OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/child/webcrypto/shared_crypto.h" | 5 #include "content/child/webcrypto/shared_crypto.h" |
6 | 6 |
7 #include <algorithm> | 7 #include <algorithm> |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
(...skipping 2610 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2621 EXPECT_EQ(true, unwrapped_key.extractable()); | 2621 EXPECT_EQ(true, unwrapped_key.extractable()); |
2622 EXPECT_EQ(blink::WebCryptoKeyUsageVerify, unwrapped_key.usages()); | 2622 EXPECT_EQ(blink::WebCryptoKeyUsageVerify, unwrapped_key.usages()); |
2623 | 2623 |
2624 // Export the new key's raw data and compare to the known original. | 2624 // Export the new key's raw data and compare to the known original. |
2625 blink::WebArrayBuffer raw_key; | 2625 blink::WebArrayBuffer raw_key; |
2626 EXPECT_STATUS_SUCCESS( | 2626 EXPECT_STATUS_SUCCESS( |
2627 ExportKey(blink::WebCryptoKeyFormatRaw, unwrapped_key, &raw_key)); | 2627 ExportKey(blink::WebCryptoKeyFormatRaw, unwrapped_key, &raw_key)); |
2628 EXPECT_TRUE(ArrayBufferMatches(key_data, raw_key)); | 2628 EXPECT_TRUE(ArrayBufferMatches(key_data, raw_key)); |
2629 } | 2629 } |
2630 | 2630 |
2631 TEST_F(SharedCryptoTest, MAYBE(AesKwJwkSymkeyUnwrapErrors)) { | |
2632 // Unwrap data that can be successfully decrypted, but contains an error in | |
2633 // the plaintext JWK, and ensure that a generic error is returned instead of | |
2634 // some other more specific error, to show that information about the | |
2635 // plaintext JWK inside the encrypted data is not leaked. | |
2636 // Specifically, wrapped_key_data below is an AES-KW encrypted version of the | |
2637 // plaintext JWK | |
2638 // { | |
2639 // "alg":"HS256", | |
2640 // "ext":true, | |
2641 // "k":"AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8", | |
2642 // "key_ops":["verify"], | |
2643 // "kty":"foo" <-- Invalid kty value | |
2644 // } | |
2645 // Recall that unwrapKey = decrypt followed by import. The wrapped_key_data | |
2646 // will decrypt successfully, but the import step will fail because of the bad | |
2647 // kty value. But unlike the standalone ImportKey() method which returns | |
2648 // ErrorJwkUnrecognizedKty in this case, the error returned must be just | |
2649 // Error::Status(). | |
2650 // Note that it is sufficient to consider just one JWK import failure mode | |
2651 // here; others are validated in the ImportJwkFailures Test. | |
2652 const std::vector<uint8> wrapped_key_data = HexStringToBytes( | |
2653 "8d5ad45f5be6195a7a5944f0cf521bbae255daea140d4712985bb63ca1de1a318fbc49ff" | |
2654 "307bd91bfafd7e9ea2057a2ddabb42ba94e319465972d165e5cc42785ad5cfa36159d5cc" | |
2655 "50084133eae85a22bf8f7cb35f3c07b7c06480dec745d9ce4d4bfce45a6cbc2d39263ab7" | |
2656 "073fc346724841f872f7148d"); | |
2657 const std::vector<uint8> wrapping_key_data = | |
2658 HexStringToBytes("000102030405060708090A0B0C0D0E0F"); | |
2659 const blink::WebCryptoAlgorithm wrapping_algorithm = | |
2660 webcrypto::CreateAlgorithm(blink::WebCryptoAlgorithmIdAesKw); | |
2661 | |
2662 // Import the wrapping key. | |
2663 blink::WebCryptoKey wrapping_key = ImportSecretKeyFromRaw( | |
2664 wrapping_key_data, wrapping_algorithm, blink::WebCryptoKeyUsageUnwrapKey); | |
2665 | |
2666 // Unwrap and ensure a generic error is received. | |
2667 blink::WebCryptoKey unwrapped_key = blink::WebCryptoKey::createNull(); | |
2668 EXPECT_STATUS(Status::Error(), | |
2669 UnwrapKey(blink::WebCryptoKeyFormatJwk, | |
2670 CryptoData(wrapped_key_data), | |
2671 wrapping_key, | |
2672 wrapping_algorithm, | |
2673 blink::WebCryptoAlgorithm::createNull(), | |
2674 true, | |
2675 blink::WebCryptoKeyUsageVerify, | |
2676 &unwrapped_key)); | |
2677 | |
2678 // FIXME(padolph): The check above can fail if the AES-KW decryption step | |
2679 // failed, which masks the test result desired here. For now we have to just | |
2680 // trust the result because I say so. | |
2681 // Once RSA-ES unwrapping is implemented, port this test to use that wrapping | |
2682 // algorithm instead of AES-KW. Unlike AES-KW, RSA-ES supports both the | |
2683 // decrypt and unwrapKey usages, so we can validate successful decryption of | |
2684 // wrapped_key_data prior to seeing the unwrapKey (import) failure. | |
2685 } | |
2686 | |
2687 // TODO(eroman): | 2631 // TODO(eroman): |
2688 // * Test decryption when the tag length exceeds input size | 2632 // * Test decryption when the tag length exceeds input size |
2689 // * Test decryption with empty input | 2633 // * Test decryption with empty input |
2690 // * Test decryption with tag length of 0. | 2634 // * Test decryption with tag length of 0. |
2691 TEST_F(SharedCryptoTest, MAYBE(AesGcmSampleSets)) { | 2635 TEST_F(SharedCryptoTest, MAYBE(AesGcmSampleSets)) { |
2692 // Some Linux test runners may not have a new enough version of NSS. | 2636 // Some Linux test runners may not have a new enough version of NSS. |
2693 if (!SupportsAesGcm()) { | 2637 if (!SupportsAesGcm()) { |
2694 LOG(WARNING) << "AES GCM not supported, skipping tests"; | 2638 LOG(WARNING) << "AES GCM not supported, skipping tests"; |
2695 return; | 2639 return; |
2696 } | 2640 } |
(...skipping 274 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2971 UnwrapKey(blink::WebCryptoKeyFormatRaw, | 2915 UnwrapKey(blink::WebCryptoKeyFormatRaw, |
2972 CryptoData(big_data), | 2916 CryptoData(big_data), |
2973 private_key, | 2917 private_key, |
2974 wrapping_algorithm, | 2918 wrapping_algorithm, |
2975 key_algorithm, | 2919 key_algorithm, |
2976 true, | 2920 true, |
2977 blink::WebCryptoKeyUsageSign, | 2921 blink::WebCryptoKeyUsageSign, |
2978 &unwrapped_key)); | 2922 &unwrapped_key)); |
2979 } | 2923 } |
2980 | 2924 |
| 2925 TEST_F(SharedCryptoTest, MAYBE(RsaEsJwkSymkeyUnwrapKnownAnswer)) { |
| 2926 // The following data lists a known 128-bit AES-CBC key, then a JWK |
| 2927 // representation of this key that was encrypted ("wrapped") using |
| 2928 // RSAES-PKCS1-v1_5 and kPublicKeySpkiDerHex as the wrapping key. |
| 2929 // For reference, the intermediate clear JWK is |
| 2930 // {"alg":"A128CBC","ext":true,"k":<b64url>,"key_ops":["encrypt"],"kty":"oct"} |
| 2931 const std::vector<uint8> key_data = |
| 2932 HexStringToBytes("8f56a26e7e8b77dca15ed54339724bf5"); |
| 2933 const std::vector<uint8> wrapped_key_data = HexStringToBytes( |
| 2934 "9debcabd9c731d6a779622dbef38635419c409b3077af67b3cf0601b2da7054f2ec26156" |
| 2935 "06bb764e4986f45dd09ce660432a7abbac48b5249924f12dea52275b6d67d8b8a2f63525" |
| 2936 "fbbf67d61244c1afa9e30857b87b7a48cdc0b3196dc1477738cbf9e42ea65d5e0edc3b05" |
| 2937 "afafadc7d7400e26a51270d251040d51ce46cecc"); |
| 2938 const blink::WebCryptoAlgorithm wrapping_algorithm = |
| 2939 webcrypto::CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5); |
| 2940 |
| 2941 // Import the private wrapping key. |
| 2942 blink::WebCryptoKey private_wrapping_key = blink::WebCryptoKey::createNull(); |
| 2943 ASSERT_STATUS_SUCCESS(ImportKey( |
| 2944 blink::WebCryptoKeyFormatPkcs8, |
| 2945 CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)), |
| 2946 wrapping_algorithm, |
| 2947 false, |
| 2948 blink::WebCryptoKeyUsageDecrypt | blink::WebCryptoKeyUsageUnwrapKey, |
| 2949 &private_wrapping_key)); |
| 2950 |
| 2951 // Unwrap the key. |
| 2952 blink::WebCryptoKey unwrapped_key = blink::WebCryptoKey::createNull(); |
| 2953 EXPECT_STATUS_SUCCESS( |
| 2954 UnwrapKey(blink::WebCryptoKeyFormatJwk, |
| 2955 CryptoData(wrapped_key_data), |
| 2956 private_wrapping_key, |
| 2957 wrapping_algorithm, |
| 2958 CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc), |
| 2959 true, |
| 2960 blink::WebCryptoKeyUsageEncrypt, |
| 2961 &unwrapped_key)); |
| 2962 EXPECT_FALSE(unwrapped_key.isNull()); |
| 2963 EXPECT_TRUE(unwrapped_key.handle()); |
| 2964 EXPECT_EQ(blink::WebCryptoKeyTypeSecret, unwrapped_key.type()); |
| 2965 EXPECT_EQ(blink::WebCryptoAlgorithmIdAesCbc, unwrapped_key.algorithm().id()); |
| 2966 EXPECT_EQ(true, unwrapped_key.extractable()); |
| 2967 EXPECT_EQ(blink::WebCryptoKeyUsageEncrypt, unwrapped_key.usages()); |
| 2968 |
| 2969 // Export the unwrapped key and compare to the original. |
| 2970 blink::WebArrayBuffer raw_key; |
| 2971 EXPECT_STATUS_SUCCESS( |
| 2972 ExportKey(blink::WebCryptoKeyFormatRaw, unwrapped_key, &raw_key)); |
| 2973 EXPECT_TRUE(ArrayBufferMatches(key_data, raw_key)); |
| 2974 } |
| 2975 |
| 2976 TEST_F(SharedCryptoTest, MAYBE(RsaEsJwkSymkeyWrapUnwrapRoundTrip)) { |
| 2977 // Generate the symkey to be wrapped (256-bit AES-CBC key). |
| 2978 const blink::WebCryptoAlgorithm gen_algorithm = |
| 2979 CreateAesCbcKeyGenAlgorithm(256); |
| 2980 blink::WebCryptoKey key_to_wrap = blink::WebCryptoKey::createNull(); |
| 2981 ASSERT_STATUS_SUCCESS(GenerateSecretKey( |
| 2982 gen_algorithm, true, blink::WebCryptoKeyUsageEncrypt, &key_to_wrap)); |
| 2983 |
| 2984 // Import the wrapping key pair. |
| 2985 const blink::WebCryptoAlgorithm wrapping_algorithm = |
| 2986 CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5); |
| 2987 blink::WebCryptoKey public_wrapping_key = blink::WebCryptoKey::createNull(); |
| 2988 blink::WebCryptoKey private_wrapping_key = blink::WebCryptoKey::createNull(); |
| 2989 ImportRsaKeyPair( |
| 2990 HexStringToBytes(kPublicKeySpkiDerHex), |
| 2991 HexStringToBytes(kPrivateKeyPkcs8DerHex), |
| 2992 wrapping_algorithm, |
| 2993 false, |
| 2994 blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey, |
| 2995 &public_wrapping_key, |
| 2996 &private_wrapping_key); |
| 2997 |
| 2998 // Wrap the symkey in JWK format, using the public wrapping key. |
| 2999 blink::WebArrayBuffer wrapped_data; |
| 3000 ASSERT_STATUS_SUCCESS(WrapKey(blink::WebCryptoKeyFormatJwk, |
| 3001 public_wrapping_key, |
| 3002 key_to_wrap, |
| 3003 wrapping_algorithm, |
| 3004 &wrapped_data)); |
| 3005 |
| 3006 // Unwrap the key using the private wrapping key. |
| 3007 blink::WebCryptoKey unwrapped_key = blink::WebCryptoKey::createNull(); |
| 3008 ASSERT_STATUS_SUCCESS( |
| 3009 UnwrapKey(blink::WebCryptoKeyFormatJwk, |
| 3010 CryptoData(wrapped_data), |
| 3011 private_wrapping_key, |
| 3012 wrapping_algorithm, |
| 3013 CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc), |
| 3014 true, |
| 3015 blink::WebCryptoKeyUsageEncrypt, |
| 3016 &unwrapped_key)); |
| 3017 |
| 3018 // Export the original symkey and the unwrapped key and compare. |
| 3019 blink::WebArrayBuffer raw_key1, raw_key2; |
| 3020 EXPECT_STATUS_SUCCESS( |
| 3021 ExportKey(blink::WebCryptoKeyFormatRaw, key_to_wrap, &raw_key1)); |
| 3022 EXPECT_STATUS_SUCCESS( |
| 3023 ExportKey(blink::WebCryptoKeyFormatRaw, unwrapped_key, &raw_key2)); |
| 3024 EXPECT_TRUE(ArrayBuffersEqual(raw_key1, raw_key2)); |
| 3025 } |
| 3026 |
| 3027 TEST_F(SharedCryptoTest, MAYBE(RsaEsJwkSymkeyWrapUnwrapErrors)) { |
| 3028 // Unwrap JWK-formatted data that can be successfully decrypted, but contains |
| 3029 // an error in the plaintext JWK so it cannot be subsequently imported, and |
| 3030 // ensure that a generic error is returned instead of some other more specific |
| 3031 // error. This shows that information about the plaintext JWK inside the |
| 3032 // encrypted data is not leaked. |
| 3033 // Note that it is sufficient to consider just one JWK import failure mode |
| 3034 // here; others are validated in the ImportJwkFailures Test. The specific |
| 3035 // error in the cleartext data below is kty = "foo", which is an invalid kty |
| 3036 // value. |
| 3037 const std::string cleartext = |
| 3038 "{\"alg\":\"A128CBC\",\"ext\":true,\"k\":" |
| 3039 "\"j1aibn6Ld9yhXtVDOXJL9Q\",\"key_ops\":[\"encrypt\"],\"kty\":\"foo\"}"; |
| 3040 // ciphertext is the cleartext above encrypted with kPublicKeySpkiDerHex, and |
| 3041 // can be decrypted with kPrivateKeyPkcs8DerHex |
| 3042 const std::vector<uint8> ciphertext = HexStringToBytes( |
| 3043 "93bc7bb2ca8502fcf3224e19b12ba455ac32d01695611022c76d3dbdd797c044de047d44" |
| 3044 "6c5ed5de5b8f79147ffe1df8da9c894b58881b238d39bd24cecd5c1a98a7c0b07354aee6" |
| 3045 "24791b2d549b7ecf1219c49513a1bcbb0fac5c6b59d350b564c44dc3678dadf84b4ea3d1" |
| 3046 "32e576e88f8d4a2d27c173e033a97bbda7e47bb9"); |
| 3047 |
| 3048 // Import the private decryption key. |
| 3049 const blink::WebCryptoAlgorithm algorithm = |
| 3050 CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaEsPkcs1v1_5); |
| 3051 blink::WebCryptoKey private_decryption_key = |
| 3052 blink::WebCryptoKey::createNull(); |
| 3053 ASSERT_STATUS_SUCCESS( |
| 3054 ImportKey(blink::WebCryptoKeyFormatPkcs8, |
| 3055 CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)), |
| 3056 algorithm, |
| 3057 false, |
| 3058 blink::WebCryptoKeyUsageDecrypt, |
| 3059 &private_decryption_key)); |
| 3060 |
| 3061 // Decrypt the ciphertext and validate the result, to prove that decryption is |
| 3062 // successful. |
| 3063 blink::WebArrayBuffer decrypted_data; |
| 3064 ASSERT_STATUS_SUCCESS(Decrypt(algorithm, |
| 3065 private_decryption_key, |
| 3066 CryptoData(ciphertext), |
| 3067 &decrypted_data)); |
| 3068 const std::string decrypted(static_cast<const char*>(decrypted_data.data()), |
| 3069 decrypted_data.byteLength()); |
| 3070 EXPECT_EQ(cleartext, decrypted); |
| 3071 |
| 3072 // Import the private wrapping key. Note this is the same underlying keying |
| 3073 // material used for private_decryption_key above. The only difference is that |
| 3074 // it has unwrap rather than decrypt usage. |
| 3075 blink::WebCryptoKey private_wrapping_key = blink::WebCryptoKey::createNull(); |
| 3076 ASSERT_STATUS_SUCCESS( |
| 3077 ImportKey(blink::WebCryptoKeyFormatPkcs8, |
| 3078 CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)), |
| 3079 algorithm, |
| 3080 false, |
| 3081 blink::WebCryptoKeyUsageUnwrapKey, |
| 3082 &private_wrapping_key)); |
| 3083 |
| 3084 // Treat the ciphertext as a wrapped key and try to unwrap it. Ensure a |
| 3085 // generic error is received. |
| 3086 blink::WebCryptoKey unwrapped_key = blink::WebCryptoKey::createNull(); |
| 3087 EXPECT_STATUS(Status::Error(), |
| 3088 UnwrapKey(blink::WebCryptoKeyFormatJwk, |
| 3089 CryptoData(ciphertext), |
| 3090 private_wrapping_key, |
| 3091 algorithm, |
| 3092 CreateAesCbcAlgorithm(std::vector<uint8>(0, 16)), |
| 3093 true, |
| 3094 blink::WebCryptoKeyUsageEncrypt, |
| 3095 &unwrapped_key)); |
| 3096 } |
| 3097 |
2981 } // namespace webcrypto | 3098 } // namespace webcrypto |
2982 | 3099 |
2983 } // namespace content | 3100 } // namespace content |
OLD | NEW |