Allow ECDSA certs to be used for VPN and wifi

chrome/browser/chromeos/options/cert_library.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/options/cert_library.h"
 
 #include <algorithm>
+#include <memory>
 
 #include "base/command_line.h"
 #include "base/i18n/string_compare.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list_threadsafe.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/browser_process.h"  // g_browser_process
 #include "chrome/common/chrome_switches.h"
@@ skipping 128 matching lines @@
 }
 
 int CertLibrary::NumCertificates(CertType type) const {
   const net::CertificateList& cert_list = GetCertificateListForType(type);
   return static_cast<int>(cert_list.size());
 }
 
 base::string16 CertLibrary::GetCertDisplayStringAt(CertType type,
                                                    int index) const {
   net::X509Certificate* cert = GetCertificateAt(type, index);
-  bool hardware_backed = IsCertHardwareBackedAt(type, index);
+  bool hardware_backed = CertLoader::IsCertificateHardwareBacked(cert);
   return GetDisplayString(cert, hardware_backed);
 }
 
 std::string CertLibrary::GetServerCACertPEMAt(int index) const {
   return CertToPEM(*GetCertificateAt(CERT_TYPE_SERVER_CA, index));
 }
 
 std::string CertLibrary::GetUserCertPkcs11IdAt(int index, int* slot_id) const {
   net::X509Certificate* cert = GetCertificateAt(CERT_TYPE_USER, index);
   return CertLoader::GetPkcs11IdAndSlotForCert(*cert, slot_id);
 }
 
-bool CertLibrary::IsCertHardwareBackedAt(CertType type, int index) const {
+bool CertLibrary::IsCertSecureAt(CertType type, int index) const {

[August Huber, 2016/11/28 18:29:39]

What is the point of the name change?
Why are you asserting that software backed keys are now 'secure'?

[Kevin Cernekee, 2016/11/28 20:09:06]

They are as secure as possible, given the hardware limitations.

   net::X509Certificate* cert = GetCertificateAt(type, index);
-  return CertLoader::IsCertificateHardwareBacked(cert);
+  bool hardware_backed = CertLoader::IsCertificateHardwareBacked(cert);
+  if (hardware_backed)
+    return true;
+
+  // An RSA private key is considered secure only if it is bound to the TPM,
+  // because all Chromebooks support this.
+  // Other key types such as ECSDA are not supported by all TPM hardware, so
+  // it doesn't make sense to force users to bind them to the device in
+  // order to use them for WiFi or VPN.
+  net::X509Certificate::PublicKeyType actual_key_type =
+      net::X509Certificate::kPublicKeyTypeUnknown;
+  size_t unused_key_size = 0;
+  net::X509Certificate::GetPublicKeyInfo(cert->os_cert_handle(),
+                                         &unused_key_size, &actual_key_type);
+  return actual_key_type != net::X509Certificate::kPublicKeyTypeRSA;
 }
 
 int CertLibrary::GetServerCACertIndexByPEM(
     const std::string& pem_encoded) const {
   int num_certs = NumCertificates(CERT_TYPE_SERVER_CA);
   for (int index = 0; index < num_certs; ++index) {
     net::X509Certificate* cert = GetCertificateAt(CERT_TYPE_SERVER_CA, index);
     if (CertToPEM(*cert) != pem_encoded)
       continue;
     return index;
@@ skipping 86 matching lines @@
     return user_certs_;
   if (type == CERT_TYPE_SERVER)
     return server_certs_;
   if (type == CERT_TYPE_SERVER_CA)
     return server_ca_certs_;
   DCHECK(type == CERT_TYPE_DEFAULT);
   return certs_;
 }
 
 }  // namespace chromeos