| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/child/webcrypto/nss/rsa_hashed_algorithm_nss.h" | 5 #include "content/child/webcrypto/nss/rsa_hashed_algorithm_nss.h" |
| 6 | 6 |
| 7 #include <secasn1.h> | 7 #include <secasn1.h> |
| 8 | 8 |
| 9 #include "base/logging.h" | 9 #include "base/logging.h" |
| 10 #include "content/child/webcrypto/crypto_data.h" | 10 #include "content/child/webcrypto/crypto_data.h" |
| 11 #include "content/child/webcrypto/generate_key_result.h" | 11 #include "content/child/webcrypto/generate_key_result.h" |
| 12 #include "content/child/webcrypto/jwk.h" | 12 #include "content/child/webcrypto/jwk.h" |
| 13 #include "content/child/webcrypto/nss/key_nss.h" | 13 #include "content/child/webcrypto/nss/key_nss.h" |
| 14 #include "content/child/webcrypto/nss/util_nss.h" | 14 #include "content/child/webcrypto/nss/util_nss.h" |
| 15 #include "content/child/webcrypto/status.h" | 15 #include "content/child/webcrypto/status.h" |
| 16 #include "content/child/webcrypto/webcrypto_util.h" | 16 #include "content/child/webcrypto/webcrypto_util.h" |
| 17 #include "crypto/scoped_nss_types.h" | 17 #include "crypto/scoped_nss_types.h" |
| 18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" | 18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" |
| 19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" | 19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" |
| 20 | 20 |
| 21 namespace content { | 21 namespace content { |
| 22 | 22 |
| 23 namespace webcrypto { | 23 namespace webcrypto { |
| 24 | 24 |
| 25 namespace { | 25 namespace { |
| 26 | 26 |
| 27 #if defined(USE_NSS) && !defined(OS_CHROMEOS) | 27 #if defined(USE_NSS_CERTS) && !defined(OS_CHROMEOS) |
| 28 Status ErrorRsaPrivateKeyImportNotSupported() { | 28 Status ErrorRsaPrivateKeyImportNotSupported() { |
| 29 return Status::ErrorUnsupported( | 29 return Status::ErrorUnsupported( |
| 30 "NSS version must be at least 3.16.2 for RSA private key import. See " | 30 "NSS version must be at least 3.16.2 for RSA private key import. See " |
| 31 "http://crbug.com/380424"); | 31 "http://crbug.com/380424"); |
| 32 } | 32 } |
| 33 | 33 |
| 34 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is | 34 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is |
| 35 // a security problem for RSA private key import from JWK which uses a | 35 // a security problem for RSA private key import from JWK which uses a |
| 36 // CKA_ID based on the public modulus to retrieve the private key. | 36 // CKA_ID based on the public modulus to retrieve the private key. |
| 37 Status NssSupportsRsaPrivateKeyImport() { | 37 Status NssSupportsRsaPrivateKeyImport() { |
| (...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 120 SECItem prime1; | 120 SECItem prime1; |
| 121 SECItem prime2; | 121 SECItem prime2; |
| 122 SECItem exponent1; | 122 SECItem exponent1; |
| 123 SECItem exponent2; | 123 SECItem exponent2; |
| 124 SECItem coefficient; | 124 SECItem coefficient; |
| 125 }; | 125 }; |
| 126 | 126 |
| 127 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo | 127 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo |
| 128 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we | 128 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we |
| 129 // provide a fallback implementation. | 129 // provide a fallback implementation. |
| 130 #if defined(USE_NSS) | 130 #if defined(USE_NSS_CERTS) |
| 131 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { | 131 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { |
| 132 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, | 132 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, |
| 133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, | 133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, |
| 134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, | 134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, |
| 135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, | 135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, |
| 136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, | 136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, |
| 137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, | 137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, |
| 138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, | 138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, |
| 139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, | 139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, |
| 140 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, | 140 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, |
| 141 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, | 141 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, |
| 142 {0}}; | 142 {0}}; |
| 143 #endif // defined(USE_NSS) | 143 #endif // defined(USE_NSS_CERTS) |
| 144 | 144 |
| 145 // On success |value| will be filled with data which must be freed by | 145 // On success |value| will be filled with data which must be freed by |
| 146 // SECITEM_FreeItem(value, PR_FALSE); | 146 // SECITEM_FreeItem(value, PR_FALSE); |
| 147 bool ReadUint(SECKEYPrivateKey* key, | 147 bool ReadUint(SECKEYPrivateKey* key, |
| 148 CK_ATTRIBUTE_TYPE attribute, | 148 CK_ATTRIBUTE_TYPE attribute, |
| 149 SECItem* value) { | 149 SECItem* value) { |
| 150 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); | 150 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); |
| 151 | 151 |
| 152 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order | 152 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order |
| 153 // for the ASN.1 encoding to be correct, the items must be of type | 153 // for the ASN.1 encoding to be correct, the items must be of type |
| (...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 247 std::vector<CK_ATTRIBUTE>* templ) { | 247 std::vector<CK_ATTRIBUTE>* templ) { |
| 248 AddAttribute(type, CryptoData(data), templ); | 248 AddAttribute(type, CryptoData(data), templ); |
| 249 } | 249 } |
| 250 | 250 |
| 251 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { | 251 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { |
| 252 if (key->keyType != rsaKey) | 252 if (key->keyType != rsaKey) |
| 253 return Status::ErrorUnsupported(); | 253 return Status::ErrorUnsupported(); |
| 254 | 254 |
| 255 // TODO(rsleevi): Implement OAEP support according to the spec. | 255 // TODO(rsleevi): Implement OAEP support according to the spec. |
| 256 | 256 |
| 257 #if defined(USE_NSS) | 257 #if defined(USE_NSS_CERTS) |
| 258 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. | 258 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. |
| 259 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; | 259 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; |
| 260 const int kPrivateKeyInfoVersion = 0; | 260 const int kPrivateKeyInfoVersion = 0; |
| 261 | 261 |
| 262 SECKEYPrivateKeyInfo private_key_info = {}; | 262 SECKEYPrivateKeyInfo private_key_info = {}; |
| 263 RSAPrivateKey rsa_private_key = {}; | 263 RSAPrivateKey rsa_private_key = {}; |
| 264 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( | 264 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( |
| 265 &rsa_private_key); | 265 &rsa_private_key); |
| 266 | 266 |
| 267 // http://crbug.com/366427: the spec does not define any other failures for | 267 // http://crbug.com/366427: the spec does not define any other failures for |
| (...skipping 17 matching lines...) Expand all Loading... |
| 285 } | 285 } |
| 286 | 286 |
| 287 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, | 287 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, |
| 288 kPrivateKeyInfoVersion)) { | 288 kPrivateKeyInfoVersion)) { |
| 289 return Status::OperationError(); | 289 return Status::OperationError(); |
| 290 } | 290 } |
| 291 | 291 |
| 292 crypto::ScopedSECItem encoded_key( | 292 crypto::ScopedSECItem encoded_key( |
| 293 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, | 293 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, |
| 294 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); | 294 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); |
| 295 #else // defined(USE_NSS) | 295 #else // defined(USE_NSS_CERTS) |
| 296 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); | 296 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); |
| 297 #endif // defined(USE_NSS) | 297 #endif // defined(USE_NSS_CERTS) |
| 298 | 298 |
| 299 if (!encoded_key.get()) | 299 if (!encoded_key.get()) |
| 300 return Status::OperationError(); | 300 return Status::OperationError(); |
| 301 | 301 |
| 302 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); | 302 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); |
| 303 return Status::Success(); | 303 return Status::Success(); |
| 304 } | 304 } |
| 305 | 305 |
| 306 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, | 306 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, |
| 307 bool extractable, | 307 bool extractable, |
| (...skipping 545 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 853 key->algorithm().rsaHashedParams()->publicExponent().size())) { | 853 key->algorithm().rsaHashedParams()->publicExponent().size())) { |
| 854 return Status::ErrorUnexpected(); | 854 return Status::ErrorUnexpected(); |
| 855 } | 855 } |
| 856 | 856 |
| 857 return Status::Success(); | 857 return Status::Success(); |
| 858 } | 858 } |
| 859 | 859 |
| 860 } // namespace webcrypto | 860 } // namespace webcrypto |
| 861 | 861 |
| 862 } // namespace content | 862 } // namespace content |
| OLD | NEW |