Add public key and signature verification to browser-side API keys

content/browser/experiments/api_key_signature_verifier.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/experiments/api_key_signature_verifier.h"
+
+#include "base/base64.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_split.h"
+#include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/time/time.h"
+#include <openssl/curve25519.h>
+
+namespace content {
+
+namespace {
+
+// This is the default public key used for validating signatures.
+// TODO(iclelland): Move this to the embedder, and provide a mechanism to allow
+// for multiple signing keys. https://crbug.com/543220
+static const uint8_t kPublicKey[] = {
+    0x7c, 0xc4, 0xb8, 0x9a, 0x93, 0xba, 0x6e, 0xe2, 0xd0, 0xfd, 0x03,
+    0x1d, 0xfb, 0x32, 0x66, 0xc7, 0x3b, 0x72, 0xfd, 0x54, 0x3a, 0x07,
+    0x51, 0x14, 0x66, 0xaa, 0x02, 0x53, 0x4e, 0x33, 0xa1, 0x15,
+};
+static const size_t kPublicKeyLength = sizeof(kPublicKey);
+
+}  // namespace
+
+// static
+bool ApiKeySignatureVerifier::VerifySignature(const std::string& signature_text,
+                                              const std::string& data) {
+  return VerifySignature(signature_text, data, kPublicKey, kPublicKeyLength);
+}
+
+// static
+bool ApiKeySignatureVerifier::VerifySignature(const std::string& signature_text,
+                                              const std::string& data,
+                                              const uint8_t* public_key,
+                                              size_t public_key_length) {
+  std::string signature;
+  // signature is base64-encoded
+  if (!base::Base64Decode(signature_text, &signature)) {
+    return false;
+  }
+
+  // TODO: verify signature length is 64
+  int result = ED25519_verify(
+      reinterpret_cast<const uint8_t*>(data.data()), data.length(),
+      reinterpret_cast<const uint8_t*>(signature.data()), public_key);
+  return (result != 0);
+}
+
+}  // namespace content