[webcrypto] Add JWK symmetric key AES-KW unwrap for NSS.

content/child/webcrypto/platform_crypto.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_CHILD_WEBCRYPTO_PLATFORM_CRYPTO_H_
 #define CONTENT_CHILD_WEBCRYPTO_PLATFORM_CRYPTO_H_
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "third_party/WebKit/public/platform/WebArrayBuffer.h"
@@ skipping 165 matching lines @@
 //  * |key| is non-null.
 Status ExportKeySpki(PublicKey* key, blink::WebArrayBuffer* buffer);
 
 // Preconditions:
 //  * |wrapping_key| is non-null
 //  * |key| is non-null
 Status WrapSymKeyAesKw(SymKey* wrapping_key,
                        SymKey* key,
                        blink::WebArrayBuffer* buffer);
 
+// Unwraps (decrypts) |wrapped_key_data| using AES-KW and places the results in
+// a WebCryptoKey. Raw key data remains inside NSS. This function should be used
+// when the input |wrapped_key_data| is known to result in symmetric raw key
+// data after AES-KW decryption.
 // Preconditions:
 //  * |wrapping_key| is non-null
 //  * |key| is non-null
 //  * |wrapped_key_data| is at least 24 bytes and a multiple of 8 bytes
 //  * |algorithm.id()| is for a symmetric key algorithm.
 Status UnwrapSymKeyAesKw(const CryptoData& wrapped_key_data,
                          SymKey* wrapping_key,
                          const blink::WebCryptoAlgorithm& algorithm,
                          bool extractable,
                          blink::WebCryptoKeyUsageMask usage_mask,
                          blink::WebCryptoKey* key);
 
+// Performs AES-KW decryption on the input |data|, of which no assumptions are

[eroman, 2014/03/17 19:47:47]

Not sure what "of which no assumptions are made" means, since we assume that it
is "at least 24 bytes and a multiple of 8 bytes".

[padolph, 2014/03/17 22:12:49]

Done.

+// made, and returns the result to the caller. This function should be used when
+// the input |data| does not directly represent a key and should instead be
+// interpreted as generic bytes.
+// Preconditions:
+//  * |key| is non-null
+//  * |data| is at least 24 bytes and a multiple of 8 bytes
+//  * |buffer| is non-null.
+Status DecryptAesKw(SymKey* key,
+                    const CryptoData& data,
+                    blink::WebArrayBuffer* buffer);
+
 // Preconditions:
 //  * |wrapping_key| is non-null
 //  * |key| is non-null
 Status WrapSymKeyRsaEs(PublicKey* wrapping_key,
                        SymKey* key,
                        blink::WebArrayBuffer* buffer);
 
 // Preconditions:
 //  * |wrapping_key| is non-null
 //  * |key| is non-null
 //  * |algorithm.id()| is for a symmetric key algorithm.
 Status UnwrapSymKeyRsaEs(const CryptoData& wrapped_key_data,
                          PrivateKey* wrapping_key,
                          const blink::WebCryptoAlgorithm& algorithm,
                          bool extractable,
                          blink::WebCryptoKeyUsageMask usage_mask,
                          blink::WebCryptoKey* key);
 
 }  // namespace platform
 
 }  // namespace webcrypto
 
 }  // namespace content
 
 #endif  // CONTENT_CHILD_WEBCRYPTO_PLATFORM_CRYPTO_H_