OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef COMPONENTS_PROXIMITY_DEVICE_TO_DEVICE_AUTHENTICATOR_H | 5 #ifndef COMPONENTS_PROXIMITY_DEVICE_TO_DEVICE_AUTHENTICATOR_H |
6 #define COMPONENTS_PROXIMITY_DEVICE_TO_DEVICE_AUTHENTICATOR_H | 6 #define COMPONENTS_PROXIMITY_DEVICE_TO_DEVICE_AUTHENTICATOR_H |
7 | 7 |
8 #include "base/callback.h" | 8 #include "base/callback.h" |
9 #include "base/macros.h" | 9 #include "base/macros.h" |
10 #include "base/memory/weak_ptr.h" | 10 #include "base/memory/weak_ptr.h" |
| 11 #include "components/cryptauth/connection.h" |
| 12 #include "components/cryptauth/connection_observer.h" |
11 #include "components/proximity_auth/authenticator.h" | 13 #include "components/proximity_auth/authenticator.h" |
12 #include "components/proximity_auth/connection_observer.h" | |
13 | 14 |
14 namespace base { | 15 namespace base { |
15 class Timer; | 16 class Timer; |
16 }; | 17 }; |
17 | 18 |
18 namespace cryptauth { | 19 namespace cryptauth { |
19 class SecureMessageDelegate; | 20 class SecureMessageDelegate; |
20 } | 21 } |
21 | 22 |
22 namespace proximity_auth { | 23 namespace proximity_auth { |
23 | 24 |
24 class Connection; | |
25 | |
26 // Authenticator implementation using the "device to device" protocol, which is | 25 // Authenticator implementation using the "device to device" protocol, which is |
27 // in turn built on top of the SecureMessage library. | 26 // in turn built on top of the SecureMessage library. |
28 // This protocol contains the following steps (local device is the initiator): | 27 // This protocol contains the following steps (local device is the initiator): |
29 // 1. Both initiator and responder devices generate a temporary key pair for | 28 // 1. Both initiator and responder devices generate a temporary key pair for |
30 // the session. | 29 // the session. |
31 // 2. Initiator sends [Hello] message to responder device, which contains the | 30 // 2. Initiator sends [Hello] message to responder device, which contains the |
32 // initiator's session public key. | 31 // initiator's session public key. |
33 // 3. Responder responds with a [Responder Auth] message, containing its | 32 // 3. Responder responds with a [Responder Auth] message, containing its |
34 // session public key and data that allows the initiator to assert the | 33 // session public key and data that allows the initiator to assert the |
35 // identity of the responder. | 34 // identity of the responder. |
36 // 4. Initiator sends [Initiator Auth] message, containing data allowing the | 35 // 4. Initiator sends [Initiator Auth] message, containing data allowing the |
37 // responder to assert the identity of the initiator. | 36 // responder to assert the identity of the initiator. |
38 // 5. Both devices derive a symmetric key by running a key agreement protocol | 37 // 5. Both devices derive a symmetric key by running a key agreement protocol |
39 // session public keys they obtain from from the messages above. This | 38 // session public keys they obtain from from the messages above. This |
40 // symmetric key is used in the subsequent SecureContext. | 39 // symmetric key is used in the subsequent SecureContext. |
41 // The authentication protocol fails if any of the steps above fail. | 40 // The authentication protocol fails if any of the steps above fail. |
42 // This protocol requires exclusive use of the connection. No other message | 41 // This protocol requires exclusive use of the connection. No other message |
43 // should be sent or received while authentication is in progress. | 42 // should be sent or received while authentication is in progress. |
44 class DeviceToDeviceAuthenticator : public Authenticator, | 43 class DeviceToDeviceAuthenticator : public Authenticator, |
45 public ConnectionObserver { | 44 public cryptauth::ConnectionObserver { |
46 public: | 45 public: |
47 // Creates the instance: | 46 // Creates the instance: |
48 // |connection|: The connection to the remote device, which must be in a | 47 // |connection|: The connection to the remote device, which must be in a |
49 // connected state. Not owned. | 48 // connected state. Not owned. |
50 // |account_id|: The canonical account id of the user who is the owner of both | 49 // |account_id|: The canonical account id of the user who is the owner of both |
51 // the local and remote devices. | 50 // the local and remote devices. |
52 // |secure_message_delegate|: Handles the SecureMessage crypto operations. | 51 // |secure_message_delegate|: Handles the SecureMessage crypto operations. |
53 DeviceToDeviceAuthenticator(Connection* connection, | 52 DeviceToDeviceAuthenticator(cryptauth::Connection* connection, |
54 const std::string& account_id, | 53 const std::string& account_id, |
55 std::unique_ptr<cryptauth::SecureMessageDelegate> | 54 std::unique_ptr<cryptauth::SecureMessageDelegate> |
56 secure_message_delegate); | 55 secure_message_delegate); |
57 | 56 |
58 ~DeviceToDeviceAuthenticator() override; | 57 ~DeviceToDeviceAuthenticator() override; |
59 | 58 |
60 // Authenticator: | 59 // Authenticator: |
61 void Authenticate(const AuthenticationCallback& callback) override; | 60 void Authenticate(const AuthenticationCallback& callback) override; |
62 | 61 |
63 protected: | 62 protected: |
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
101 // Called when the authentication flow fails, and logs |error_message|. The | 100 // Called when the authentication flow fails, and logs |error_message|. The |
102 // overloaded version specifies the Result to be reported; | 101 // overloaded version specifies the Result to be reported; |
103 // otherwise, a FAILURE result will be reported. | 102 // otherwise, a FAILURE result will be reported. |
104 void Fail(const std::string& error_message); | 103 void Fail(const std::string& error_message); |
105 void Fail(const std::string& error_message, Result result); | 104 void Fail(const std::string& error_message, Result result); |
106 | 105 |
107 // Called when the authentication flow succeeds. | 106 // Called when the authentication flow succeeds. |
108 void Succeed(); | 107 void Succeed(); |
109 | 108 |
110 // ConnectionObserver: | 109 // ConnectionObserver: |
111 void OnConnectionStatusChanged(Connection* connection, | 110 void OnConnectionStatusChanged( |
112 Connection::Status old_status, | 111 cryptauth::Connection* connection, |
113 Connection::Status new_status) override; | 112 cryptauth::Connection::Status old_status, |
114 void OnMessageReceived(const Connection& connection, | 113 cryptauth::Connection::Status new_status) override; |
115 const WireMessage& message) override; | 114 void OnMessageReceived(const cryptauth::Connection& connection, |
116 void OnSendCompleted(const Connection& connection, | 115 const cryptauth::WireMessage& message) override; |
117 const WireMessage& message, | 116 void OnSendCompleted(const cryptauth::Connection& connection, |
| 117 const cryptauth::WireMessage& message, |
118 bool success) override; | 118 bool success) override; |
119 | 119 |
120 // The connection to the remote device. It is expected to be in the CONNECTED | 120 // The connection to the remote device. It is expected to be in the CONNECTED |
121 // state at all times during authentication. | 121 // state at all times during authentication. |
122 // Not owned, and must outlive this instance. | 122 // Not owned, and must outlive this instance. |
123 Connection* const connection_; | 123 cryptauth::Connection* const connection_; |
124 | 124 |
125 // The account id of the user who owns the local and remote devices. This is | 125 // The account id of the user who owns the local and remote devices. This is |
126 // normally an email address, and should be canonicalized. | 126 // normally an email address, and should be canonicalized. |
127 const std::string account_id_; | 127 const std::string account_id_; |
128 | 128 |
129 // Handles SecureMessage crypto operations. | 129 // Handles SecureMessage crypto operations. |
130 std::unique_ptr<cryptauth::SecureMessageDelegate> secure_message_delegate_; | 130 std::unique_ptr<cryptauth::SecureMessageDelegate> secure_message_delegate_; |
131 | 131 |
132 // The current state in the authentication flow. | 132 // The current state in the authentication flow. |
133 State state_; | 133 State state_; |
(...skipping 17 matching lines...) Expand all Loading... |
151 std::string session_symmetric_key_; | 151 std::string session_symmetric_key_; |
152 | 152 |
153 base::WeakPtrFactory<DeviceToDeviceAuthenticator> weak_ptr_factory_; | 153 base::WeakPtrFactory<DeviceToDeviceAuthenticator> weak_ptr_factory_; |
154 | 154 |
155 DISALLOW_COPY_AND_ASSIGN(DeviceToDeviceAuthenticator); | 155 DISALLOW_COPY_AND_ASSIGN(DeviceToDeviceAuthenticator); |
156 }; | 156 }; |
157 | 157 |
158 } // namespace proximity_auth | 158 } // namespace proximity_auth |
159 | 159 |
160 #endif // COMPONENTS_PROXIMITY_DEVICE_TO_DEVICE_AUTHENTICATOR_H | 160 #endif // COMPONENTS_PROXIMITY_DEVICE_TO_DEVICE_AUTHENTICATOR_H |
OLD | NEW |