OLD | NEW |
| (Empty) |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include <cert.h> | |
6 #include <keyhi.h> | |
7 #include <nss.h> | |
8 | |
9 #include <memory> | |
10 | |
11 #include "base/base64url.h" | |
12 #include "base/values.h" | |
13 #include "crypto/nss_util.h" | |
14 #include "crypto/scoped_nss_types.h" | |
15 #include "net/cert/jwk_serializer.h" | |
16 | |
17 namespace net { | |
18 | |
19 namespace JwkSerializer { | |
20 | |
21 namespace { | |
22 | |
23 bool ConvertEcPrime256v1PublicKeyInfoToJwk( | |
24 CERTSubjectPublicKeyInfo* spki, | |
25 base::DictionaryValue* public_key_jwk) { | |
26 static const int kUncompressedEncodingType = 4; | |
27 static const int kPrime256v1PublicKeyLength = 64; | |
28 // The public key value is encoded as 0x04 + 64 bytes of public key. | |
29 // NSS gives the length as the bit length. | |
30 if (spki->subjectPublicKey.len != (kPrime256v1PublicKeyLength + 1) * 8 || | |
31 spki->subjectPublicKey.data[0] != kUncompressedEncodingType) | |
32 return false; | |
33 | |
34 public_key_jwk->SetString("kty", "EC"); | |
35 public_key_jwk->SetString("crv", "P-256"); | |
36 | |
37 base::StringPiece x( | |
38 reinterpret_cast<char*>(spki->subjectPublicKey.data + 1), | |
39 kPrime256v1PublicKeyLength / 2); | |
40 std::string x_b64; | |
41 base::Base64UrlEncode(x, base::Base64UrlEncodePolicy::OMIT_PADDING, &x_b64); | |
42 public_key_jwk->SetString("x", x_b64); | |
43 | |
44 base::StringPiece y( | |
45 reinterpret_cast<char*>(spki->subjectPublicKey.data + 1 + | |
46 kPrime256v1PublicKeyLength / 2), | |
47 kPrime256v1PublicKeyLength / 2); | |
48 std::string y_b64; | |
49 base::Base64UrlEncode(y, base::Base64UrlEncodePolicy::OMIT_PADDING, &y_b64); | |
50 public_key_jwk->SetString("y", y_b64); | |
51 return true; | |
52 } | |
53 | |
54 bool ConvertEcPublicKeyInfoToJwk( | |
55 CERTSubjectPublicKeyInfo* spki, | |
56 base::DictionaryValue* public_key_jwk) { | |
57 // 1.2.840.10045.3.1.7 | |
58 // (iso.member-body.us.ansi-x9-62.ellipticCurve.primeCurve.prime256v1) | |
59 // (This includes the DER-encoded type (OID) and length: parameters can be | |
60 // anything, so the DER type isn't implied, and NSS includes it.) | |
61 static const unsigned char kPrime256v1[] = { | |
62 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 | |
63 }; | |
64 if (spki->algorithm.parameters.len == sizeof(kPrime256v1) && | |
65 !memcmp(spki->algorithm.parameters.data, kPrime256v1, | |
66 sizeof(kPrime256v1))) { | |
67 return ConvertEcPrime256v1PublicKeyInfoToJwk(spki, public_key_jwk); | |
68 } | |
69 // TODO(juanlang): other curves | |
70 return false; | |
71 } | |
72 | |
73 typedef std::unique_ptr< | |
74 CERTSubjectPublicKeyInfo, | |
75 crypto::NSSDestroyer<CERTSubjectPublicKeyInfo, | |
76 SECKEY_DestroySubjectPublicKeyInfo>> | |
77 ScopedCERTSubjectPublicKeyInfo; | |
78 | |
79 } // namespace | |
80 | |
81 bool ConvertSpkiFromDerToJwk( | |
82 const base::StringPiece& spki_der, | |
83 base::DictionaryValue* public_key_jwk) { | |
84 public_key_jwk->Clear(); | |
85 | |
86 crypto::EnsureNSSInit(); | |
87 | |
88 if (!NSS_IsInitialized()) | |
89 return false; | |
90 | |
91 SECItem sec_item; | |
92 sec_item.data = const_cast<unsigned char*>( | |
93 reinterpret_cast<const unsigned char*>(spki_der.data())); | |
94 sec_item.len = spki_der.size(); | |
95 ScopedCERTSubjectPublicKeyInfo spki( | |
96 SECKEY_DecodeDERSubjectPublicKeyInfo(&sec_item)); | |
97 if (!spki) | |
98 return false; | |
99 | |
100 // 1.2.840.10045.2 | |
101 // (iso.member-body.us.ansi-x9-62.id-ecPublicKey) | |
102 // (This omits the ASN.1 encoding of the type (OID) and length: the fact that | |
103 // this is an OID is already clear, and NSS omits it here.) | |
104 static const unsigned char kIdEcPublicKey[] = { | |
105 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01 | |
106 }; | |
107 bool rv = false; | |
108 if (spki->algorithm.algorithm.len == sizeof(kIdEcPublicKey) && | |
109 !memcmp(spki->algorithm.algorithm.data, kIdEcPublicKey, | |
110 sizeof(kIdEcPublicKey))) { | |
111 rv = ConvertEcPublicKeyInfoToJwk(spki.get(), public_key_jwk); | |
112 } | |
113 // TODO(juanlang): other algorithms | |
114 return rv; | |
115 } | |
116 | |
117 } // namespace JwkSerializer | |
118 | |
119 } // namespace net | |
OLD | NEW |