Update token binding code to latest drafts

net/ssl/token_binding.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/token_binding.h"
 
 #include <openssl/bytestring.h>
 #include <openssl/ec.h>
+#include <openssl/ec_key.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
 
 #include "base/stl_util.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/base/net_errors.h"
 #include "net/ssl/ssl_config.h"
 
 namespace net {
 
 namespace {
 
+const size_t kUncompressedPointLen = 65;
+
 bool BuildTokenBindingID(crypto::ECPrivateKey* key, CBB* out) {
   EC_KEY* ec_key = EVP_PKEY_get0_EC_KEY(key->key());
   DCHECK(ec_key);
 
+  uint8_t point_buf[kUncompressedPointLen];
+  if (EC_POINT_point2oct(
+          EC_KEY_get0_group(ec_key), EC_KEY_get0_public_key(ec_key),
+          POINT_CONVERSION_UNCOMPRESSED, point_buf, kUncompressedPointLen,
+          NULL) != kUncompressedPointLen) {
+    return false;
+  }
   CBB ec_point;
   return CBB_add_u8(out, TB_PARAM_ECDSAP256) &&
          CBB_add_u8_length_prefixed(out, &ec_point) &&
-         EC_POINT_point2cbb(&ec_point, EC_KEY_get0_group(ec_key),
-                            EC_KEY_get0_public_key(ec_key),
-                            POINT_CONVERSION_UNCOMPRESSED, nullptr) &&
+         CBB_add_bytes(&ec_point, point_buf + 1, kUncompressedPointLen - 1) &&
          CBB_flush(out);
 }
 
 bool ECDSA_SIGToRaw(ECDSA_SIG* ec_sig, EC_KEY* ec, std::vector<uint8_t>* out) {
   const EC_GROUP* group = EC_KEY_get0_group(ec);
   const BIGNUM* order = EC_GROUP_get0_order(group);
   size_t len = BN_num_bytes(order);
   out->resize(2 * len);
   if (!BN_bn2bin_padded(out->data(), len, ec_sig->r) ||
       !BN_bn2bin_padded(out->data() + len, len, ec_sig->s)) {
@@ skipping 114 matching lines @@
         std::string(reinterpret_cast<const char*>(CBS_data(&signature)),
                     CBS_len(&signature));
     token_bindings->push_back(token_binding);
   }
   return true;
 }
 
 bool VerifyEKMSignature(base::StringPiece ec_point,
                         base::StringPiece signature,
                         base::StringPiece ekm) {
+  if (ec_point.size() != kUncompressedPointLen - 1)
+    return false;
+  uint8_t x9_62_ec_point[kUncompressedPointLen];
+  x9_62_ec_point[0] = 4;
+  memcpy(x9_62_ec_point + 1, reinterpret_cast<const uint8_t*>(ec_point.data()),

[davidben, 2016/07/13 23:22:57]

memcpy takes void* so I think you don't need the cast.

[nharper, 2016/07/13 23:29:43]

Done.

+         kUncompressedPointLen - 1);
   crypto::ScopedEC_Key key(EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
   EC_KEY* keyp = key.get();
-  const uint8_t* ec_point_data =
-      reinterpret_cast<const uint8_t*>(ec_point.data());
-  if (o2i_ECPublicKey(&keyp, &ec_point_data, ec_point.size()) != key.get())
+  crypto::ScopedEC_POINT pub_key(EC_POINT_new(EC_KEY_get0_group(keyp)));
+  if (!EC_POINT_oct2point(EC_KEY_get0_group(keyp), pub_key.get(),
+                          x9_62_ec_point, kUncompressedPointLen, nullptr) ||
+      !EC_KEY_set_public_key(keyp, pub_key.get())) {
     return false;
+  }
+
   crypto::ScopedECDSA_SIG sig(RawToECDSA_SIG(keyp, signature));
   if (!sig)
     return false;
   return !!ECDSA_do_verify(reinterpret_cast<const uint8_t*>(ekm.data()),
                            ekm.size(), sig.get(), keyp);
 }
 
 }  // namespace net