OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/certificate_reporting/error_reporter.h" | 5 #include "components/certificate_reporting/error_reporter.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 | 8 |
9 #include <set> | 9 #include <set> |
10 #include <utility> | 10 #include <utility> |
11 | 11 |
12 #include "base/logging.h" | 12 #include "base/logging.h" |
13 #include "base/memory/ptr_util.h" | 13 #include "base/memory/ptr_util.h" |
14 #include "base/metrics/histogram_macros.h" | 14 #include "base/metrics/histogram_macros.h" |
15 #include "base/metrics/sparse_histogram.h" | 15 #include "base/metrics/sparse_histogram.h" |
16 #include "components/certificate_reporting/encrypted_cert_logger.pb.h" | 16 #include "components/certificate_reporting/encrypted_cert_logger.pb.h" |
17 #include "crypto/aead.h" | 17 #include "crypto/aead.h" |
18 #include "crypto/curve25519.h" | |
19 #include "crypto/hkdf.h" | 18 #include "crypto/hkdf.h" |
20 #include "crypto/random.h" | 19 #include "crypto/random.h" |
21 #include "net/url_request/report_sender.h" | 20 #include "net/url_request/report_sender.h" |
| 21 #include "third_party/boringssl/src/include/openssl/curve25519.h" |
22 | 22 |
23 namespace certificate_reporting { | 23 namespace certificate_reporting { |
24 | 24 |
25 namespace { | 25 namespace { |
26 | 26 |
27 // Constants used for crypto. The corresponding private key is used by | 27 // Constants used for crypto. The corresponding private key is used by |
28 // the SafeBrowsing client-side detection server to decrypt reports. | 28 // the SafeBrowsing client-side detection server to decrypt reports. |
29 static const uint8_t kServerPublicKey[] = { | 29 static const uint8_t kServerPublicKey[] = { |
30 0x51, 0xcc, 0x52, 0x67, 0x42, 0x47, 0x3b, 0x10, 0xe8, 0x63, 0x18, | 30 0x51, 0xcc, 0x52, 0x67, 0x42, 0x47, 0x3b, 0x10, 0xe8, 0x63, 0x18, |
31 0x3c, 0x61, 0xa7, 0x96, 0x76, 0x86, 0x91, 0x40, 0x71, 0x39, 0x5f, | 31 0x3c, 0x61, 0xa7, 0x96, 0x76, 0x86, 0x91, 0x40, 0x71, 0x39, 0x5f, |
32 0x31, 0x1a, 0x39, 0x5b, 0x76, 0xb1, 0x6b, 0x3d, 0x6a, 0x2b}; | 32 0x31, 0x1a, 0x39, 0x5b, 0x76, 0xb1, 0x6b, 0x3d, 0x6a, 0x2b}; |
33 static const uint32_t kServerPublicKeyVersion = 1; | 33 static const uint32_t kServerPublicKeyVersion = 1; |
34 | 34 |
35 static const char kHkdfLabel[] = "certificate report"; | 35 static const char kHkdfLabel[] = "certificate report"; |
36 | 36 |
37 bool GetHkdfSubkeySecret(size_t subkey_length, | 37 bool GetHkdfSubkeySecret(size_t subkey_length, |
38 const uint8_t* private_key, | 38 const uint8_t* private_key, |
39 const uint8_t* public_key, | 39 const uint8_t* public_key, |
40 std::string* secret) { | 40 std::string* secret) { |
41 uint8_t shared_secret[crypto::curve25519::kBytes]; | 41 uint8_t shared_secret[32]; |
42 if (!crypto::curve25519::ScalarMult(private_key, public_key, shared_secret)) | 42 if (!X25519(shared_secret, private_key, public_key)) |
43 return false; | 43 return false; |
44 | 44 |
45 // By mistake, the HKDF label here ends up with an extra null byte on | 45 // By mistake, the HKDF label here ends up with an extra null byte on |
46 // the end, due to using sizeof(kHkdfLabel) in the StringPiece | 46 // the end, due to using sizeof(kHkdfLabel) in the StringPiece |
47 // constructor instead of strlen(kHkdfLabel). Ideally this code should | 47 // constructor instead of strlen(kHkdfLabel). Ideally this code should |
48 // be just passing kHkdfLabel directly into the HKDF constructor. | 48 // be just passing kHkdfLabel directly into the HKDF constructor. |
49 // | 49 // |
50 // TODO(estark): fix this in coordination with the server-side code -- | 50 // TODO(estark): fix this in coordination with the server-side code -- |
51 // perhaps by rolling the public key version forward and using the | 51 // perhaps by rolling the public key version forward and using the |
52 // version to decide whether to use the extra-null-byte version of the | 52 // version to decide whether to use the extra-null-byte version of the |
53 // label. https://crbug.com/517746 | 53 // label. https://crbug.com/517746 |
54 crypto::HKDF hkdf(base::StringPiece(reinterpret_cast<char*>(shared_secret), | 54 crypto::HKDF hkdf(base::StringPiece(reinterpret_cast<char*>(shared_secret), |
55 sizeof(shared_secret)), | 55 sizeof(shared_secret)), |
56 "" /* salt */, | 56 "" /* salt */, |
57 base::StringPiece(kHkdfLabel, sizeof(kHkdfLabel)), | 57 base::StringPiece(kHkdfLabel, sizeof(kHkdfLabel)), |
58 0 /* key bytes */, 0 /* iv bytes */, subkey_length); | 58 0 /* key bytes */, 0 /* iv bytes */, subkey_length); |
59 | 59 |
60 *secret = hkdf.subkey_secret().as_string(); | 60 *secret = hkdf.subkey_secret().as_string(); |
61 return true; | 61 return true; |
62 } | 62 } |
63 | 63 |
64 bool EncryptSerializedReport(const uint8_t* server_public_key, | 64 bool EncryptSerializedReport(const uint8_t* server_public_key, |
65 uint32_t server_public_key_version, | 65 uint32_t server_public_key_version, |
66 const std::string& report, | 66 const std::string& report, |
67 EncryptedCertLoggerRequest* encrypted_report) { | 67 EncryptedCertLoggerRequest* encrypted_report) { |
68 // Generate an ephemeral key pair to generate a shared secret. | 68 // Generate an ephemeral key pair to generate a shared secret. |
69 uint8_t public_key[crypto::curve25519::kBytes]; | 69 uint8_t public_key[32]; |
70 uint8_t private_key[crypto::curve25519::kScalarBytes]; | 70 uint8_t private_key[32]; |
71 | 71 |
72 crypto::RandBytes(private_key, sizeof(private_key)); | 72 crypto::RandBytes(private_key, sizeof(private_key)); |
73 crypto::curve25519::ScalarBaseMult(private_key, public_key); | 73 X25519_public_from_private(public_key, private_key); |
74 | 74 |
75 crypto::Aead aead(crypto::Aead::AES_128_CTR_HMAC_SHA256); | 75 crypto::Aead aead(crypto::Aead::AES_128_CTR_HMAC_SHA256); |
76 std::string key; | 76 std::string key; |
77 if (!GetHkdfSubkeySecret(aead.KeyLength(), private_key, | 77 if (!GetHkdfSubkeySecret(aead.KeyLength(), private_key, |
78 reinterpret_cast<const uint8_t*>(server_public_key), | 78 reinterpret_cast<const uint8_t*>(server_public_key), |
79 &key)) { | 79 &key)) { |
80 LOG(ERROR) << "Error getting subkey secret."; | 80 LOG(ERROR) << "Error getting subkey secret."; |
81 return false; | 81 return false; |
82 } | 82 } |
83 aead.Init(&key); | 83 aead.Init(&key); |
(...skipping 88 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
172 aead.Init(&key); | 172 aead.Init(&key); |
173 | 173 |
174 // Use an all-zero nonce because the key is random per-message. | 174 // Use an all-zero nonce because the key is random per-message. |
175 std::string nonce(aead.NonceLength(), 0); | 175 std::string nonce(aead.NonceLength(), 0); |
176 | 176 |
177 return aead.Open(encrypted_report.encrypted_report(), nonce, std::string(), | 177 return aead.Open(encrypted_report.encrypted_report(), nonce, std::string(), |
178 decrypted_serialized_report); | 178 decrypted_serialized_report); |
179 } | 179 } |
180 | 180 |
181 } // namespace certificate_reporting | 181 } // namespace certificate_reporting |
OLD | NEW |