[webcrypto] Add raw symmetric key RSAES-PKCS1-v1_5 wrap/unwrap for NSS.

content/child/webcrypto/shared_crypto_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/webcrypto/shared_crypto.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 344 matching lines @@
 blink::WebCryptoAlgorithm CreateAesKwKeyGenAlgorithm(
     unsigned short key_length_bits) {
   return CreateAesKeyGenAlgorithm(blink::WebCryptoAlgorithmIdAesKw,
                                   key_length_bits);
 }
 
 // The following key pair is comprised of the SPKI (public key) and PKCS#8
 // (private key) representations of the key pair provided in Example 1 of the
 // NIST test vectors at
 // ftp://ftp.rsa.com/pub/rsalabs/tmp/pkcs1v15sign-vectors.txt
-const unsigned int kModulusLength = 1024;
+const unsigned int kModulusLengthBits = 1024;
 const char* const kPublicKeySpkiDerHex =
     "30819f300d06092a864886f70d010101050003818d0030818902818100a5"
     "6e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad9"
     "91d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfc"
     "e0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e"
     "6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cf"
     "fb2249bd9a21370203010001";
 const char* const kPrivateKeyPkcs8DerHex =
     "30820275020100300d06092a864886f70d01010105000482025f3082025b"
     "02010002818100a56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52"
@@ skipping 916 matching lines @@
       ImportKey(blink::WebCryptoKeyFormatSpki,
                 CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
                 CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5),
                 true,
                 blink::WebCryptoKeyUsageEncrypt,
                 &key));
   EXPECT_TRUE(key.handle());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, key.type());
   EXPECT_TRUE(key.extractable());
   EXPECT_EQ(blink::WebCryptoKeyUsageEncrypt, key.usages());
-  EXPECT_EQ(kModulusLength, key.algorithm().rsaParams()->modulusLengthBits());
+  EXPECT_EQ(kModulusLengthBits,
+            key.algorithm().rsaParams()->modulusLengthBits());
   ExpectCryptoDataMatchesHex(
       "010001", CryptoData(key.algorithm().rsaParams()->publicExponent()));
 
   // Failing case: Empty SPKI data
   EXPECT_STATUS(Status::ErrorImportEmptyKeyData(),
                 ImportKey(blink::WebCryptoKeyFormatSpki,
                           CryptoData(std::vector<uint8>()),
                           blink::WebCryptoAlgorithm::createNull(),
                           true,
                           blink::WebCryptoKeyUsageEncrypt,
@@ skipping 64 matching lines @@
                                      blink::WebCryptoAlgorithmIdSha1),
       true,
       blink::WebCryptoKeyUsageSign,
       &key));
   EXPECT_TRUE(key.handle());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, key.type());
   EXPECT_TRUE(key.extractable());
   EXPECT_EQ(blink::WebCryptoKeyUsageSign, key.usages());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
             key.algorithm().rsaHashedParams()->hash().id());
-  EXPECT_EQ(kModulusLength,
+  EXPECT_EQ(kModulusLengthBits,
             key.algorithm().rsaHashedParams()->modulusLengthBits());
   ExpectCryptoDataMatchesHex(
       "010001",
       CryptoData(key.algorithm().rsaHashedParams()->publicExponent()));
 
   // Failing case: Empty PKCS#8 data
   EXPECT_STATUS(Status::ErrorImportEmptyKeyData(),
                 ImportKey(blink::WebCryptoKeyFormatPkcs8,
                           CryptoData(std::vector<uint8>()),
                           blink::WebCryptoAlgorithm::createNull(),
@@ skipping 191 matching lines @@
       HexStringToBytes(kPublicKeySpkiDerHex),
       HexStringToBytes(kPrivateKeyPkcs8DerHex),
       algorithm,
       false,
       blink::WebCryptoKeyUsageEncrypt | blink::WebCryptoKeyUsageDecrypt,
       &public_key,
       &private_key);
 
   // Make a maximum-length data message. RSAES can operate on messages up to
   // length of k - 11 bytes, where k is the octet length of the RSA modulus.
-  const unsigned int kMaxMsgSizeBytes = kModulusLength / 8 - 11;
+  const unsigned int kMaxMsgSizeBytes = kModulusLengthBits / 8 - 11;
   // There are two hex chars for each byte.
   const unsigned int kMsgHexSize = kMaxMsgSizeBytes * 2;
   char max_data_hex[kMsgHexSize + 1];
   std::fill(&max_data_hex[0], &max_data_hex[0] + kMsgHexSize, 'a');
   max_data_hex[kMsgHexSize] = '\0';
 
   // Verify encrypt / decrypt round trip on a few messages. Note that RSA
   // encryption does not support empty input.
   algorithm = CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5);
   const char* const kTestDataHex[] = {"ff", "0102030405060708090a0b0c0d0e0f",
                                       max_data_hex};
   blink::WebArrayBuffer encrypted_data;
   blink::WebArrayBuffer decrypted_data;
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(kTestDataHex); ++i) {
     SCOPED_TRACE(i);
     EXPECT_STATUS_SUCCESS(Encrypt(algorithm,
                                   public_key,
                                   CryptoData(HexStringToBytes(kTestDataHex[i])),
                                   &encrypted_data));
-    EXPECT_EQ(kModulusLength / 8, encrypted_data.byteLength());
+    EXPECT_EQ(kModulusLengthBits / 8, encrypted_data.byteLength());
     ASSERT_STATUS_SUCCESS(Decrypt(
         algorithm, private_key, CryptoData(encrypted_data), &decrypted_data));
     ExpectArrayBufferMatchesHex(kTestDataHex[i], decrypted_data);
   }
 }
 
 TEST_F(SharedCryptoTest, MAYBE(RsaEsKnownAnswer)) {
   scoped_ptr<base::Value> json;
   ASSERT_TRUE(ReadJsonTestFile("rsa_es.json", &json));
   base::DictionaryValue* test = NULL;
@@ skipping 77 matching lines @@
 
   // Fail encrypt with empty message.
   EXPECT_STATUS(Status::Error(),
                 Encrypt(algorithm,
                         public_key,
                         CryptoData(std::vector<uint8>()),
                         &encrypted_data));
 
   // Fail encrypt with message too large. RSAES can operate on messages up to
   // length of k - 11 bytes, where k is the octet length of the RSA modulus.
-  const unsigned int kMaxMsgSizeBytes = kModulusLength / 8 - 11;
+  const unsigned int kMaxMsgSizeBytes = kModulusLengthBits / 8 - 11;
   EXPECT_STATUS(
       Status::ErrorDataTooLarge(),
       Encrypt(algorithm,
               public_key,
               CryptoData(std::vector<uint8>(kMaxMsgSizeBytes + 1, '0')),
               &encrypted_data));
 
   // Generate encrypted data.
   EXPECT_STATUS(
       Status::Success(),
@@ skipping 75 matching lines @@
   corrupt_sig[corrupt_sig.size() / 2] ^= 0x1;
   EXPECT_STATUS_SUCCESS(VerifySignature(algorithm,
                                         public_key,
                                         CryptoData(corrupt_sig),
                                         CryptoData(data),
                                         &signature_match));
   EXPECT_FALSE(signature_match);
 
   // Ensure signatures that are greater than the modulus size fail.
   const unsigned int long_message_size_bytes = 1024;
-  DCHECK_GT(long_message_size_bytes, kModulusLength / 8);
+  DCHECK_GT(long_message_size_bytes, kModulusLengthBits / 8);
   const unsigned char kLongSignature[long_message_size_bytes] = {0};
   EXPECT_STATUS_SUCCESS(
       VerifySignature(algorithm,
                       public_key,
                       CryptoData(kLongSignature, sizeof(kLongSignature)),
                       CryptoData(data),
                       &signature_match));
   EXPECT_FALSE(signature_match);
 
   // Ensure that verifying using a private key, rather than a public key, fails.
@@ skipping 475 matching lines @@
                                         test_iv,
                                         test_additional_data,
                                         wrong_tag_size_bits,
                                         test_cipher_text,
                                         test_authentication_tag,
                                         &plain_text));
     }
   }
 }
 
+TEST_F(SharedCryptoTest, MAYBE(RsaEsRawSymkeyWrapUnwrapKnownAnswer)) {
+  scoped_ptr<base::Value> json;
+  ASSERT_TRUE(ReadJsonTestFile("rsa_es.json", &json));
+  base::DictionaryValue* test = NULL;
+  ASSERT_TRUE(json->GetAsDictionary(&test));
+  const std::vector<uint8> rsa_spki_der =
+      GetBytesFromHexString(test, "rsa_spki_der");
+  const std::vector<uint8> rsa_pkcs8_der =
+      GetBytesFromHexString(test, "rsa_pkcs8_der");
+  const std::vector<uint8> ciphertext =
+      GetBytesFromHexString(test, "ciphertext");
+  const std::vector<uint8> cleartext = GetBytesFromHexString(test, "cleartext");
+  blink::WebCryptoAlgorithm key_algorithm =
+      CreateHmacImportAlgorithm(blink::WebCryptoAlgorithmIdSha256);
+
+  // Import the RSA key pair.
+  blink::WebCryptoAlgorithm algorithm =
+      CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5);
+  blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
+  blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
+  ImportRsaKeyPair(
+      rsa_spki_der,
+      rsa_pkcs8_der,
+      algorithm,
+      false,
+      blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey,
+      &public_key,
+      &private_key);
+
+  // Import the symmetric key.
+  blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
+  ASSERT_STATUS_SUCCESS(ImportKey(blink::WebCryptoKeyFormatRaw,
+                                  CryptoData(cleartext),
+                                  key_algorithm,
+                                  true,
+                                  blink::WebCryptoKeyUsageSign,
+                                  &key));
+
+  // Wrap the symmetric key with raw format.
+  blink::WebArrayBuffer wrapped_key;
+  ASSERT_STATUS_SUCCESS(WrapKey(
+      blink::WebCryptoKeyFormatRaw, public_key, key, algorithm, &wrapped_key));
+
+  // Unwrap the wrapped key.
+  blink::WebCryptoKey unwrapped_key = blink::WebCryptoKey::createNull();
+  ASSERT_STATUS_SUCCESS(UnwrapKey(blink::WebCryptoKeyFormatRaw,
+                                  CryptoData(wrapped_key),
+                                  private_key,
+                                  algorithm,
+                                  key_algorithm,
+                                  true,
+                                  blink::WebCryptoKeyUsageSign,
+                                  &unwrapped_key));
+  EXPECT_FALSE(key.isNull());
+  EXPECT_TRUE(key.handle());
+  EXPECT_EQ(blink::WebCryptoKeyTypeSecret, key.type());
+  EXPECT_EQ(key_algorithm.id(), key.algorithm().id());
+  EXPECT_EQ(true, key.extractable());
+  EXPECT_EQ(blink::WebCryptoKeyUsageSign, key.usages());
+
+  // Export the new key and compare its raw bytes with the original known data.
+  blink::WebArrayBuffer raw_key;
+  EXPECT_STATUS_SUCCESS(
+      ExportKey(blink::WebCryptoKeyFormatRaw, unwrapped_key, &raw_key));
+  EXPECT_TRUE(ArrayBufferMatches(cleartext, raw_key));
+
+  // Unwrap the known wrapped key and compare to the known cleartext.
+  ASSERT_STATUS_SUCCESS(UnwrapKey(blink::WebCryptoKeyFormatRaw,
+                                  CryptoData(ciphertext),
+                                  private_key,
+                                  algorithm,
+                                  key_algorithm,
+                                  true,
+                                  blink::WebCryptoKeyUsageSign,
+                                  &unwrapped_key));
+  EXPECT_STATUS_SUCCESS(
+      ExportKey(blink::WebCryptoKeyFormatRaw, unwrapped_key, &raw_key));
+  EXPECT_TRUE(ArrayBufferMatches(cleartext, raw_key));
+}
+
+TEST_F(SharedCryptoTest, MAYBE(RsaEsRawSymkeyWrapUnwrapErrors)) {
+  const std::vector<uint8> data(64, 0);
+  blink::WebCryptoAlgorithm key_algorithm =
+      CreateHmacImportAlgorithm(blink::WebCryptoAlgorithmIdSha256);
+
+  // Import the RSA key pair.
+  blink::WebCryptoAlgorithm wrapping_algorithm =
+      CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5);
+  blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
+  blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
+  ImportRsaKeyPair(
+      HexStringToBytes(kPublicKeySpkiDerHex),
+      HexStringToBytes(kPrivateKeyPkcs8DerHex),
+      wrapping_algorithm,
+      false,
+      blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey,
+      &public_key,
+      &private_key);
+
+  // Import the symmetric key.
+  blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
+  ASSERT_STATUS_SUCCESS(ImportKey(blink::WebCryptoKeyFormatRaw,
+                                  CryptoData(data),
+                                  key_algorithm,
+                                  true,
+                                  blink::WebCryptoKeyUsageSign,
+                                  &key));
+
+  // Wrapping with a private key should fail.
+  blink::WebArrayBuffer wrapped_key;
+  EXPECT_STATUS(Status::ErrorUnexpectedKeyType(),
+                WrapKey(blink::WebCryptoKeyFormatRaw,
+                        private_key,
+                        key,
+                        wrapping_algorithm,
+                        &wrapped_key));
+
+  // Wrapping a key whose raw keying material is too large for the wrapping key
+  // should fail.
+  // RSAES can encrypt data up to length of k - 11 bytes, where k is the octet
+  // length of the RSA modulus, and can decrypt data up to length k. Fabricate a
+  // big piece of data here that fails both of these criteria, so it can be used
+  // for both wrap and unwrap negative tests below.
+  const std::vector<uint8> big_data(kModulusLengthBits / 8 + 1, 0);
+  blink::WebCryptoKey big_key = blink::WebCryptoKey::createNull();
+  ASSERT_STATUS_SUCCESS(ImportKey(blink::WebCryptoKeyFormatRaw,
+                                  CryptoData(big_data),
+                                  key_algorithm,
+                                  true,
+                                  blink::WebCryptoKeyUsageSign,
+                                  &big_key));
+  EXPECT_STATUS(Status::ErrorDataTooLarge(),
+                WrapKey(blink::WebCryptoKeyFormatRaw,
+                        public_key,
+                        big_key,
+                        wrapping_algorithm,
+                        &wrapped_key));
+
+  // Unwrapping with a public key should fail.
+  blink::WebCryptoKey unwrapped_key = blink::WebCryptoKey::createNull();
+  EXPECT_STATUS(Status::ErrorUnexpectedKeyType(),
+                UnwrapKey(blink::WebCryptoKeyFormatRaw,
+                          CryptoData(data),
+                          public_key,
+                          wrapping_algorithm,
+                          key_algorithm,
+                          true,
+                          blink::WebCryptoKeyUsageSign,
+                          &unwrapped_key));
+
+  // Unwrapping empty data should fail.
+  const std::vector<uint8> emtpy_data;
+  EXPECT_STATUS(Status::ErrorDataTooSmall(),
+                UnwrapKey(blink::WebCryptoKeyFormatRaw,
+                          CryptoData(emtpy_data),
+                          private_key,
+                          wrapping_algorithm,
+                          key_algorithm,
+                          true,
+                          blink::WebCryptoKeyUsageSign,
+                          &unwrapped_key));
+
+  // Unwapping data too large for the wrapping key should fail.
+  EXPECT_STATUS(Status::ErrorDataTooLarge(),
+                UnwrapKey(blink::WebCryptoKeyFormatRaw,
+                          CryptoData(big_data),
+                          private_key,
+                          wrapping_algorithm,
+                          key_algorithm,
+                          true,
+                          blink::WebCryptoKeyUsageSign,
+                          &unwrapped_key));
+}
+
 }  // namespace webcrypto
 
 }  // namespace content