[webcrypto] Some fixes for HMAC

content/renderer/webcrypto/webcrypto_impl_nss.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/webcrypto/webcrypto_impl.h"
 
 #include <cryptohi.h>
 #include <pk11pub.h>
 #include <sechash.h>
 
@@ skipping 62 matching lines @@
     case blink::WebCryptoAlgorithmIdSha384:
       return HASH_AlgSHA384;
     case blink::WebCryptoAlgorithmIdSha512:
       return HASH_AlgSHA512;
     default:
       // Not a digest algorithm.
       return HASH_AlgNULL;
   }
 }
 
-CK_MECHANISM_TYPE WebCryptoAlgorithmToHMACMechanism(
+CK_MECHANISM_TYPE WebCryptoHashToHMACMechanism(
     const blink::WebCryptoAlgorithm& algorithm) {
   switch (algorithm.id()) {
     case blink::WebCryptoAlgorithmIdSha1:
       return CKM_SHA_1_HMAC;
+    case blink::WebCryptoAlgorithmIdSha224:
+      return CKM_SHA224_HMAC;
     case blink::WebCryptoAlgorithmIdSha256:
       return CKM_SHA256_HMAC;
+    case blink::WebCryptoAlgorithmIdSha384:
+      return CKM_SHA384_HMAC;
+    case blink::WebCryptoAlgorithmIdSha512:
+      return CKM_SHA512_HMAC;
     default:
       // Not a supported algorithm.
       return CKM_INVALID_MECHANISM;
   }
 }
 
 bool AesCbcEncryptDecrypt(
     CK_ATTRIBUTE_TYPE operation,
     const blink::WebCryptoAlgorithm& algorithm,
     const blink::WebCryptoKey& key,
@@ skipping 68 matching lines @@
                                      buffer_data + output_len,
                                      &final_output_chunk_len,
                                      output_max_len - output_len)) {
     return false;
   }
 
   webcrypto::ShrinkBuffer(buffer, final_output_chunk_len + output_len);
   return true;
 }
 
-CK_MECHANISM_TYPE HmacAlgorithmToGenMechanism(
-    const blink::WebCryptoAlgorithm& algorithm) {
-  DCHECK_EQ(algorithm.id(), blink::WebCryptoAlgorithmIdHmac);
-  const blink::WebCryptoHmacKeyParams* params = algorithm.hmacKeyParams();
-  DCHECK(params);
-  switch (params->hash().id()) {
-    case blink::WebCryptoAlgorithmIdSha1:
-      return CKM_SHA_1_HMAC;
-    case blink::WebCryptoAlgorithmIdSha256:
-      return CKM_SHA256_HMAC;
-    default:
-      return CKM_INVALID_MECHANISM;
-  }
-}
-
 CK_MECHANISM_TYPE WebCryptoAlgorithmToGenMechanism(
     const blink::WebCryptoAlgorithm& algorithm) {
   switch (algorithm.id()) {
     case blink::WebCryptoAlgorithmIdAesCbc:
       return CKM_AES_KEY_GEN;
     case blink::WebCryptoAlgorithmIdHmac:
-      return HmacAlgorithmToGenMechanism(algorithm);
+      return WebCryptoHashToHMACMechanism(algorithm.hmacKeyParams()->hash());
     default:
       return CKM_INVALID_MECHANISM;
   }
 }
 
-// TODO(eroman): This is duplicated in OpenSSL version.
-unsigned int WebCryptoHmacAlgorithmToBlockSizeBits(
-    const blink::WebCryptoAlgorithm& algorithm) {
-  DCHECK_EQ(algorithm.id(), blink::WebCryptoAlgorithmIdHmac);
-  const blink::WebCryptoHmacKeyParams* params = algorithm.hmacKeyParams();
-  DCHECK(params);
-  switch (params->hash().id()) {
-    case blink::WebCryptoAlgorithmIdSha1:
-      return 512;
-    case blink::WebCryptoAlgorithmIdSha256:
-      return 512;
-    default:
-      return 0;
-  }
-}
-
 // Converts a (big-endian) WebCrypto BigInteger, with or without leading zeros,
 // to unsigned long.
 bool BigIntegerToLong(const uint8* data,
                       unsigned data_size,
                       unsigned long* result) {
   // TODO(padolph): Is it correct to say that empty data is an error, or does it
   // mean value 0? See https://www.w3.org/Bugs/Public/show_bug.cgi?id=23655
   if (data_size == 0)
     return false;
 
@@ skipping 43 matching lines @@
   // possible operations for this key type.
   CK_FLAGS flags = 0;
 
   switch (algorithm.id()) {
     case blink::WebCryptoAlgorithmIdHmac: {
       const blink::WebCryptoHmacParams* params = algorithm.hmacParams();
       if (!params) {
         return false;
       }
 
-      mechanism = WebCryptoAlgorithmToHMACMechanism(params->hash());
+      mechanism = WebCryptoHashToHMACMechanism(params->hash());
       if (mechanism == CKM_INVALID_MECHANISM) {
         return false;
       }
 
       flags |= CKF_SIGN | CKF_VERIFY;
 
       break;
     }
     case blink::WebCryptoAlgorithmIdAesCbc: {
       mechanism = CKM_AES_CBC;
@@ skipping 379 matching lines @@
       keylen_bytes = params->lengthBits() / 8;
       key_type = blink::WebCryptoKeyTypeSecret;
       break;
     }
     case blink::WebCryptoAlgorithmIdHmac: {
       const blink::WebCryptoHmacKeyParams* params = algorithm.hmacKeyParams();
       DCHECK(params);
       if (params->hasLengthBytes()) {
         keylen_bytes = params->optionalLengthBytes();
       } else {
-        keylen_bytes = WebCryptoHmacAlgorithmToBlockSizeBits(algorithm) / 8;
+        keylen_bytes = webcrypto::ShaBlockSizeBytes(params->hash().id());
       }
 
       key_type = blink::WebCryptoKeyTypeSecret;
       break;
     }
 
     default: {
       return false;
     }
   }
@@ skipping 174 matching lines @@
   switch (algorithm.id()) {
     case blink::WebCryptoAlgorithmIdHmac: {
       const blink::WebCryptoHmacParams* params = algorithm.hmacParams();
       if (!params) {
         return false;
       }
 
       SymKeyHandle* sym_key = reinterpret_cast<SymKeyHandle*>(key.handle());
 
       DCHECK_EQ(PK11_GetMechanism(sym_key->key()),
-                WebCryptoAlgorithmToHMACMechanism(params->hash()));
+                WebCryptoHashToHMACMechanism(params->hash()));
       DCHECK_NE(0, key.usages() & blink::WebCryptoKeyUsageSign);
 
       SECItem param_item = { siBuffer, NULL, 0 };
       SECItem data_item = {
         siBuffer,
         const_cast<unsigned char*>(data),
         data_size
       };
       // First call is to figure out the length.
       SECItem signature_item = { siBuffer, NULL, 0 };
@@ skipping 117 matching lines @@
 
   *key = blink::WebCryptoKey::create(new PublicKeyHandle(pubkey.Pass()),
                                      blink::WebCryptoKeyTypePublic,
                                      extractable,
                                      algorithm,
                                      usage_mask);
   return true;
 }
 
 }  // namespace content