| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_CHROMEOS_LOGIN_EASY_UNLOCK_EASY_UNLOCK_TPM_KEY_MANAGER_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_LOGIN_EASY_UNLOCK_EASY_UNLOCK_TPM_KEY_MANAGER_H_ |
| 6 #define CHROME_BROWSER_CHROMEOS_LOGIN_EASY_UNLOCK_EASY_UNLOCK_TPM_KEY_MANAGER_H_ | 6 #define CHROME_BROWSER_CHROMEOS_LOGIN_EASY_UNLOCK_EASY_UNLOCK_TPM_KEY_MANAGER_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/callback.h" | 11 #include "base/callback.h" |
| 12 #include "base/macros.h" | 12 #include "base/macros.h" |
| 13 #include "base/memory/weak_ptr.h" | 13 #include "base/memory/weak_ptr.h" |
| 14 #include "components/keyed_service/core/keyed_service.h" | 14 #include "components/keyed_service/core/keyed_service.h" |
| 15 #include "components/signin/core/account_id/account_id.h" |
| 15 #include "crypto/scoped_nss_types.h" | 16 #include "crypto/scoped_nss_types.h" |
| 16 | 17 |
| 17 class PrefRegistrySimple; | 18 class PrefRegistrySimple; |
| 18 class PrefService; | 19 class PrefService; |
| 19 | 20 |
| 20 // Manages per user RSA keys stored in system TPM slot used in easy signin | 21 // Manages per user RSA keys stored in system TPM slot used in easy signin |
| 21 // protocol. The keys are used to sign a nonce exchanged during signin. | 22 // protocol. The keys are used to sign a nonce exchanged during signin. |
| 22 class EasyUnlockTpmKeyManager : public KeyedService { | 23 class EasyUnlockTpmKeyManager : public KeyedService { |
| 23 public: | 24 public: |
| 24 // Registers local state prefs used to store public RSA keys per user. | 25 // Registers local state prefs used to store public RSA keys per user. |
| 25 static void RegisterLocalStatePrefs(PrefRegistrySimple* registry); | 26 static void RegisterLocalStatePrefs(PrefRegistrySimple* registry); |
| 26 | 27 |
| 27 // Clears local state for user. Should be called when a user is removed. | 28 // Clears local state for user. Should be called when a user is removed. |
| 28 static void ResetLocalStateForUser(const std::string& user_id); | 29 static void ResetLocalStateForUser(const AccountId& account_id); |
| 29 | 30 |
| 30 // |user_id|: Id for the user associated with the service. Empty for sign-in | 31 // |account_id|: Id for the user associated with the service. Empty for |
| 31 // service. | 32 // sign-in service. |
| 32 // |username_hash|: Username hash for the user associated with the service. | 33 // |username_hash|: Username hash for the user associated with the service. |
| 33 // Empty for sign-in service. | 34 // Empty for sign-in service. |
| 34 // |local_state|: The local state prefs. | 35 // |local_state|: The local state prefs. |
| 35 EasyUnlockTpmKeyManager(const std::string& user_id, | 36 EasyUnlockTpmKeyManager(const AccountId& account_id, |
| 36 const std::string& username_hash, | 37 const std::string& username_hash, |
| 37 PrefService* local_state); | 38 PrefService* local_state); |
| 38 ~EasyUnlockTpmKeyManager() override; | 39 ~EasyUnlockTpmKeyManager() override; |
| 39 | 40 |
| 40 // Checks if the RSA public key is set in the local state. If not, creates | 41 // Checks if the RSA public key is set in the local state. If not, creates |
| 41 // one. If the key presence can be confirmed, immediately returns true and | 42 // one. If the key presence can be confirmed, immediately returns true and |
| 42 // |callback| never gets called, otherwise returns false (callback is called | 43 // |callback| never gets called, otherwise returns false (callback is called |
| 43 // when the key presence is confirmed). | 44 // when the key presence is confirmed). |
| 44 // Must not be called for signin profile. | 45 // Must not be called for signin profile. |
| 45 // |check_private_key|: If public RSA key is set in the local state, whether | 46 // |check_private_key|: If public RSA key is set in the local state, whether |
| (...skipping 11 matching lines...) Expand all Loading... |
| 57 const base::Closure& callback); | 58 const base::Closure& callback); |
| 58 | 59 |
| 59 // If called, posts a delayed task that cancels |PrepareTpmKey| and all other | 60 // If called, posts a delayed task that cancels |PrepareTpmKey| and all other |
| 60 // started timeouts in case getting system slot takes more than |timeout_ms|. | 61 // started timeouts in case getting system slot takes more than |timeout_ms|. |
| 61 // In the case getting system slot times out, |PrepareTpmKey| callback will | 62 // In the case getting system slot times out, |PrepareTpmKey| callback will |
| 62 // be called with an empty public key. | 63 // be called with an empty public key. |
| 63 // Must be called after |PrepareTpmKey| to have the intended effect. | 64 // Must be called after |PrepareTpmKey| to have the intended effect. |
| 64 bool StartGetSystemSlotTimeoutMs(size_t timeout_ms); | 65 bool StartGetSystemSlotTimeoutMs(size_t timeout_ms); |
| 65 | 66 |
| 66 // Gets the public RSA key for user. The key is retrieved from local state. | 67 // Gets the public RSA key for user. The key is retrieved from local state. |
| 67 std::string GetPublicTpmKey(const std::string& user_id); | 68 std::string GetPublicTpmKey(const AccountId& account_id); |
| 68 | 69 |
| 69 // Signs |data| using private RSA key associated with |user_id| stored in TPM | 70 // Signs |data| using private RSA key associated with |user_id| stored in TPM |
| 70 // system slot. | 71 // system slot. |
| 71 void SignUsingTpmKey( | 72 void SignUsingTpmKey( |
| 72 const std::string& user_id, | 73 const AccountId& account_id, |
| 73 const std::string& data, | 74 const std::string& data, |
| 74 const base::Callback<void(const std::string& data)> callback); | 75 const base::Callback<void(const std::string& data)> callback); |
| 75 | 76 |
| 76 bool StartedCreatingTpmKeys() const; | 77 bool StartedCreatingTpmKeys() const; |
| 77 | 78 |
| 78 private: | 79 private: |
| 79 enum CreateTpmKeyState { | 80 enum CreateTpmKeyState { |
| 80 CREATE_TPM_KEY_NOT_STARTED, | 81 CREATE_TPM_KEY_NOT_STARTED, |
| 81 CREATE_TPM_KEY_WAITING_FOR_USER_SLOT, | 82 CREATE_TPM_KEY_WAITING_FOR_USER_SLOT, |
| 82 CREATE_TPM_KEY_WAITING_FOR_SYSTEM_SLOT, | 83 CREATE_TPM_KEY_WAITING_FOR_SYSTEM_SLOT, |
| 83 CREATE_TPM_KEY_GOT_SYSTEM_SLOT, | 84 CREATE_TPM_KEY_GOT_SYSTEM_SLOT, |
| 84 CREATE_TPM_KEY_DONE | 85 CREATE_TPM_KEY_DONE |
| 85 }; | 86 }; |
| 86 | 87 |
| 87 // Utility method for setting public key values in local state. | 88 // Utility method for setting public key values in local state. |
| 88 // Note that the keys are saved base64 encoded. | 89 // Note that the keys are saved base64 encoded. |
| 89 void SetKeyInLocalState(const std::string& user_id, | 90 void SetKeyInLocalState(const AccountId& account_id, |
| 90 const std::string& value); | 91 const std::string& value); |
| 91 | 92 |
| 92 // Called when TPM system slot is initialized and ready to be used. | 93 // Called when TPM system slot is initialized and ready to be used. |
| 93 // It creates RSA key pair for the user in the system slot. | 94 // It creates RSA key pair for the user in the system slot. |
| 94 // When the key pair is created, |OnTpmKeyCreated| will be called with the | 95 // When the key pair is created, |OnTpmKeyCreated| will be called with the |
| 95 // created public key. | 96 // created public key. |
| 96 // The key will not be created if |public_key| is non-empty and the associated | 97 // The key will not be created if |public_key| is non-empty and the associated |
| 97 // private key can be found in the slot. Instead |OnTpmKeyCreated| will be | 98 // private key can be found in the slot. Instead |OnTpmKeyCreated| will be |
| 98 // called with |public_key|. | 99 // called with |public_key|. |
| 99 void CreateKeyInSystemSlot(const std::string& public_key, | 100 void CreateKeyInSystemSlot(const std::string& public_key, |
| (...skipping 21 matching lines...) Expand all Loading... |
| 121 // |PrepareTpmKey| callbacks. | 122 // |PrepareTpmKey| callbacks. |
| 122 void OnTpmKeyCreated(const std::string& public_key); | 123 void OnTpmKeyCreated(const std::string& public_key); |
| 123 | 124 |
| 124 // Called when data signing requested in |SignUsingTpmKey| is done. | 125 // Called when data signing requested in |SignUsingTpmKey| is done. |
| 125 // It runs |callback| with the created |signature|. On error the callback will | 126 // It runs |callback| with the created |signature|. On error the callback will |
| 126 // be run with an empty string. | 127 // be run with an empty string. |
| 127 void OnDataSigned( | 128 void OnDataSigned( |
| 128 const base::Callback<void(const std::string&)>& callback, | 129 const base::Callback<void(const std::string&)>& callback, |
| 129 const std::string& signature); | 130 const std::string& signature); |
| 130 | 131 |
| 131 std::string user_id_; | 132 const AccountId account_id_; |
| 132 std::string username_hash_; | 133 std::string username_hash_; |
| 133 | 134 |
| 134 PrefService* local_state_; | 135 PrefService* local_state_; |
| 135 | 136 |
| 136 // The current TPM key creation state. If key creation is in progress, | 137 // The current TPM key creation state. If key creation is in progress, |
| 137 // callbacks for further |PrepareTpmKey| will be queued up and run when the | 138 // callbacks for further |PrepareTpmKey| will be queued up and run when the |
| 138 // key is created. All queued callbacks will be run with the same key value. | 139 // key is created. All queued callbacks will be run with the same key value. |
| 139 CreateTpmKeyState create_tpm_key_state_; | 140 CreateTpmKeyState create_tpm_key_state_; |
| 140 | 141 |
| 141 // Queued up |PrepareTpmKey| callbacks. | 142 // Queued up |PrepareTpmKey| callbacks. |
| 142 std::vector<base::Closure> prepare_tpm_key_callbacks_; | 143 std::vector<base::Closure> prepare_tpm_key_callbacks_; |
| 143 | 144 |
| 144 base::WeakPtrFactory<EasyUnlockTpmKeyManager> get_tpm_slot_weak_ptr_factory_; | 145 base::WeakPtrFactory<EasyUnlockTpmKeyManager> get_tpm_slot_weak_ptr_factory_; |
| 145 base::WeakPtrFactory<EasyUnlockTpmKeyManager> weak_ptr_factory_; | 146 base::WeakPtrFactory<EasyUnlockTpmKeyManager> weak_ptr_factory_; |
| 146 | 147 |
| 147 DISALLOW_COPY_AND_ASSIGN(EasyUnlockTpmKeyManager); | 148 DISALLOW_COPY_AND_ASSIGN(EasyUnlockTpmKeyManager); |
| 148 }; | 149 }; |
| 149 | 150 |
| 150 #endif // CHROME_BROWSER_CHROMEOS_LOGIN_EASY_UNLOCK_EASY_UNLOCK_TPM_KEY_MANAGER
_H_ | 151 #endif // CHROME_BROWSER_CHROMEOS_LOGIN_EASY_UNLOCK_EASY_UNLOCK_TPM_KEY_MANAGER
_H_ |
| OLD | NEW |