Switch //net to the new SPKI and PKCS#8 APIs.

net/base/keygen_handler_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/keygen_handler.h"
 
 #include <Security/SecAsn1Coder.h>
 #include <Security/SecAsn1Templates.h>
 #include <Security/Security.h>
 
@@ skipping 130 matching lines @@
     }
     base::ScopedCFTypeRef<CFDataRef> scoped_key_data(key_data);
 
     // Create an ASN.1 encoder.
     err = SecAsn1CoderCreate(&coder);
     if (err) {
       crypto::LogCSSMError("SecAsn1CoderCreate", err);
       goto failure;
     }
 
+    // The DER encoding of a NULL.
+    static const uint8_t kNullDer[] = {0x05, 0x00};
+
     // Fill in and DER-encode the PublicKeyAndChallenge:
     SignedPublicKeyAndChallenge spkac;
     memset(&spkac, 0, sizeof(spkac));
     spkac.pkac.spki.algorithm.algorithm = CSSMOID_RSA;
+    spkac.pkac.spki.algorithm.parameters.Data = const_cast<uint8_t*>(kNullDer);
+    spkac.pkac.spki.algorithm.parameters.Length = sizeof(kNullDer);

[davidben, 2016/03/03 16:22:31]

(We could also reimplement this whole thing in CBB in code shared with
keygen_handler_openssl.cc, but the fix was easy so it didn't seem worth
bothering.)

     spkac.pkac.spki.subjectPublicKey.Length =
         CFDataGetLength(key_data) * 8;  // interpreted as a _bit_ count
     spkac.pkac.spki.subjectPublicKey.Data =
         const_cast<uint8_t*>(CFDataGetBytePtr(key_data));
     spkac.pkac.challenge_string.Length = challenge_.length();
     spkac.pkac.challenge_string.Data =
         reinterpret_cast<uint8_t*>(const_cast<char*>(challenge_.data()));
 
     CSSM_DATA encoded;
     err = SecAsn1EncodeItem(coder, &spkac.pkac,
                             kPublicKeyAndChallengeTemplate, &encoded);
     if (err) {
       crypto::LogCSSMError("SecAsn1EncodeItem", err);
       goto failure;
     }
 
     // Compute a signature of the result:
     err = SignData(encoded, private_key, &signature);
     if (err)
       goto failure;
     spkac.signature.Data = signature.Data;
     spkac.signature.Length = signature.Length * 8;  // a _bit_ count
     spkac.signature_algorithm.algorithm = CSSMOID_MD5WithRSA;
+    spkac.signature_algorithm.parameters.Data = const_cast<uint8_t*>(kNullDer);
+    spkac.signature_algorithm.parameters.Length = sizeof(kNullDer);
     // TODO(snej): MD5 is weak. Can we use SHA1 instead?
     // See <https://bugzilla.mozilla.org/show_bug.cgi?id=549460>
 
     // DER-encode the entire SignedPublicKeyAndChallenge:
     err = SecAsn1EncodeItem(coder, &spkac,
                             kSignedPublicKeyAndChallengeTemplate, &encoded);
     if (err) {
       crypto::LogCSSMError("SecAsn1EncodeItem", err);
       goto failure;
     }
@@ skipping 128 matching lines @@
     return err;
   }
   err = CSSM_SignData(cc_handle, &data, 1, CSSM_ALGID_NONE, signature);
   if (err)
     crypto::LogCSSMError("CSSM_SignData", err);
   CSSM_DeleteContext(cc_handle);
   return err;
 }
 
 }  // namespace net