 34 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is |
35 // a security problem for RSA private key import from JWK which uses a | 35 // a security problem for RSA private key import from JWK which uses a |
36 // CKA_ID based on the public modulus to retrieve the private key. | 36 // CKA_ID based on the public modulus to retrieve the private key. |
37 Status NssSupportsRsaPrivateKeyImport() { | 37 Status NssSupportsRsaPrivateKeyImport() { |
(...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
120 SECItem prime1; | 120 SECItem prime1; |
121 SECItem prime2; | 121 SECItem prime2; |
122 SECItem exponent1; | 122 SECItem exponent1; |
123 SECItem exponent2; | 123 SECItem exponent2; |
124 SECItem coefficient; | 124 SECItem coefficient; |
125 }; | 125 }; |
126 | 126 |
127 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo | 127 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo |
128 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we | 128 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we |
129 // provide a fallback implementation. | 129 // provide a fallback implementation. |
130 #if defined(USE_NSS) | 130 #if defined(USE_NSS_CERTS) |
131 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { | 131 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { |
132 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, | 132 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, |
133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, | 133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, |
134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, | 134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, |
135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, | 135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, |
136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, | 136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, |
137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, | 137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, |
138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, | 138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, |
139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, | 139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, |
140 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, | 140 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, |
141 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, | 141 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, |
142 {0}}; | 142 {0}}; |
143 #endif // defined(USE_NSS) | 143 #endif // defined(USE_NSS_CERTS) |
144 | 144 |
145 // On success |value| will be filled with data which must be freed by | 145 // On success |value| will be filled with data which must be freed by |
146 // SECITEM_FreeItem(value, PR_FALSE); | 146 // SECITEM_FreeItem(value, PR_FALSE); |
147 bool ReadUint(SECKEYPrivateKey* key, | 147 bool ReadUint(SECKEYPrivateKey* key, |
148 CK_ATTRIBUTE_TYPE attribute, | 148 CK_ATTRIBUTE_TYPE attribute, |
149 SECItem* value) { | 149 SECItem* value) { |
150 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); | 150 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); |
151 | 151 |
152 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order | 152 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order |
153 // for the ASN.1 encoding to be correct, the items must be of type | 153 // for the ASN.1 encoding to be correct, the items must be of type |
(...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
247 std::vector<CK_ATTRIBUTE>* templ) { | 247 std::vector<CK_ATTRIBUTE>* templ) { |
248 AddAttribute(type, CryptoData(data), templ); | 248 AddAttribute(type, CryptoData(data), templ); |
249 } | 249 } |
250 | 250 |
251 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { | 251 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { |
252 if (key->keyType != rsaKey) | 252 if (key->keyType != rsaKey) |
253 return Status::ErrorUnsupported(); | 253 return Status::ErrorUnsupported(); |
254 | 254 |
255 // TODO(rsleevi): Implement OAEP support according to the spec. | 255 // TODO(rsleevi): Implement OAEP support according to the spec. |
256 | 256 |
257 #if defined(USE_NSS) | 257 #if defined(USE_NSS_CERTS) |
258 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. | 258 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. |
259 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; | 259 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; |
260 const int kPrivateKeyInfoVersion = 0; | 260 const int kPrivateKeyInfoVersion = 0; |
261 | 261 |
262 SECKEYPrivateKeyInfo private_key_info = {}; | 262 SECKEYPrivateKeyInfo private_key_info = {}; |
263 RSAPrivateKey rsa_private_key = {}; | 263 RSAPrivateKey rsa_private_key = {}; |
264 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( | 264 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( |
265 &rsa_private_key); | 265 &rsa_private_key); |
266 | 266 |
267 // http://crbug.com/366427: the spec does not define any other failures for | 267 // http://crbug.com/366427: the spec does not define any other failures for |
(...skipping 17 matching lines...) Expand all Loading... |
285 } | 285 } |
286 | 286 |
287 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, | 287 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, |
288 kPrivateKeyInfoVersion)) { | 288 kPrivateKeyInfoVersion)) { |
289 return Status::OperationError(); | 289 return Status::OperationError(); |
290 } | 290 } |
291 | 291 |
292 crypto::ScopedSECItem encoded_key( | 292 crypto::ScopedSECItem encoded_key( |
293 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, | 293 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, |
294 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); | 294 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); |
295 #else // defined(USE_NSS) | 295 #else // defined(USE_NSS_CERTS) |
296 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); | 296 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); |
297 #endif // defined(USE_NSS) | 297 #endif // defined(USE_NSS_CERTS) |
298 | 298 |
299 if (!encoded_key.get()) | 299 if (!encoded_key.get()) |
300 return Status::OperationError(); | 300 return Status::OperationError(); |
301 | 301 |
302 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); | 302 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); |
303 return Status::Success(); | 303 return Status::Success(); |
304 } | 304 } |
305 | 305 |
306 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, | 306 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, |
307 bool extractable, | 307 bool extractable, |
(...skipping 545 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
853 key->algorithm().rsaHashedParams()->publicExponent().size())) { | 853 key->algorithm().rsaHashedParams()->publicExponent().size())) { |
854 return Status::ErrorUnexpected(); | 854 return Status::ErrorUnexpected(); |
855 } | 855 } |
856 | 856 |
857 return Status::Success(); | 857 return Status::Success(); |
858 } | 858 } |
859 | 859 |
860 } // namespace webcrypto | 860 } // namespace webcrypto |
861 | 861 |
862 } // namespace content | 862 } // namespace content |
OLD | NEW |