OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/internal/verify_signed_data.h" | 5 #include "net/cert/internal/verify_signed_data.h" |
6 | 6 |
7 #include <openssl/bytestring.h> | 7 #include <openssl/bytestring.h> |
8 #include <openssl/digest.h> | 8 #include <openssl/digest.h> |
9 #include <openssl/ec.h> | 9 #include <openssl/ec.h> |
10 #include <openssl/ec_key.h> | 10 #include <openssl/ec_key.h> |
(...skipping 149 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
160 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_RSA, pkey)) | 160 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_RSA, pkey)) |
161 return false; | 161 return false; |
162 | 162 |
163 // Extract the modulus length from the key. | 163 // Extract the modulus length from the key. |
164 crypto::ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey->get())); | 164 crypto::ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey->get())); |
165 if (!rsa) | 165 if (!rsa) |
166 return false; | 166 return false; |
167 unsigned int modulus_length_bits = BN_num_bits(rsa->n); | 167 unsigned int modulus_length_bits = BN_num_bits(rsa->n); |
168 | 168 |
169 if (!policy->IsAcceptableModulusLengthForRsa(modulus_length_bits, errors)) { | 169 if (!policy->IsAcceptableModulusLengthForRsa(modulus_length_bits, errors)) { |
170 errors->Add(kUnacceptableRsaModulusLength); | 170 errors->AddError(kUnacceptableRsaModulusLength); |
171 return false; | 171 return false; |
172 } | 172 } |
173 | 173 |
174 return true; | 174 return true; |
175 } | 175 } |
176 | 176 |
177 // Does signature verification using either RSA or ECDSA. | 177 // Does signature verification using either RSA or ECDSA. |
178 WARN_UNUSED_RESULT bool DoVerify(const SignatureAlgorithm& algorithm, | 178 WARN_UNUSED_RESULT bool DoVerify(const SignatureAlgorithm& algorithm, |
179 const der::Input& signed_data, | 179 const der::Input& signed_data, |
180 const der::BitString& signature_value, | 180 const der::BitString& signature_value, |
(...skipping 88 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
269 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_EC, pkey)) | 269 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_EC, pkey)) |
270 return false; | 270 return false; |
271 | 271 |
272 // Extract the curve name. | 272 // Extract the curve name. |
273 crypto::ScopedEC_KEY ec(EVP_PKEY_get1_EC_KEY(pkey->get())); | 273 crypto::ScopedEC_KEY ec(EVP_PKEY_get1_EC_KEY(pkey->get())); |
274 if (!ec.get()) | 274 if (!ec.get()) |
275 return false; // Unexpected. | 275 return false; // Unexpected. |
276 int curve_nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec.get())); | 276 int curve_nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec.get())); |
277 | 277 |
278 if (!policy->IsAcceptableCurveForEcdsa(curve_nid, errors)) { | 278 if (!policy->IsAcceptableCurveForEcdsa(curve_nid, errors)) { |
279 errors->Add(kUnacceptableEcdsaCurve); | 279 errors->AddError(kUnacceptableEcdsaCurve); |
280 return false; | 280 return false; |
281 } | 281 } |
282 | 282 |
283 return true; | 283 return true; |
284 } | 284 } |
285 | 285 |
286 } // namespace | 286 } // namespace |
287 | 287 |
288 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm, | 288 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm, |
289 const der::Input& signed_data, | 289 const der::Input& signed_data, |
290 const der::BitString& signature_value, | 290 const der::BitString& signature_value, |
291 const der::Input& public_key_spki, | 291 const der::Input& public_key_spki, |
292 const SignaturePolicy* policy, | 292 const SignaturePolicy* policy, |
293 CertErrors* errors) { | 293 CertErrors* errors) { |
294 if (!policy->IsAcceptableSignatureAlgorithm(signature_algorithm, errors)) { | 294 if (!policy->IsAcceptableSignatureAlgorithm(signature_algorithm, errors)) { |
295 errors->Add(kUnacceptableSignatureAlgorithm); | 295 errors->AddError(kUnacceptableSignatureAlgorithm); |
296 return false; | 296 return false; |
297 } | 297 } |
298 | 298 |
299 crypto::ScopedEVP_PKEY public_key; | 299 crypto::ScopedEVP_PKEY public_key; |
300 | 300 |
301 // Parse the SPKI to an EVP_PKEY appropriate for the signature algorithm. | 301 // Parse the SPKI to an EVP_PKEY appropriate for the signature algorithm. |
302 switch (signature_algorithm.algorithm()) { | 302 switch (signature_algorithm.algorithm()) { |
303 case SignatureAlgorithmId::RsaPkcs1: | 303 case SignatureAlgorithmId::RsaPkcs1: |
304 case SignatureAlgorithmId::RsaPss: | 304 case SignatureAlgorithmId::RsaPss: |
305 if (!ParseRsaKeyFromSpki(public_key_spki, &public_key, policy, errors)) | 305 if (!ParseRsaKeyFromSpki(public_key_spki, &public_key, policy, errors)) |
306 return false; | 306 return false; |
307 break; | 307 break; |
308 case SignatureAlgorithmId::Ecdsa: | 308 case SignatureAlgorithmId::Ecdsa: |
309 if (!ParseEcKeyFromSpki(public_key_spki, &public_key, policy, errors)) | 309 if (!ParseEcKeyFromSpki(public_key_spki, &public_key, policy, errors)) |
310 return false; | 310 return false; |
311 break; | 311 break; |
312 } | 312 } |
313 | 313 |
314 if (!DoVerify(signature_algorithm, signed_data, signature_value, | 314 if (!DoVerify(signature_algorithm, signed_data, signature_value, |
315 public_key.get())) { | 315 public_key.get())) { |
316 errors->Add(kSignatureVerificationFailed); | 316 errors->AddError(kSignatureVerificationFailed); |
317 return false; | 317 return false; |
318 } | 318 } |
319 | 319 |
320 return true; | 320 return true; |
321 } | 321 } |
322 | 322 |
323 } // namespace net | 323 } // namespace net |
OLD | NEW |