Encrypt certificate reports before uploading to HTTP URLs

chrome/browser/net/cert_logger.proto

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This protobuffer is intended to store reports from Chrome users of
 // certificate errors. A report will be sent from Chrome when it gets
 // e.g. a certificate for google.com that chains up to a root CA not expected by
 // Chrome for that origin, such as DigiNotar (compromised in July 2011), or
 // other pinning errors such as a blacklisted cert in the chain, or
 // (when opted in) other certificate validation errors like an expired
@@ skipping 23 matching lines @@
   // site generating the pinning error.
   required int64 time_usec = 3;
   // public_key_hash contains the string forms of the hashes calculated for
   // the chain. (I.e. "sha1/<base64 data>".)
   repeated string public_key_hash = 4;
   // pin contains the string forms of the pins that were matched against for
   // this host.
   repeated string pin = 5;
 };
 
+// A wrapper proto containing an encrypted CertLoggerRequest
+message EncryptedCertLoggerRequest {
+  // An encrypted, serialized CertLoggerRequest
+  required bytes encrypted_report = 1;
+  // The server public key version that was used to derive the shared secret.
+  required uint32 server_public_key_version = 2;
+  // The client public key that corresponds to the private key that was used
+  // to derive the shared secret.
+  required bytes client_public_key = 3;
+  // The encryption algorithm used to encrypt the report.
+  enum Algorithm {
+    UNKNOWN_ALGORITHM = 0;
+    AEAD_ECDH_AES_128_CTR_HMAC_SHA256 = 1;
+  }
+  optional Algorithm algorithm = 4
+      [default = AEAD_ECDH_AES_128_CTR_HMAC_SHA256];
+};
+
 // The response sent back to the user.
 message CertLoggerResponse {
   enum ResponseCode {
     OK = 1;
     MALFORMED_CERT_DATA = 2;
     HOST_CERT_DONT_MATCH = 3;
     ROOT_NOT_RECOGNIZED = 4;
     ROOT_NOT_UNEXPECTED = 5;
     OTHER_ERROR = 6;
   };
   required ResponseCode response = 1;
 };
-