OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/webcrypto/nss/rsa_hashed_algorithm_nss.h" | 5 #include "components/webcrypto/nss/rsa_hashed_algorithm_nss.h" |
6 | 6 |
7 #include <secasn1.h> | 7 #include <secasn1.h> |
8 | 8 |
9 #include "base/logging.h" | 9 #include "base/logging.h" |
10 #include "components/webcrypto/crypto_data.h" | 10 #include "components/webcrypto/crypto_data.h" |
11 #include "components/webcrypto/generate_key_result.h" | 11 #include "components/webcrypto/generate_key_result.h" |
12 #include "components/webcrypto/jwk.h" | 12 #include "components/webcrypto/jwk.h" |
13 #include "components/webcrypto/nss/key_nss.h" | 13 #include "components/webcrypto/nss/key_nss.h" |
14 #include "components/webcrypto/nss/util_nss.h" | 14 #include "components/webcrypto/nss/util_nss.h" |
15 #include "components/webcrypto/status.h" | 15 #include "components/webcrypto/status.h" |
16 #include "components/webcrypto/webcrypto_util.h" | 16 #include "components/webcrypto/webcrypto_util.h" |
17 #include "crypto/scoped_nss_types.h" | 17 #include "crypto/scoped_nss_types.h" |
18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" | 18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h" |
19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" | 19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h" |
20 | 20 |
21 namespace webcrypto { | 21 namespace webcrypto { |
22 | 22 |
23 namespace { | 23 namespace { |
24 | 24 |
25 #if defined(USE_NSS) && !defined(OS_CHROMEOS) | 25 #if defined(USE_NSS_CERTS) && !defined(OS_CHROMEOS) |
26 Status ErrorRsaPrivateKeyImportNotSupported() { | 26 Status ErrorRsaPrivateKeyImportNotSupported() { |
27 return Status::ErrorUnsupported( | 27 return Status::ErrorUnsupported( |
28 "NSS version must be at least 3.16.2 for RSA private key import. See " | 28 "NSS version must be at least 3.16.2 for RSA private key import. See " |
29 "http://crbug.com/380424"); | 29 "http://crbug.com/380424"); |
30 } | 30 } |
31 | 31 |
32 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is | 32 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is |
33 // a security problem for RSA private key import from JWK which uses a | 33 // a security problem for RSA private key import from JWK which uses a |
34 // CKA_ID based on the public modulus to retrieve the private key. | 34 // CKA_ID based on the public modulus to retrieve the private key. |
35 Status NssSupportsRsaPrivateKeyImport() { | 35 Status NssSupportsRsaPrivateKeyImport() { |
(...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
118 SECItem prime1; | 118 SECItem prime1; |
119 SECItem prime2; | 119 SECItem prime2; |
120 SECItem exponent1; | 120 SECItem exponent1; |
121 SECItem exponent2; | 121 SECItem exponent2; |
122 SECItem coefficient; | 122 SECItem coefficient; |
123 }; | 123 }; |
124 | 124 |
125 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo | 125 // The system NSS library doesn't have the new PK11_ExportDERPrivateKeyInfo |
126 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we | 126 // function yet (https://bugzilla.mozilla.org/show_bug.cgi?id=519255). So we |
127 // provide a fallback implementation. | 127 // provide a fallback implementation. |
128 #if defined(USE_NSS) | 128 #if defined(USE_NSS_CERTS) |
129 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { | 129 const SEC_ASN1Template RSAPrivateKeyTemplate[] = { |
130 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, | 130 {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(RSAPrivateKey)}, |
131 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, | 131 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, version)}, |
132 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, | 132 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, modulus)}, |
133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, | 133 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, public_exponent)}, |
134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, | 134 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, private_exponent)}, |
135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, | 135 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime1)}, |
136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, | 136 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, prime2)}, |
137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, | 137 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent1)}, |
138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, | 138 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, exponent2)}, |
139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, | 139 {SEC_ASN1_INTEGER, offsetof(RSAPrivateKey, coefficient)}, |
140 {0}}; | 140 {0}}; |
141 #endif // defined(USE_NSS) | 141 #endif // defined(USE_NSS_CERTS) |
142 | 142 |
143 // On success |value| will be filled with data which must be freed by | 143 // On success |value| will be filled with data which must be freed by |
144 // SECITEM_FreeItem(value, PR_FALSE); | 144 // SECITEM_FreeItem(value, PR_FALSE); |
145 bool ReadUint(SECKEYPrivateKey* key, | 145 bool ReadUint(SECKEYPrivateKey* key, |
146 CK_ATTRIBUTE_TYPE attribute, | 146 CK_ATTRIBUTE_TYPE attribute, |
147 SECItem* value) { | 147 SECItem* value) { |
148 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); | 148 SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, attribute, value); |
149 | 149 |
150 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order | 150 // PK11_ReadRawAttribute() returns items of type siBuffer. However in order |
151 // for the ASN.1 encoding to be correct, the items must be of type | 151 // for the ASN.1 encoding to be correct, the items must be of type |
(...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
245 std::vector<CK_ATTRIBUTE>* templ) { | 245 std::vector<CK_ATTRIBUTE>* templ) { |
246 AddAttribute(type, CryptoData(data), templ); | 246 AddAttribute(type, CryptoData(data), templ); |
247 } | 247 } |
248 | 248 |
249 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { | 249 Status ExportKeyPkcs8Nss(SECKEYPrivateKey* key, std::vector<uint8_t>* buffer) { |
250 if (key->keyType != rsaKey) | 250 if (key->keyType != rsaKey) |
251 return Status::ErrorUnsupported(); | 251 return Status::ErrorUnsupported(); |
252 | 252 |
253 // TODO(rsleevi): Implement OAEP support according to the spec. | 253 // TODO(rsleevi): Implement OAEP support according to the spec. |
254 | 254 |
255 #if defined(USE_NSS) | 255 #if defined(USE_NSS_CERTS) |
256 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. | 256 // PK11_ExportDERPrivateKeyInfo isn't available. Use our fallback code. |
257 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; | 257 const SECOidTag algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION; |
258 const int kPrivateKeyInfoVersion = 0; | 258 const int kPrivateKeyInfoVersion = 0; |
259 | 259 |
260 SECKEYPrivateKeyInfo private_key_info = {}; | 260 SECKEYPrivateKeyInfo private_key_info = {}; |
261 RSAPrivateKey rsa_private_key = {}; | 261 RSAPrivateKey rsa_private_key = {}; |
262 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( | 262 scoped_ptr<RSAPrivateKey, FreeRsaPrivateKey> free_private_key( |
263 &rsa_private_key); | 263 &rsa_private_key); |
264 | 264 |
265 // http://crbug.com/366427: the spec does not define any other failures for | 265 // http://crbug.com/366427: the spec does not define any other failures for |
(...skipping 17 matching lines...) Expand all Loading... |
283 } | 283 } |
284 | 284 |
285 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, | 285 if (!SEC_ASN1EncodeInteger(arena.get(), &private_key_info.version, |
286 kPrivateKeyInfoVersion)) { | 286 kPrivateKeyInfoVersion)) { |
287 return Status::OperationError(); | 287 return Status::OperationError(); |
288 } | 288 } |
289 | 289 |
290 crypto::ScopedSECItem encoded_key( | 290 crypto::ScopedSECItem encoded_key( |
291 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, | 291 SEC_ASN1EncodeItem(NULL, NULL, &private_key_info, |
292 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); | 292 SEC_ASN1_GET(SECKEY_PrivateKeyInfoTemplate))); |
293 #else // defined(USE_NSS) | 293 #else // defined(USE_NSS_CERTS) |
294 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); | 294 crypto::ScopedSECItem encoded_key(PK11_ExportDERPrivateKeyInfo(key, NULL)); |
295 #endif // defined(USE_NSS) | 295 #endif // defined(USE_NSS_CERTS) |
296 | 296 |
297 if (!encoded_key.get()) | 297 if (!encoded_key.get()) |
298 return Status::OperationError(); | 298 return Status::OperationError(); |
299 | 299 |
300 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); | 300 buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len); |
301 return Status::Success(); | 301 return Status::Success(); |
302 } | 302 } |
303 | 303 |
304 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, | 304 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm, |
305 bool extractable, | 305 bool extractable, |
(...skipping 543 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
849 memcmp(algorithm.rsaHashedParams()->publicExponent().data(), | 849 memcmp(algorithm.rsaHashedParams()->publicExponent().data(), |
850 key->algorithm().rsaHashedParams()->publicExponent().data(), | 850 key->algorithm().rsaHashedParams()->publicExponent().data(), |
851 key->algorithm().rsaHashedParams()->publicExponent().size())) { | 851 key->algorithm().rsaHashedParams()->publicExponent().size())) { |
852 return Status::ErrorUnexpected(); | 852 return Status::ErrorUnexpected(); |
853 } | 853 } |
854 | 854 |
855 return Status::Success(); | 855 return Status::Success(); |
856 } | 856 } |
857 | 857 |
858 } // namespace webcrypto | 858 } // namespace webcrypto |
OLD | NEW |