| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "crypto/ec_private_key.h" | 5 #include "crypto/ec_private_key.h" |
| 6 | 6 |
| 7 extern "C" { | 7 extern "C" { |
| 8 // Work around NSS missing SEC_BEGIN_PROTOS in secmodt.h. This must come before | 8 // Work around NSS missing SEC_BEGIN_PROTOS in secmodt.h. This must come before |
| 9 // other NSS headers. | 9 // other NSS headers. |
| 10 #include <secmodt.h> | 10 #include <secmodt.h> |
| 11 } | 11 } |
| 12 | 12 |
| 13 #include <cryptohi.h> | 13 #include <cryptohi.h> |
| 14 #include <keyhi.h> | 14 #include <keyhi.h> |
| 15 #include <pk11pub.h> | 15 #include <pk11pub.h> |
| 16 #include <secmod.h> | 16 #include <secmod.h> |
| 17 #include <stddef.h> |
| 18 #include <stdint.h> |
| 17 | 19 |
| 18 #include "base/logging.h" | 20 #include "base/logging.h" |
| 19 #include "base/memory/scoped_ptr.h" | 21 #include "base/memory/scoped_ptr.h" |
| 20 #include "crypto/nss_util.h" | 22 #include "crypto/nss_util.h" |
| 21 #include "crypto/nss_util_internal.h" | 23 #include "crypto/nss_util_internal.h" |
| 22 #include "crypto/scoped_nss_types.h" | 24 #include "crypto/scoped_nss_types.h" |
| 23 #include "crypto/third_party/nss/chromium-nss.h" | 25 #include "crypto/third_party/nss/chromium-nss.h" |
| 24 | 26 |
| 25 namespace { | 27 namespace { |
| 26 | 28 |
| 27 // Copied from rsa_private_key_nss.cc. | 29 // Copied from rsa_private_key_nss.cc. |
| 28 static bool ReadAttribute(SECKEYPrivateKey* key, | 30 static bool ReadAttribute(SECKEYPrivateKey* key, |
| 29 CK_ATTRIBUTE_TYPE type, | 31 CK_ATTRIBUTE_TYPE type, |
| 30 std::vector<uint8>* output) { | 32 std::vector<uint8_t>* output) { |
| 31 SECItem item; | 33 SECItem item; |
| 32 SECStatus rv; | 34 SECStatus rv; |
| 33 rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, type, &item); | 35 rv = PK11_ReadRawAttribute(PK11_TypePrivKey, key, type, &item); |
| 34 if (rv != SECSuccess) { | 36 if (rv != SECSuccess) { |
| 35 DLOG(ERROR) << "PK11_ReadRawAttribute: " << PORT_GetError(); | 37 DLOG(ERROR) << "PK11_ReadRawAttribute: " << PORT_GetError(); |
| 36 return false; | 38 return false; |
| 37 } | 39 } |
| 38 | 40 |
| 39 output->assign(item.data, item.data + item.len); | 41 output->assign(item.data, item.data + item.len); |
| 40 SECITEM_FreeItem(&item, PR_FALSE); | 42 SECITEM_FreeItem(&item, PR_FALSE); |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 95 return nullptr; | 97 return nullptr; |
| 96 } | 98 } |
| 97 CHECK_EQ(ecKey, SECKEY_GetPublicKeyType(result->public_key_)); | 99 CHECK_EQ(ecKey, SECKEY_GetPublicKeyType(result->public_key_)); |
| 98 | 100 |
| 99 return result.release(); | 101 return result.release(); |
| 100 } | 102 } |
| 101 | 103 |
| 102 // static | 104 // static |
| 103 ECPrivateKey* ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( | 105 ECPrivateKey* ECPrivateKey::CreateFromEncryptedPrivateKeyInfo( |
| 104 const std::string& password, | 106 const std::string& password, |
| 105 const std::vector<uint8>& encrypted_private_key_info, | 107 const std::vector<uint8_t>& encrypted_private_key_info, |
| 106 const std::vector<uint8>& subject_public_key_info) { | 108 const std::vector<uint8_t>& subject_public_key_info) { |
| 107 EnsureNSSInit(); | 109 EnsureNSSInit(); |
| 108 | 110 |
| 109 ScopedPK11Slot slot(PK11_GetInternalSlot()); | 111 ScopedPK11Slot slot(PK11_GetInternalSlot()); |
| 110 if (!slot) | 112 if (!slot) |
| 111 return nullptr; | 113 return nullptr; |
| 112 | 114 |
| 113 scoped_ptr<ECPrivateKey> result(new ECPrivateKey); | 115 scoped_ptr<ECPrivateKey> result(new ECPrivateKey); |
| 114 | 116 |
| 115 SECItem encoded_spki = { | 117 SECItem encoded_spki = { |
| 116 siBuffer, | 118 siBuffer, |
| (...skipping 25 matching lines...) Expand all Loading... |
| 142 return result.release(); | 144 return result.release(); |
| 143 } | 145 } |
| 144 | 146 |
| 145 return nullptr; | 147 return nullptr; |
| 146 } | 148 } |
| 147 | 149 |
| 148 // static | 150 // static |
| 149 bool ECPrivateKey::ImportFromEncryptedPrivateKeyInfo( | 151 bool ECPrivateKey::ImportFromEncryptedPrivateKeyInfo( |
| 150 PK11SlotInfo* slot, | 152 PK11SlotInfo* slot, |
| 151 const std::string& password, | 153 const std::string& password, |
| 152 const uint8* encrypted_private_key_info, | 154 const uint8_t* encrypted_private_key_info, |
| 153 size_t encrypted_private_key_info_len, | 155 size_t encrypted_private_key_info_len, |
| 154 CERTSubjectPublicKeyInfo* decoded_spki, | 156 CERTSubjectPublicKeyInfo* decoded_spki, |
| 155 bool permanent, | 157 bool permanent, |
| 156 bool sensitive, | 158 bool sensitive, |
| 157 SECKEYPrivateKey** key, | 159 SECKEYPrivateKey** key, |
| 158 SECKEYPublicKey** public_key) { | 160 SECKEYPublicKey** public_key) { |
| 159 if (!slot) | 161 if (!slot) |
| 160 return false; | 162 return false; |
| 161 | 163 |
| 162 *public_key = SECKEY_ExtractPublicKey(decoded_spki); | 164 *public_key = SECKEY_ExtractPublicKey(decoded_spki); |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 230 return NULL; | 232 return NULL; |
| 231 } | 233 } |
| 232 if (public_key_) { | 234 if (public_key_) { |
| 233 copy->public_key_ = SECKEY_CopyPublicKey(public_key_); | 235 copy->public_key_ = SECKEY_CopyPublicKey(public_key_); |
| 234 if (!copy->public_key_) | 236 if (!copy->public_key_) |
| 235 return NULL; | 237 return NULL; |
| 236 } | 238 } |
| 237 return copy.release(); | 239 return copy.release(); |
| 238 } | 240 } |
| 239 | 241 |
| 240 bool ECPrivateKey::ExportEncryptedPrivateKey( | 242 bool ECPrivateKey::ExportEncryptedPrivateKey(const std::string& password, |
| 241 const std::string& password, | 243 int iterations, |
| 242 int iterations, | 244 std::vector<uint8_t>* output) { |
| 243 std::vector<uint8>* output) { | |
| 244 // We export as an EncryptedPrivateKeyInfo bundle instead of a plain PKCS #8 | 245 // We export as an EncryptedPrivateKeyInfo bundle instead of a plain PKCS #8 |
| 245 // PrivateKeyInfo because PK11_ImportDERPrivateKeyInfoAndReturnKey doesn't | 246 // PrivateKeyInfo because PK11_ImportDERPrivateKeyInfoAndReturnKey doesn't |
| 246 // support EC keys. | 247 // support EC keys. |
| 247 // https://bugzilla.mozilla.org/show_bug.cgi?id=327773 | 248 // https://bugzilla.mozilla.org/show_bug.cgi?id=327773 |
| 248 SECItem password_item = { | 249 SECItem password_item = { |
| 249 siBuffer, | 250 siBuffer, |
| 250 reinterpret_cast<unsigned char*>(const_cast<char*>(password.data())), | 251 reinterpret_cast<unsigned char*>(const_cast<char*>(password.data())), |
| 251 static_cast<unsigned>(password.size()) | 252 static_cast<unsigned>(password.size()) |
| 252 }; | 253 }; |
| 253 | 254 |
| (...skipping 21 matching lines...) Expand all Loading... |
| 275 if (!encoded_item) { | 276 if (!encoded_item) { |
| 276 DLOG(ERROR) << "SEC_ASN1EncodeItem: " << PORT_GetError(); | 277 DLOG(ERROR) << "SEC_ASN1EncodeItem: " << PORT_GetError(); |
| 277 return false; | 278 return false; |
| 278 } | 279 } |
| 279 | 280 |
| 280 output->assign(der_key.data, der_key.data + der_key.len); | 281 output->assign(der_key.data, der_key.data + der_key.len); |
| 281 | 282 |
| 282 return true; | 283 return true; |
| 283 } | 284 } |
| 284 | 285 |
| 285 bool ECPrivateKey::ExportPublicKey(std::vector<uint8>* output) { | 286 bool ECPrivateKey::ExportPublicKey(std::vector<uint8_t>* output) { |
| 286 ScopedSECItem der_pubkey( | 287 ScopedSECItem der_pubkey( |
| 287 SECKEY_EncodeDERSubjectPublicKeyInfo(public_key_)); | 288 SECKEY_EncodeDERSubjectPublicKeyInfo(public_key_)); |
| 288 if (!der_pubkey.get()) { | 289 if (!der_pubkey.get()) { |
| 289 return false; | 290 return false; |
| 290 } | 291 } |
| 291 | 292 |
| 292 output->assign(der_pubkey->data, der_pubkey->data + der_pubkey->len); | 293 output->assign(der_pubkey->data, der_pubkey->data + der_pubkey->len); |
| 293 return true; | 294 return true; |
| 294 } | 295 } |
| 295 | 296 |
| 296 bool ECPrivateKey::ExportRawPublicKey(std::string* output) { | 297 bool ECPrivateKey::ExportRawPublicKey(std::string* output) { |
| 297 // public_key_->u.ec.publicValue is an ANSI X9.62 public key which, for | 298 // public_key_->u.ec.publicValue is an ANSI X9.62 public key which, for |
| 298 // a P-256 key, is 0x04 (meaning uncompressed) followed by the x and y field | 299 // a P-256 key, is 0x04 (meaning uncompressed) followed by the x and y field |
| 299 // elements as 32-byte, big-endian numbers. | 300 // elements as 32-byte, big-endian numbers. |
| 300 static const unsigned int kExpectedKeyLength = 65; | 301 static const unsigned int kExpectedKeyLength = 65; |
| 301 | 302 |
| 302 CHECK_EQ(ecKey, SECKEY_GetPublicKeyType(public_key_)); | 303 CHECK_EQ(ecKey, SECKEY_GetPublicKeyType(public_key_)); |
| 303 const unsigned char* const data = public_key_->u.ec.publicValue.data; | 304 const unsigned char* const data = public_key_->u.ec.publicValue.data; |
| 304 const unsigned int len = public_key_->u.ec.publicValue.len; | 305 const unsigned int len = public_key_->u.ec.publicValue.len; |
| 305 if (len != kExpectedKeyLength || data[0] != 0x04) | 306 if (len != kExpectedKeyLength || data[0] != 0x04) |
| 306 return false; | 307 return false; |
| 307 | 308 |
| 308 output->assign(reinterpret_cast<const char*>(data + 1), | 309 output->assign(reinterpret_cast<const char*>(data + 1), |
| 309 kExpectedKeyLength - 1); | 310 kExpectedKeyLength - 1); |
| 310 return true; | 311 return true; |
| 311 } | 312 } |
| 312 | 313 |
| 313 bool ECPrivateKey::ExportValue(std::vector<uint8>* output) { | 314 bool ECPrivateKey::ExportValue(std::vector<uint8_t>* output) { |
| 314 return ReadAttribute(key_, CKA_VALUE, output); | 315 return ReadAttribute(key_, CKA_VALUE, output); |
| 315 } | 316 } |
| 316 | 317 |
| 317 bool ECPrivateKey::ExportECParams(std::vector<uint8>* output) { | 318 bool ECPrivateKey::ExportECParams(std::vector<uint8_t>* output) { |
| 318 return ReadAttribute(key_, CKA_EC_PARAMS, output); | 319 return ReadAttribute(key_, CKA_EC_PARAMS, output); |
| 319 } | 320 } |
| 320 | 321 |
| 321 ECPrivateKey::ECPrivateKey() : key_(NULL), public_key_(NULL) {} | 322 ECPrivateKey::ECPrivateKey() : key_(NULL), public_key_(NULL) {} |
| 322 | 323 |
| 323 } // namespace crypto | 324 } // namespace crypto |
| OLD | NEW |