Allow ECDSA certs to be used for VPN and wifi

Allow ECDSA certs to be used for VPN and wifi

These certs cannot be hardware-backed on legacy TPM hardware, so make
an exception for them.  RSA certs are still required to be
hardware-backed.

BUG=619273
TEST=manually import an ECDSA cert and use it to connect to an IPsec VPN

[stevenjb, 2016-11-08 20:09:36]

stevenjb@chromium.org changed reviewers:
+ stevenjb@chromium.org

[stevenjb, 2016-11-08 20:09:37]

This looks reaosnable to me, but please also find someone familiar with
certificatee security to review.

lgtm w/ comments updated.

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
File chrome/browser/chromeos/options/vpn_config_view.cc (right):

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
chrome/browser/chromeos/options/vpn_config_view.cc:1032: // Currently only
hardware-backed user certificates are valid.
Update comment.

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
File chrome/browser/chromeos/options/wifi_config_view.cc (right):

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
chrome/browser/chromeos/options/wifi_config_view.cc:448: // Currently only
hardware-backed user certificates are valid.
Update comment.

[Kevin Cernekee, 2016-11-08 21:00:41]

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
File chrome/browser/chromeos/options/vpn_config_view.cc (right):

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
chrome/browser/chromeos/options/vpn_config_view.cc:1032: // Currently only
hardware-backed user certificates are valid.
On 2016/11/08 20:09:37, stevenjb wrote:
> Update comment.

Done.

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
File chrome/browser/chromeos/options/wifi_config_view.cc (right):

https://codereview.chromium.org/2485813002/diff/1/chrome/browser/chromeos/opt...
chrome/browser/chromeos/options/wifi_config_view.cc:448: // Currently only
hardware-backed user certificates are valid.
On 2016/11/08 20:09:37, stevenjb wrote:
> Update comment.

Done.

[stevenjb, 2016-11-10 18:58:58]

stevenjb@chromium.org changed reviewers:
+ mnissler@chromium.org

[stevenjb, 2016-11-10 18:58:58]

+mnissler@

I have OWNER status for this code, but I would like an additional lg here just
to confirm that someone more knowledgeable about ECSDA certs has looked at the
code. Thanks!

[Mattias Nissler (ping if slow), 2016-11-10 21:39:34]

OK, LGTM then :)

[August Huber, 2016-11-28 18:29:39]

auh@chromium.org changed reviewers:
+ auh@chromium.org

[August Huber, 2016-11-28 18:29:40]

I think you need to revisit the assumptions that were made when we decided to
require hardware-backed keys for VPN.

Users of keys generated via verified access don't have this concern, but users
who cannot assert TPM backing via attestation may believe this is providing some
kind of security.

https://codereview.chromium.org/2485813002/diff/20001/chrome/browser/chromeos...
File chrome/browser/chromeos/options/cert_library.cc (right):

https://codereview.chromium.org/2485813002/diff/20001/chrome/browser/chromeos...
chrome/browser/chromeos/options/cert_library.cc:170: bool
CertLibrary::IsCertSecureAt(CertType type, int index) const {
What is the point of the name change?
Why are you asserting that software backed keys are now 'secure'?

[Kevin Cernekee, 2016-11-28 20:09:06]

This CL will not work as-is because strongSwan cannot currently access
certs/keys in UserNSSDB, but:

> users who cannot assert TPM backing via attestation may
> believe this is providing some kind of security.

If they are using RSA certs, nothing changes.  Non-HW-backed RSA certs are still
disallowed.

If they choose to enable support for ECDSA certs on TPM1 hardware, they should
already be aware of the platform's limitations.

If they are already issuing ECDSA certs without verified access, they have no
way of guaranteeing that the certs will be used from a(n unmodified) Chromebook
anyway.

https://codereview.chromium.org/2485813002/diff/20001/chrome/browser/chromeos...
File chrome/browser/chromeos/options/cert_library.cc (right):

https://codereview.chromium.org/2485813002/diff/20001/chrome/browser/chromeos...
chrome/browser/chromeos/options/cert_library.cc:170: bool
CertLibrary::IsCertSecureAt(CertType type, int index) const {
On 2016/11/28 18:29:39, August Huber wrote:
> What is the point of the name change?
> Why are you asserting that software backed keys are now 'secure'?

They are as secure as possible, given the hardware limitations.

[Kevin Cernekee, 2016-11-28 20:41:56]

cernekee@chromium.org changed reviewers:
+ drewry@google.com

[Kevin Cernekee, 2016-11-28 20:41:57]

Per offline discussions with August:

Will - do you have any strong opinions on whether to drop the "cert must be HW
backed" check in the GUI for ECDSA only, RSA+ECDSA, or for neither?

Also, how should ONC handle it?

[Kevin Cernekee, 2016-12-01 20:26:04]

The CQ bit was checked by cernekee@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 20:26:32]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 20:55:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 20:55:17]

Dry run: This issue passed the CQ dry run.

[Kevin Cernekee, 2017-09-22 16:20:09]

Description was changed from

==========
Allow ECDSA certs to be used for VPN and wifi

These certs cannot be hardware-backed on legacy TPM hardware, so make
an exception for them.  RSA certs are still required to be
hardware-backed.

BUG=619273
TEST=manually import an ECDSA cert and use it to connect to an IPsec VPN
==========

to

==========
Allow ECDSA certs to be used for VPN and wifi

These certs cannot be hardware-backed on legacy TPM hardware, so make
an exception for them.  RSA certs are still required to be
hardware-backed.

BUG=619273
TEST=manually import an ECDSA cert and use it to connect to an IPsec VPN
==========