Implement verify() for HMAC using NSS

content/renderer/webcrypto_impl_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webcrypto_impl.h"
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 87 matching lines @@
 
   bool SignInternal(
       const WebKit::WebCryptoAlgorithm& algorithm,
       const WebKit::WebCryptoKey& key,
       const unsigned char* data,
       unsigned data_size,
       WebKit::WebArrayBuffer* buffer) {
     return crypto_.SignInternal(algorithm, key, data, data_size, buffer);
   }
 
+  bool VerifySignatureInternal(
+      const WebKit::WebCryptoAlgorithm& algorithm,
+      const WebKit::WebCryptoKey& key,
+      const unsigned char* signature,
+      unsigned signature_size,
+      const unsigned char* data,
+      unsigned data_size,
+      bool* signature_match) {
+    return crypto_.VerifySignatureInternal(algorithm,
+                                           key,
+                                           signature,
+                                           signature_size,
+                                           data,
+                                           data_size,
+                                           signature_match);
+  }
+
  private:
   WebCryptoImpl crypto_;
 };
 
 TEST_F(WebCryptoImplTest, DigestSampleSets) {
   // The results are stored here in hex format for readability.
   //
   // TODO(bryaneyler): Eventually, all these sample test sets should be replaced
   // with the sets here: http://csrc.nist.gov/groups/STM/cavp/index.html#03
   //
@@ skipping 171 matching lines @@
         test.key, algorithm, WebKit::WebCryptoKeyUsageSign);
 
     std::vector<uint8> message_raw = HexStringToBytes(test.message);
 
     WebKit::WebArrayBuffer output;
 
     ASSERT_TRUE(SignInternal(
         algorithm, key, message_raw.data(), message_raw.size(), &output));
 
     ExpectArrayBufferMatchesHex(test.mac, output);
+
+    bool signature_match = false;
+    EXPECT_TRUE(VerifySignatureInternal(
+        algorithm,
+        key,
+        static_cast<const unsigned char*>(output.data()),
+        output.byteLength(),
+        message_raw.data(),
+        message_raw.size(),
+        &signature_match));
+    EXPECT_TRUE(signature_match);
+
+    // Ensure truncated signature does not verify by passing one less byte.
+    EXPECT_TRUE(VerifySignatureInternal(
+        algorithm,
+        key,
+        static_cast<const unsigned char*>(output.data()),
+        output.byteLength() - 1,
+        message_raw.data(),
+        message_raw.size(),
+        &signature_match));
+    EXPECT_FALSE(signature_match);
+
+    // Ensure extra long signature does not cause issues and fails.
+    const unsigned char kLongSignature[1024] = { 0 };
+    EXPECT_TRUE(VerifySignatureInternal(
+        algorithm,
+        key,
+        kLongSignature,
+        sizeof(kLongSignature),
+        message_raw.data(),
+        message_raw.size(),
+        &signature_match));
+    EXPECT_FALSE(signature_match);
   }
 }
 
 }  // namespace content