OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <openssl/bn.h> | 5 #include <openssl/bn.h> |
6 #include <openssl/dsa.h> | 6 #include <openssl/dsa.h> |
7 #include <openssl/ecdsa.h> | 7 #include <openssl/ecdsa.h> |
8 #include <openssl/err.h> | 8 #include <openssl/err.h> |
9 #include <openssl/evp.h> | 9 #include <openssl/evp.h> |
10 #include <openssl/pem.h> | 10 #include <openssl/pem.h> |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 namespace android { | 55 namespace android { |
56 | 56 |
57 namespace { | 57 namespace { |
58 | 58 |
59 typedef crypto::ScopedOpenSSL<EVP_PKEY, EVP_PKEY_free> ScopedEVP_PKEY; | 59 typedef crypto::ScopedOpenSSL<EVP_PKEY, EVP_PKEY_free> ScopedEVP_PKEY; |
60 typedef crypto::ScopedOpenSSL<RSA, RSA_free> ScopedRSA; | 60 typedef crypto::ScopedOpenSSL<RSA, RSA_free> ScopedRSA; |
61 typedef crypto::ScopedOpenSSL<DSA, DSA_free> ScopedDSA; | 61 typedef crypto::ScopedOpenSSL<DSA, DSA_free> ScopedDSA; |
62 typedef crypto::ScopedOpenSSL<EC_KEY, EC_KEY_free> ScopedEC_KEY; | 62 typedef crypto::ScopedOpenSSL<EC_KEY, EC_KEY_free> ScopedEC_KEY; |
63 typedef crypto::ScopedOpenSSL<BIGNUM, BN_free> ScopedBIGNUM; | 63 typedef crypto::ScopedOpenSSL<BIGNUM, BN_free> ScopedBIGNUM; |
64 | 64 |
65 typedef crypto::ScopedOpenSSL< | 65 typedef crypto::ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free> |
66 PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free> | 66 ScopedPKCS8_PRIV_KEY_INFO; |
67 ScopedPKCS8_PRIV_KEY_INFO; | |
68 | 67 |
69 typedef base::android::ScopedJavaLocalRef<jobject> ScopedJava; | 68 typedef base::android::ScopedJavaLocalRef<jobject> ScopedJava; |
70 | 69 |
71 JNIEnv* InitEnv() { | 70 JNIEnv* InitEnv() { |
72 JNIEnv* env = base::android::AttachCurrentThread(); | 71 JNIEnv* env = base::android::AttachCurrentThread(); |
73 static bool inited = false; | 72 static bool inited = false; |
74 if (!inited) { | 73 if (!inited) { |
75 RegisterNativesImpl(env); | 74 RegisterNativesImpl(env); |
76 inited = true; | 75 inited = true; |
77 } | 76 } |
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
118 base::FilePath certs_dir = GetTestCertsDirectory(); | 117 base::FilePath certs_dir = GetTestCertsDirectory(); |
119 base::FilePath file_path = certs_dir.AppendASCII(filename); | 118 base::FilePath file_path = certs_dir.AppendASCII(filename); |
120 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); | 119 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); |
121 if (!handle.get()) { | 120 if (!handle.get()) { |
122 LOG(ERROR) << "Could not open private key file: " << filename; | 121 LOG(ERROR) << "Could not open private key file: " << filename; |
123 return NULL; | 122 return NULL; |
124 } | 123 } |
125 // Assume it is PEM_encoded. Load it as an EVP_PKEY. | 124 // Assume it is PEM_encoded. Load it as an EVP_PKEY. |
126 EVP_PKEY* pkey = PEM_read_PrivateKey(handle.get(), NULL, NULL, NULL); | 125 EVP_PKEY* pkey = PEM_read_PrivateKey(handle.get(), NULL, NULL, NULL); |
127 if (!pkey) { | 126 if (!pkey) { |
128 LOG(ERROR) << "Could not load public key file: " << filename | 127 LOG(ERROR) << "Could not load public key file: " << filename << ", " |
129 << ", " << GetOpenSSLErrorString(); | 128 << GetOpenSSLErrorString(); |
130 return NULL; | 129 return NULL; |
131 } | 130 } |
132 return pkey; | 131 return pkey; |
133 } | 132 } |
134 | 133 |
135 // Convert a private key into its PKCS#8 encoded representation. | 134 // Convert a private key into its PKCS#8 encoded representation. |
136 // |pkey| is the EVP_PKEY handle for the private key. | 135 // |pkey| is the EVP_PKEY handle for the private key. |
137 // |pkcs8| will receive the PKCS#8 bytes. | 136 // |pkcs8| will receive the PKCS#8 bytes. |
138 // Returns true on success, false otherwise. | 137 // Returns true on success, false otherwise. |
139 bool GetPrivateKeyPkcs8Bytes(const ScopedEVP_PKEY& pkey, | 138 bool GetPrivateKeyPkcs8Bytes(const ScopedEVP_PKEY& pkey, std::string* pkcs8) { |
140 std::string* pkcs8) { | |
141 // Convert to PKCS#8 object. | 139 // Convert to PKCS#8 object. |
142 ScopedPKCS8_PRIV_KEY_INFO p8_info(EVP_PKEY2PKCS8(pkey.get())); | 140 ScopedPKCS8_PRIV_KEY_INFO p8_info(EVP_PKEY2PKCS8(pkey.get())); |
143 if (!p8_info.get()) { | 141 if (!p8_info.get()) { |
144 LOG(ERROR) << "Can't get PKCS#8 private key from EVP_PKEY: " | 142 LOG(ERROR) << "Can't get PKCS#8 private key from EVP_PKEY: " |
145 << GetOpenSSLErrorString(); | 143 << GetOpenSSLErrorString(); |
146 return false; | 144 return false; |
147 } | 145 } |
148 | 146 |
149 // Then convert it | 147 // Then convert it |
150 int len = i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), NULL); | 148 int len = i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), NULL); |
151 unsigned char* p = OpenSSLWriteInto(pkcs8, static_cast<size_t>(len)); | 149 unsigned char* p = OpenSSLWriteInto(pkcs8, static_cast<size_t>(len)); |
152 i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), &p); | 150 i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), &p); |
153 return true; | 151 return true; |
154 } | 152 } |
155 | 153 |
156 bool ImportPrivateKeyFileAsPkcs8(const char* filename, | 154 bool ImportPrivateKeyFileAsPkcs8(const char* filename, std::string* pkcs8) { |
157 std::string* pkcs8) { | |
158 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(filename)); | 155 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(filename)); |
159 if (!pkey.get()) | 156 if (!pkey.get()) |
160 return false; | 157 return false; |
161 return GetPrivateKeyPkcs8Bytes(pkey, pkcs8); | 158 return GetPrivateKeyPkcs8Bytes(pkey, pkcs8); |
162 } | 159 } |
163 | 160 |
164 // Same as ImportPrivateKey, but for public ones. | 161 // Same as ImportPrivateKey, but for public ones. |
165 EVP_PKEY* ImportPublicKeyFile(const char* filename) { | 162 EVP_PKEY* ImportPublicKeyFile(const char* filename) { |
166 // Load file as PEM data. | 163 // Load file as PEM data. |
167 base::FilePath certs_dir = GetTestCertsDirectory(); | 164 base::FilePath certs_dir = GetTestCertsDirectory(); |
168 base::FilePath file_path = certs_dir.AppendASCII(filename); | 165 base::FilePath file_path = certs_dir.AppendASCII(filename); |
169 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); | 166 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); |
170 if (!handle.get()) { | 167 if (!handle.get()) { |
171 LOG(ERROR) << "Could not open public key file: " << filename; | 168 LOG(ERROR) << "Could not open public key file: " << filename; |
172 return NULL; | 169 return NULL; |
173 } | 170 } |
174 EVP_PKEY* pkey = PEM_read_PUBKEY(handle.get(), NULL, NULL, NULL); | 171 EVP_PKEY* pkey = PEM_read_PUBKEY(handle.get(), NULL, NULL, NULL); |
175 if (!pkey) { | 172 if (!pkey) { |
176 LOG(ERROR) << "Could not load public key file: " << filename | 173 LOG(ERROR) << "Could not load public key file: " << filename << ", " |
177 << ", " << GetOpenSSLErrorString(); | 174 << GetOpenSSLErrorString(); |
178 return NULL; | 175 return NULL; |
179 } | 176 } |
180 return pkey; | 177 return pkey; |
181 } | 178 } |
182 | 179 |
183 // Retrieve a JNI local ref from encoded PKCS#8 data. | 180 // Retrieve a JNI local ref from encoded PKCS#8 data. |
184 ScopedJava GetPKCS8PrivateKeyJava(PrivateKeyType key_type, | 181 ScopedJava GetPKCS8PrivateKeyJava(PrivateKeyType key_type, |
185 const std::string& pkcs8_key) { | 182 const std::string& pkcs8_key) { |
186 JNIEnv* env = InitEnv(); | 183 JNIEnv* env = InitEnv(); |
187 base::android::ScopedJavaLocalRef<jbyteArray> bytes( | 184 base::android::ScopedJavaLocalRef<jbyteArray> bytes( |
188 base::android::ToJavaByteArray( | 185 base::android::ToJavaByteArray( |
189 env, | 186 env, |
190 reinterpret_cast<const uint8*>(pkcs8_key.data()), | 187 reinterpret_cast<const uint8*>(pkcs8_key.data()), |
191 pkcs8_key.size())); | 188 pkcs8_key.size())); |
192 | 189 |
193 ScopedJava key( | 190 ScopedJava key(Java_AndroidKeyStoreTestUtil_createPrivateKeyFromPKCS8( |
194 Java_AndroidKeyStoreTestUtil_createPrivateKeyFromPKCS8( | 191 env, key_type, bytes.obj())); |
195 env, key_type, bytes.obj())); | |
196 | 192 |
197 return key; | 193 return key; |
198 } | 194 } |
199 | 195 |
200 const char kTestRsaKeyFile[] = "android-test-key-rsa.pem"; | 196 const char kTestRsaKeyFile[] = "android-test-key-rsa.pem"; |
201 | 197 |
202 // The RSA test hash must be 36 bytes exactly. | 198 // The RSA test hash must be 36 bytes exactly. |
203 const char kTestRsaHash[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; | 199 const char kTestRsaHash[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; |
204 | 200 |
205 // Retrieve a JNI local ref for our test RSA key. | 201 // Retrieve a JNI local ref for our test RSA key. |
(...skipping 24 matching lines...) Expand all Loading... |
230 // signature bits directly. However, one can use the public key | 226 // signature bits directly. However, one can use the public key |
231 // to do the check. | 227 // to do the check. |
232 bool VerifyTestDSASignature(const base::StringPiece& message, | 228 bool VerifyTestDSASignature(const base::StringPiece& message, |
233 const base::StringPiece& signature) { | 229 const base::StringPiece& signature) { |
234 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestDsaPublicKeyFile)); | 230 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestDsaPublicKeyFile)); |
235 if (!pkey.get()) | 231 if (!pkey.get()) |
236 return false; | 232 return false; |
237 | 233 |
238 ScopedDSA pub_key(EVP_PKEY_get1_DSA(pkey.get())); | 234 ScopedDSA pub_key(EVP_PKEY_get1_DSA(pkey.get())); |
239 if (!pub_key.get()) { | 235 if (!pub_key.get()) { |
240 LOG(ERROR) << "Could not get DSA public key: " | 236 LOG(ERROR) << "Could not get DSA public key: " << GetOpenSSLErrorString(); |
241 << GetOpenSSLErrorString(); | |
242 return false; | 237 return false; |
243 } | 238 } |
244 | 239 |
245 const unsigned char* digest = | 240 const unsigned char* digest = |
246 reinterpret_cast<const unsigned char*>(message.data()); | 241 reinterpret_cast<const unsigned char*>(message.data()); |
247 int digest_len = static_cast<int>(message.size()); | 242 int digest_len = static_cast<int>(message.size()); |
248 const unsigned char* sigbuf = | 243 const unsigned char* sigbuf = |
249 reinterpret_cast<const unsigned char*>(signature.data()); | 244 reinterpret_cast<const unsigned char*>(signature.data()); |
250 int siglen = static_cast<int>(signature.size()); | 245 int siglen = static_cast<int>(signature.size()); |
251 | 246 |
252 int ret = DSA_verify( | 247 int ret = DSA_verify(0, digest, digest_len, sigbuf, siglen, pub_key.get()); |
253 0, digest, digest_len, sigbuf, siglen, pub_key.get()); | |
254 if (ret != 1) { | 248 if (ret != 1) { |
255 LOG(ERROR) << "DSA_verify() failed: " << GetOpenSSLErrorString(); | 249 LOG(ERROR) << "DSA_verify() failed: " << GetOpenSSLErrorString(); |
256 return false; | 250 return false; |
257 } | 251 } |
258 return true; | 252 return true; |
259 } | 253 } |
260 | 254 |
261 const char kTestEcdsaKeyFile[] = "android-test-key-ecdsa.pem"; | 255 const char kTestEcdsaKeyFile[] = "android-test-key-ecdsa.pem"; |
262 const char kTestEcdsaPublicKeyFile[] = "android-test-key-ecdsa-public.pem"; | 256 const char kTestEcdsaPublicKeyFile[] = "android-test-key-ecdsa-public.pem"; |
263 | 257 |
(...skipping 13 matching lines...) Expand all Loading... |
277 // random elements in the signature, it is not possible to compare | 271 // random elements in the signature, it is not possible to compare |
278 // signature bits directly. However, one can use the public key | 272 // signature bits directly. However, one can use the public key |
279 // to do the check. | 273 // to do the check. |
280 bool VerifyTestECDSASignature(const base::StringPiece& message, | 274 bool VerifyTestECDSASignature(const base::StringPiece& message, |
281 const base::StringPiece& signature) { | 275 const base::StringPiece& signature) { |
282 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestEcdsaPublicKeyFile)); | 276 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestEcdsaPublicKeyFile)); |
283 if (!pkey.get()) | 277 if (!pkey.get()) |
284 return false; | 278 return false; |
285 ScopedEC_KEY pub_key(EVP_PKEY_get1_EC_KEY(pkey.get())); | 279 ScopedEC_KEY pub_key(EVP_PKEY_get1_EC_KEY(pkey.get())); |
286 if (!pub_key.get()) { | 280 if (!pub_key.get()) { |
287 LOG(ERROR) << "Could not get ECDSA public key: " | 281 LOG(ERROR) << "Could not get ECDSA public key: " << GetOpenSSLErrorString(); |
288 << GetOpenSSLErrorString(); | |
289 return false; | 282 return false; |
290 } | 283 } |
291 | 284 |
292 const unsigned char* digest = | 285 const unsigned char* digest = |
293 reinterpret_cast<const unsigned char*>(message.data()); | 286 reinterpret_cast<const unsigned char*>(message.data()); |
294 int digest_len = static_cast<int>(message.size()); | 287 int digest_len = static_cast<int>(message.size()); |
295 const unsigned char* sigbuf = | 288 const unsigned char* sigbuf = |
296 reinterpret_cast<const unsigned char*>(signature.data()); | 289 reinterpret_cast<const unsigned char*>(signature.data()); |
297 int siglen = static_cast<int>(signature.size()); | 290 int siglen = static_cast<int>(signature.size()); |
298 | 291 |
299 int ret = ECDSA_verify( | 292 int ret = ECDSA_verify(0, digest, digest_len, sigbuf, siglen, pub_key.get()); |
300 0, digest, digest_len, sigbuf, siglen, pub_key.get()); | |
301 if (ret != 1) { | 293 if (ret != 1) { |
302 LOG(ERROR) << "ECDSA_verify() failed: " << GetOpenSSLErrorString(); | 294 LOG(ERROR) << "ECDSA_verify() failed: " << GetOpenSSLErrorString(); |
303 return false; | 295 return false; |
304 } | 296 } |
305 return true; | 297 return true; |
306 } | 298 } |
307 | 299 |
308 // Sign a message with OpenSSL, return the result as a string. | 300 // Sign a message with OpenSSL, return the result as a string. |
309 // |message| is the message to be signed. | 301 // |message| is the message to be signed. |
310 // |openssl_key| is an OpenSSL EVP_PKEY to use. | 302 // |openssl_key| is an OpenSSL EVP_PKEY to use. |
311 // |result| receives the result. | 303 // |result| receives the result. |
312 // Returns true on success, false otherwise. | 304 // Returns true on success, false otherwise. |
313 bool SignWithOpenSSL(const base::StringPiece& message, | 305 bool SignWithOpenSSL(const base::StringPiece& message, |
314 EVP_PKEY* openssl_key, | 306 EVP_PKEY* openssl_key, |
315 std::string* result) { | 307 std::string* result) { |
316 const unsigned char* digest = | 308 const unsigned char* digest = |
317 reinterpret_cast<const unsigned char*>(message.data()); | 309 reinterpret_cast<const unsigned char*>(message.data()); |
318 unsigned int digest_len = static_cast<unsigned int>(message.size()); | 310 unsigned int digest_len = static_cast<unsigned int>(message.size()); |
319 std::string signature; | 311 std::string signature; |
320 size_t signature_size; | 312 size_t signature_size; |
321 size_t max_signature_size; | 313 size_t max_signature_size; |
322 int key_type = EVP_PKEY_id(openssl_key); | 314 int key_type = EVP_PKEY_id(openssl_key); |
323 switch (key_type) { | 315 switch (key_type) { |
324 case EVP_PKEY_RSA: | 316 case EVP_PKEY_RSA: { |
325 { | |
326 ScopedRSA rsa(EVP_PKEY_get1_RSA(openssl_key)); | 317 ScopedRSA rsa(EVP_PKEY_get1_RSA(openssl_key)); |
327 if (!rsa.get()) { | 318 if (!rsa.get()) { |
328 LOG(ERROR) << "Could not get RSA from EVP_PKEY: " | 319 LOG(ERROR) << "Could not get RSA from EVP_PKEY: " |
329 << GetOpenSSLErrorString(); | 320 << GetOpenSSLErrorString(); |
330 return false; | 321 return false; |
331 } | 322 } |
332 // With RSA, the signature will always be RSA_size() bytes. | 323 // With RSA, the signature will always be RSA_size() bytes. |
333 max_signature_size = static_cast<size_t>(RSA_size(rsa.get())); | 324 max_signature_size = static_cast<size_t>(RSA_size(rsa.get())); |
334 unsigned char* p = OpenSSLWriteInto(&signature, | 325 unsigned char* p = OpenSSLWriteInto(&signature, max_signature_size); |
335 max_signature_size); | |
336 unsigned int p_len = 0; | 326 unsigned int p_len = 0; |
337 int ret = RSA_sign( | 327 int ret = |
338 NID_md5_sha1, digest, digest_len, p, &p_len, rsa.get()); | 328 RSA_sign(NID_md5_sha1, digest, digest_len, p, &p_len, rsa.get()); |
339 if (ret != 1) { | 329 if (ret != 1) { |
340 LOG(ERROR) << "RSA_sign() failed: " << GetOpenSSLErrorString(); | 330 LOG(ERROR) << "RSA_sign() failed: " << GetOpenSSLErrorString(); |
341 return false; | 331 return false; |
342 } | 332 } |
343 signature_size = static_cast<size_t>(p_len); | 333 signature_size = static_cast<size_t>(p_len); |
344 break; | 334 break; |
345 } | 335 } |
346 case EVP_PKEY_DSA: | 336 case EVP_PKEY_DSA: { |
347 { | |
348 ScopedDSA dsa(EVP_PKEY_get1_DSA(openssl_key)); | 337 ScopedDSA dsa(EVP_PKEY_get1_DSA(openssl_key)); |
349 if (!dsa.get()) { | 338 if (!dsa.get()) { |
350 LOG(ERROR) << "Could not get DSA from EVP_PKEY: " | 339 LOG(ERROR) << "Could not get DSA from EVP_PKEY: " |
351 << GetOpenSSLErrorString(); | 340 << GetOpenSSLErrorString(); |
352 return false; | 341 return false; |
353 } | 342 } |
354 // Note, the actual signature can be smaller than DSA_size() | 343 // Note, the actual signature can be smaller than DSA_size() |
355 max_signature_size = static_cast<size_t>(DSA_size(dsa.get())); | 344 max_signature_size = static_cast<size_t>(DSA_size(dsa.get())); |
356 unsigned char* p = OpenSSLWriteInto(&signature, | 345 unsigned char* p = OpenSSLWriteInto(&signature, max_signature_size); |
357 max_signature_size); | |
358 unsigned int p_len = 0; | 346 unsigned int p_len = 0; |
359 // Note: first parameter is ignored by function. | 347 // Note: first parameter is ignored by function. |
360 int ret = DSA_sign(0, digest, digest_len, p, &p_len, dsa.get()); | 348 int ret = DSA_sign(0, digest, digest_len, p, &p_len, dsa.get()); |
361 if (ret != 1) { | 349 if (ret != 1) { |
362 LOG(ERROR) << "DSA_sign() failed: " << GetOpenSSLErrorString(); | 350 LOG(ERROR) << "DSA_sign() failed: " << GetOpenSSLErrorString(); |
363 return false; | 351 return false; |
364 } | 352 } |
365 signature_size = static_cast<size_t>(p_len); | 353 signature_size = static_cast<size_t>(p_len); |
366 break; | 354 break; |
367 } | 355 } |
368 case EVP_PKEY_EC: | 356 case EVP_PKEY_EC: { |
369 { | |
370 ScopedEC_KEY ecdsa(EVP_PKEY_get1_EC_KEY(openssl_key)); | 357 ScopedEC_KEY ecdsa(EVP_PKEY_get1_EC_KEY(openssl_key)); |
371 if (!ecdsa.get()) { | 358 if (!ecdsa.get()) { |
372 LOG(ERROR) << "Could not get EC_KEY from EVP_PKEY: " | 359 LOG(ERROR) << "Could not get EC_KEY from EVP_PKEY: " |
373 << GetOpenSSLErrorString(); | 360 << GetOpenSSLErrorString(); |
374 return false; | 361 return false; |
375 } | 362 } |
376 // Note, the actual signature can be smaller than ECDSA_size() | 363 // Note, the actual signature can be smaller than ECDSA_size() |
377 max_signature_size = ECDSA_size(ecdsa.get()); | 364 max_signature_size = ECDSA_size(ecdsa.get()); |
378 unsigned char* p = OpenSSLWriteInto(&signature, | 365 unsigned char* p = OpenSSLWriteInto(&signature, max_signature_size); |
379 max_signature_size); | |
380 unsigned int p_len = 0; | 366 unsigned int p_len = 0; |
381 // Note: first parameter is ignored by function. | 367 // Note: first parameter is ignored by function. |
382 int ret = ECDSA_sign( | 368 int ret = ECDSA_sign(0, digest, digest_len, p, &p_len, ecdsa.get()); |
383 0, digest, digest_len, p, &p_len, ecdsa.get()); | |
384 if (ret != 1) { | 369 if (ret != 1) { |
385 LOG(ERROR) << "ECDSA_sign() fialed: " << GetOpenSSLErrorString(); | 370 LOG(ERROR) << "ECDSA_sign() fialed: " << GetOpenSSLErrorString(); |
386 return false; | 371 return false; |
387 } | 372 } |
388 signature_size = static_cast<size_t>(p_len); | 373 signature_size = static_cast<size_t>(p_len); |
389 break; | 374 break; |
390 } | 375 } |
391 default: | 376 default: |
392 LOG(WARNING) << "Invalid OpenSSL key type: " << key_type; | 377 LOG(WARNING) << "Invalid OpenSSL key type: " << key_type; |
393 return false; | 378 return false; |
394 } | 379 } |
395 | 380 |
396 if (signature_size == 0) { | 381 if (signature_size == 0) { |
397 LOG(ERROR) << "Signature is empty!"; | 382 LOG(ERROR) << "Signature is empty!"; |
398 return false; | 383 return false; |
399 } | 384 } |
400 if (signature_size > max_signature_size) { | 385 if (signature_size > max_signature_size) { |
401 LOG(ERROR) << "Signature size mismatch, actual " << signature_size | 386 LOG(ERROR) << "Signature size mismatch, actual " << signature_size |
402 << ", expected <= " << max_signature_size; | 387 << ", expected <= " << max_signature_size; |
403 return false; | 388 return false; |
404 } | 389 } |
405 signature.resize(signature_size); | 390 signature.resize(signature_size); |
406 result->swap(signature); | 391 result->swap(signature); |
407 return true; | 392 return true; |
408 } | 393 } |
409 | 394 |
410 // Check that a generated signature for a given message matches | 395 // Check that a generated signature for a given message matches |
411 // OpenSSL output byte-by-byte. | 396 // OpenSSL output byte-by-byte. |
412 // |message| is the input message. | 397 // |message| is the input message. |
413 // |signature| is the generated signature for the message. | 398 // |signature| is the generated signature for the message. |
414 // |openssl_key| is a raw EVP_PKEY for the same private key than the | 399 // |openssl_key| is a raw EVP_PKEY for the same private key than the |
415 // one which was used to generate the signature. | 400 // one which was used to generate the signature. |
416 // Returns true on success, false otherwise. | 401 // Returns true on success, false otherwise. |
417 bool CompareSignatureWithOpenSSL(const base::StringPiece& message, | 402 bool CompareSignatureWithOpenSSL(const base::StringPiece& message, |
418 const base::StringPiece& signature, | 403 const base::StringPiece& signature, |
419 EVP_PKEY* openssl_key) { | 404 EVP_PKEY* openssl_key) { |
420 std::string openssl_signature; | 405 std::string openssl_signature; |
421 SignWithOpenSSL(message, openssl_key, &openssl_signature); | 406 SignWithOpenSSL(message, openssl_key, &openssl_signature); |
422 | 407 |
423 if (signature.size() != openssl_signature.size()) { | 408 if (signature.size() != openssl_signature.size()) { |
424 LOG(ERROR) << "Signature size mismatch, actual " | 409 LOG(ERROR) << "Signature size mismatch, actual " << signature.size() |
425 << signature.size() << ", expected " | 410 << ", expected " << openssl_signature.size(); |
426 << openssl_signature.size(); | |
427 return false; | 411 return false; |
428 } | 412 } |
429 for (size_t n = 0; n < signature.size(); ++n) { | 413 for (size_t n = 0; n < signature.size(); ++n) { |
430 if (openssl_signature[n] != signature[n]) { | 414 if (openssl_signature[n] != signature[n]) { |
431 LOG(ERROR) << "Signature byte mismatch at index " << n | 415 LOG(ERROR) << "Signature byte mismatch at index " << n << "actual " |
432 << "actual " << signature[n] << ", expected " | 416 << signature[n] << ", expected " << openssl_signature[n]; |
433 << openssl_signature[n]; | 417 LOG(ERROR) << "Actual signature : " << base::HexEncode(signature.data(), |
434 LOG(ERROR) << "Actual signature : " | 418 signature.size()); |
435 << base::HexEncode(signature.data(), signature.size()); | 419 LOG(ERROR) << "Expected signature: " << base::HexEncode( |
436 LOG(ERROR) << "Expected signature: " | 420 openssl_signature.data(), |
437 << base::HexEncode(openssl_signature.data(), | 421 openssl_signature.size()); |
438 openssl_signature.size()); | |
439 return false; | 422 return false; |
440 } | 423 } |
441 } | 424 } |
442 return true; | 425 return true; |
443 } | 426 } |
444 | 427 |
445 // Sign a message with our platform API. | 428 // Sign a message with our platform API. |
446 // | 429 // |
447 // |android_key| is a JNI reference to the platform PrivateKey object. | 430 // |android_key| is a JNI reference to the platform PrivateKey object. |
448 // |openssl_key| is a pointer to an OpenSSL key object for the exact | 431 // |openssl_key| is a pointer to an OpenSSL key object for the exact |
449 // same key content. | 432 // same key content. |
450 // |message| is a message. | 433 // |message| is a message. |
451 // |result| will receive the result. | 434 // |result| will receive the result. |
452 void DoKeySigning(jobject android_key, | 435 void DoKeySigning(jobject android_key, |
453 EVP_PKEY* openssl_key, | 436 EVP_PKEY* openssl_key, |
454 const base::StringPiece& message, | 437 const base::StringPiece& message, |
455 std::string* result) { | 438 std::string* result) { |
456 // First, get the platform signature. | 439 // First, get the platform signature. |
457 std::vector<uint8> android_signature; | 440 std::vector<uint8> android_signature; |
458 ASSERT_TRUE( | 441 ASSERT_TRUE( |
459 RawSignDigestWithPrivateKey(android_key, | 442 RawSignDigestWithPrivateKey(android_key, message, &android_signature)); |
460 message, | |
461 &android_signature)); | |
462 | 443 |
463 result->assign( | 444 result->assign(reinterpret_cast<const char*>(&android_signature[0]), |
464 reinterpret_cast<const char*>(&android_signature[0]), | 445 android_signature.size()); |
465 android_signature.size()); | |
466 } | 446 } |
467 | 447 |
468 // Sign a message with our OpenSSL EVP_PKEY wrapper around platform | 448 // Sign a message with our OpenSSL EVP_PKEY wrapper around platform |
469 // APIS. | 449 // APIS. |
470 // | 450 // |
471 // |android_key| is a JNI reference to the platform PrivateKey object. | 451 // |android_key| is a JNI reference to the platform PrivateKey object. |
472 // |openssl_key| is a pointer to an OpenSSL key object for the exact | 452 // |openssl_key| is a pointer to an OpenSSL key object for the exact |
473 // same key content. | 453 // same key content. |
474 // |message| is a message. | 454 // |message| is a message. |
475 // |result| will receive the result. | 455 // |result| will receive the result. |
476 void DoKeySigningWithWrapper(EVP_PKEY* wrapper_key, | 456 void DoKeySigningWithWrapper(EVP_PKEY* wrapper_key, |
477 EVP_PKEY* openssl_key, | 457 EVP_PKEY* openssl_key, |
478 const base::StringPiece& message, | 458 const base::StringPiece& message, |
479 std::string* result) { | 459 std::string* result) { |
480 // First, get the platform signature. | 460 // First, get the platform signature. |
481 std::string wrapper_signature; | 461 std::string wrapper_signature; |
482 SignWithOpenSSL(message, wrapper_key, &wrapper_signature); | 462 SignWithOpenSSL(message, wrapper_key, &wrapper_signature); |
483 ASSERT_NE(0U, wrapper_signature.size()); | 463 ASSERT_NE(0U, wrapper_signature.size()); |
484 | 464 |
485 result->assign( | 465 result->assign(reinterpret_cast<const char*>(&wrapper_signature[0]), |
486 reinterpret_cast<const char*>(&wrapper_signature[0]), | 466 wrapper_signature.size()); |
487 wrapper_signature.size()); | |
488 } | 467 } |
489 | 468 |
490 } // namespace | 469 } // namespace |
491 | 470 |
492 TEST(AndroidKeyStore,GetRSAKeyModulus) { | 471 TEST(AndroidKeyStore, GetRSAKeyModulus) { |
493 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 472 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
494 InitEnv(); | 473 InitEnv(); |
495 | 474 |
496 // Load the test RSA key. | 475 // Load the test RSA key. |
497 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestRsaKeyFile)); | 476 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestRsaKeyFile)); |
498 ASSERT_TRUE(pkey.get()); | 477 ASSERT_TRUE(pkey.get()); |
499 | 478 |
500 // Convert it to encoded PKCS#8 bytes. | 479 // Convert it to encoded PKCS#8 bytes. |
501 std::string pkcs8_data; | 480 std::string pkcs8_data; |
502 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); | 481 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); |
503 | 482 |
504 // Create platform PrivateKey object from it. | 483 // Create platform PrivateKey object from it. |
505 ScopedJava key_java = GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_RSA, | 484 ScopedJava key_java = |
506 pkcs8_data); | 485 GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_RSA, pkcs8_data); |
507 ASSERT_FALSE(key_java.is_null()); | 486 ASSERT_FALSE(key_java.is_null()); |
508 | 487 |
509 // Retrieve the corresponding modulus through JNI | 488 // Retrieve the corresponding modulus through JNI |
510 std::vector<uint8> modulus_java; | 489 std::vector<uint8> modulus_java; |
511 ASSERT_TRUE(GetRSAKeyModulus(key_java.obj(), &modulus_java)); | 490 ASSERT_TRUE(GetRSAKeyModulus(key_java.obj(), &modulus_java)); |
512 | 491 |
513 // Create an OpenSSL BIGNUM from it. | 492 // Create an OpenSSL BIGNUM from it. |
514 ScopedBIGNUM bn( | 493 ScopedBIGNUM bn( |
515 BN_bin2bn( | 494 BN_bin2bn(reinterpret_cast<const unsigned char*>(&modulus_java[0]), |
516 reinterpret_cast<const unsigned char*>(&modulus_java[0]), | 495 static_cast<int>(modulus_java.size()), |
517 static_cast<int>(modulus_java.size()), | 496 NULL)); |
518 NULL)); | |
519 ASSERT_TRUE(bn.get()); | 497 ASSERT_TRUE(bn.get()); |
520 | 498 |
521 // Compare it to the one in the RSA key, they must be identical. | 499 // Compare it to the one in the RSA key, they must be identical. |
522 ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey.get())); | 500 ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey.get())); |
523 ASSERT_TRUE(rsa.get()) << GetOpenSSLErrorString(); | 501 ASSERT_TRUE(rsa.get()) << GetOpenSSLErrorString(); |
524 | 502 |
525 ASSERT_EQ(0, BN_cmp(bn.get(), rsa.get()->n)); | 503 ASSERT_EQ(0, BN_cmp(bn.get(), rsa.get()->n)); |
526 } | 504 } |
527 | 505 |
528 TEST(AndroidKeyStore,GetDSAKeyParamQ) { | 506 TEST(AndroidKeyStore, GetDSAKeyParamQ) { |
529 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 507 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
530 InitEnv(); | 508 InitEnv(); |
531 | 509 |
532 // Load the test DSA key. | 510 // Load the test DSA key. |
533 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestDsaKeyFile)); | 511 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestDsaKeyFile)); |
534 ASSERT_TRUE(pkey.get()); | 512 ASSERT_TRUE(pkey.get()); |
535 | 513 |
536 // Convert it to encoded PKCS#8 bytes. | 514 // Convert it to encoded PKCS#8 bytes. |
537 std::string pkcs8_data; | 515 std::string pkcs8_data; |
538 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); | 516 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); |
539 | 517 |
540 // Create platform PrivateKey object from it. | 518 // Create platform PrivateKey object from it. |
541 ScopedJava key_java = GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_DSA, | 519 ScopedJava key_java = |
542 pkcs8_data); | 520 GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_DSA, pkcs8_data); |
543 ASSERT_FALSE(key_java.is_null()); | 521 ASSERT_FALSE(key_java.is_null()); |
544 | 522 |
545 // Retrieve the corresponding Q parameter through JNI | 523 // Retrieve the corresponding Q parameter through JNI |
546 std::vector<uint8> q_java; | 524 std::vector<uint8> q_java; |
547 ASSERT_TRUE(GetDSAKeyParamQ(key_java.obj(), &q_java)); | 525 ASSERT_TRUE(GetDSAKeyParamQ(key_java.obj(), &q_java)); |
548 | 526 |
549 // Create an OpenSSL BIGNUM from it. | 527 // Create an OpenSSL BIGNUM from it. |
550 ScopedBIGNUM bn( | 528 ScopedBIGNUM bn(BN_bin2bn(reinterpret_cast<const unsigned char*>(&q_java[0]), |
551 BN_bin2bn( | 529 static_cast<int>(q_java.size()), |
552 reinterpret_cast<const unsigned char*>(&q_java[0]), | 530 NULL)); |
553 static_cast<int>(q_java.size()), | |
554 NULL)); | |
555 ASSERT_TRUE(bn.get()); | 531 ASSERT_TRUE(bn.get()); |
556 | 532 |
557 // Compare it to the one in the RSA key, they must be identical. | 533 // Compare it to the one in the RSA key, they must be identical. |
558 ScopedDSA dsa(EVP_PKEY_get1_DSA(pkey.get())); | 534 ScopedDSA dsa(EVP_PKEY_get1_DSA(pkey.get())); |
559 ASSERT_TRUE(dsa.get()) << GetOpenSSLErrorString(); | 535 ASSERT_TRUE(dsa.get()) << GetOpenSSLErrorString(); |
560 | 536 |
561 ASSERT_EQ(0, BN_cmp(bn.get(), dsa.get()->q)); | 537 ASSERT_EQ(0, BN_cmp(bn.get(), dsa.get()->q)); |
562 } | 538 } |
563 | 539 |
564 TEST(AndroidKeyStore,GetPrivateKeyTypeRSA) { | 540 TEST(AndroidKeyStore, GetPrivateKeyTypeRSA) { |
565 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 541 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
566 | 542 |
567 ScopedJava rsa_key = GetRSATestKeyJava(); | 543 ScopedJava rsa_key = GetRSATestKeyJava(); |
568 ASSERT_FALSE(rsa_key.is_null()); | 544 ASSERT_FALSE(rsa_key.is_null()); |
569 EXPECT_EQ(PRIVATE_KEY_TYPE_RSA, | 545 EXPECT_EQ(PRIVATE_KEY_TYPE_RSA, GetPrivateKeyType(rsa_key.obj())); |
570 GetPrivateKeyType(rsa_key.obj())); | |
571 } | 546 } |
572 | 547 |
573 TEST(AndroidKeyStore,SignWithPrivateKeyRSA) { | 548 TEST(AndroidKeyStore, SignWithPrivateKeyRSA) { |
574 ScopedJava rsa_key = GetRSATestKeyJava(); | 549 ScopedJava rsa_key = GetRSATestKeyJava(); |
575 ASSERT_FALSE(rsa_key.is_null()); | 550 ASSERT_FALSE(rsa_key.is_null()); |
576 | 551 |
577 if (IsOnAndroidOlderThan_4_2()) { | 552 if (IsOnAndroidOlderThan_4_2()) { |
578 LOG(INFO) << "This test can't run on Android < 4.2"; | 553 LOG(INFO) << "This test can't run on Android < 4.2"; |
579 return; | 554 return; |
580 } | 555 } |
581 | 556 |
582 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); | 557 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); |
583 ASSERT_TRUE(openssl_key.get()); | 558 ASSERT_TRUE(openssl_key.get()); |
584 | 559 |
585 std::string message = kTestRsaHash; | 560 std::string message = kTestRsaHash; |
586 ASSERT_EQ(36U, message.size()); | 561 ASSERT_EQ(36U, message.size()); |
587 | 562 |
588 std::string signature; | 563 std::string signature; |
589 DoKeySigning(rsa_key.obj(), openssl_key.get(), message, &signature); | 564 DoKeySigning(rsa_key.obj(), openssl_key.get(), message, &signature); |
590 ASSERT_TRUE( | 565 ASSERT_TRUE( |
591 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); | 566 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); |
592 // All good. | 567 // All good. |
593 } | 568 } |
594 | 569 |
595 TEST(AndroidKeyStore,SignWithWrapperKeyRSA) { | 570 TEST(AndroidKeyStore, SignWithWrapperKeyRSA) { |
596 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 571 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
597 | 572 |
598 ScopedJava rsa_key = GetRSATestKeyJava(); | 573 ScopedJava rsa_key = GetRSATestKeyJava(); |
599 ASSERT_FALSE(rsa_key.is_null()); | 574 ASSERT_FALSE(rsa_key.is_null()); |
600 | 575 |
601 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(rsa_key.obj())); | 576 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(rsa_key.obj())); |
602 ASSERT_TRUE(wrapper_key.get() != NULL); | 577 ASSERT_TRUE(wrapper_key.get() != NULL); |
603 | 578 |
604 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); | 579 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); |
605 ASSERT_TRUE(openssl_key.get()); | 580 ASSERT_TRUE(openssl_key.get()); |
606 | 581 |
607 // Check that RSA_size() works properly on the wrapper key. | 582 // Check that RSA_size() works properly on the wrapper key. |
608 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), | 583 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), EVP_PKEY_size(wrapper_key.get())); |
609 EVP_PKEY_size(wrapper_key.get())); | |
610 | 584 |
611 // Message size must be 36 for RSA_sign(NID_md5_sha1,...) to return | 585 // Message size must be 36 for RSA_sign(NID_md5_sha1,...) to return |
612 // without an error. | 586 // without an error. |
613 std::string message = kTestRsaHash; | 587 std::string message = kTestRsaHash; |
614 ASSERT_EQ(36U, message.size()); | 588 ASSERT_EQ(36U, message.size()); |
615 | 589 |
616 std::string signature; | 590 std::string signature; |
617 DoKeySigningWithWrapper(wrapper_key.get(), | 591 DoKeySigningWithWrapper( |
618 openssl_key.get(), | 592 wrapper_key.get(), openssl_key.get(), message, &signature); |
619 message, | |
620 &signature); | |
621 ASSERT_TRUE( | 593 ASSERT_TRUE( |
622 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); | 594 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); |
623 } | 595 } |
624 | 596 |
625 TEST(AndroidKeyStore,GetPrivateKeyTypeDSA) { | 597 TEST(AndroidKeyStore, GetPrivateKeyTypeDSA) { |
626 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 598 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
627 | 599 |
628 ScopedJava dsa_key = GetDSATestKeyJava(); | 600 ScopedJava dsa_key = GetDSATestKeyJava(); |
629 ASSERT_FALSE(dsa_key.is_null()); | 601 ASSERT_FALSE(dsa_key.is_null()); |
630 EXPECT_EQ(PRIVATE_KEY_TYPE_DSA, | 602 EXPECT_EQ(PRIVATE_KEY_TYPE_DSA, GetPrivateKeyType(dsa_key.obj())); |
631 GetPrivateKeyType(dsa_key.obj())); | |
632 } | 603 } |
633 | 604 |
634 TEST(AndroidKeyStore,SignWithPrivateKeyDSA) { | 605 TEST(AndroidKeyStore, SignWithPrivateKeyDSA) { |
635 ScopedJava dsa_key = GetDSATestKeyJava(); | 606 ScopedJava dsa_key = GetDSATestKeyJava(); |
636 ASSERT_FALSE(dsa_key.is_null()); | 607 ASSERT_FALSE(dsa_key.is_null()); |
637 | 608 |
638 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); | 609 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); |
639 ASSERT_TRUE(openssl_key.get()); | 610 ASSERT_TRUE(openssl_key.get()); |
640 | 611 |
641 std::string message = kTestDsaHash; | 612 std::string message = kTestDsaHash; |
642 ASSERT_EQ(20U, message.size()); | 613 ASSERT_EQ(20U, message.size()); |
643 | 614 |
644 std::string signature; | 615 std::string signature; |
645 DoKeySigning(dsa_key.obj(), openssl_key.get(), message, &signature); | 616 DoKeySigning(dsa_key.obj(), openssl_key.get(), message, &signature); |
646 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); | 617 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); |
647 } | 618 } |
648 | 619 |
649 TEST(AndroidKeyStore,SignWithWrapperKeyDSA) { | 620 TEST(AndroidKeyStore, SignWithWrapperKeyDSA) { |
650 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 621 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
651 | 622 |
652 ScopedJava dsa_key = GetDSATestKeyJava(); | 623 ScopedJava dsa_key = GetDSATestKeyJava(); |
653 ASSERT_FALSE(dsa_key.is_null()); | 624 ASSERT_FALSE(dsa_key.is_null()); |
654 | 625 |
655 ScopedEVP_PKEY wrapper_key( | 626 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(dsa_key.obj())); |
656 GetOpenSSLPrivateKeyWrapper(dsa_key.obj())); | |
657 ASSERT_TRUE(wrapper_key.get()); | 627 ASSERT_TRUE(wrapper_key.get()); |
658 | 628 |
659 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); | 629 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); |
660 ASSERT_TRUE(openssl_key.get()); | 630 ASSERT_TRUE(openssl_key.get()); |
661 | 631 |
662 // Check that DSA_size() works correctly on the wrapper. | 632 // Check that DSA_size() works correctly on the wrapper. |
663 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), | 633 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), EVP_PKEY_size(wrapper_key.get())); |
664 EVP_PKEY_size(wrapper_key.get())); | |
665 | 634 |
666 std::string message = kTestDsaHash; | 635 std::string message = kTestDsaHash; |
667 std::string signature; | 636 std::string signature; |
668 DoKeySigningWithWrapper(wrapper_key.get(), | 637 DoKeySigningWithWrapper( |
669 openssl_key.get(), | 638 wrapper_key.get(), openssl_key.get(), message, &signature); |
670 message, | |
671 &signature); | |
672 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); | 639 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); |
673 } | 640 } |
674 | 641 |
675 TEST(AndroidKeyStore,GetPrivateKeyTypeECDSA) { | 642 TEST(AndroidKeyStore, GetPrivateKeyTypeECDSA) { |
676 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 643 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
677 | 644 |
678 ScopedJava ecdsa_key = GetECDSATestKeyJava(); | 645 ScopedJava ecdsa_key = GetECDSATestKeyJava(); |
679 ASSERT_FALSE(ecdsa_key.is_null()); | 646 ASSERT_FALSE(ecdsa_key.is_null()); |
680 EXPECT_EQ(PRIVATE_KEY_TYPE_ECDSA, | 647 EXPECT_EQ(PRIVATE_KEY_TYPE_ECDSA, GetPrivateKeyType(ecdsa_key.obj())); |
681 GetPrivateKeyType(ecdsa_key.obj())); | |
682 } | 648 } |
683 | 649 |
684 TEST(AndroidKeyStore,SignWithPrivateKeyECDSA) { | 650 TEST(AndroidKeyStore, SignWithPrivateKeyECDSA) { |
685 ScopedJava ecdsa_key = GetECDSATestKeyJava(); | 651 ScopedJava ecdsa_key = GetECDSATestKeyJava(); |
686 ASSERT_FALSE(ecdsa_key.is_null()); | 652 ASSERT_FALSE(ecdsa_key.is_null()); |
687 | 653 |
688 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); | 654 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); |
689 ASSERT_TRUE(openssl_key.get()); | 655 ASSERT_TRUE(openssl_key.get()); |
690 | 656 |
691 std::string message = kTestEcdsaHash; | 657 std::string message = kTestEcdsaHash; |
692 std::string signature; | 658 std::string signature; |
693 DoKeySigning(ecdsa_key.obj(), openssl_key.get(), message, &signature); | 659 DoKeySigning(ecdsa_key.obj(), openssl_key.get(), message, &signature); |
694 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); | 660 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); |
695 } | 661 } |
696 | 662 |
697 TEST(AndroidKeyStore, SignWithWrapperKeyECDSA) { | 663 TEST(AndroidKeyStore, SignWithWrapperKeyECDSA) { |
698 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 664 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
699 | 665 |
700 ScopedJava ecdsa_key = GetECDSATestKeyJava(); | 666 ScopedJava ecdsa_key = GetECDSATestKeyJava(); |
701 ASSERT_FALSE(ecdsa_key.is_null()); | 667 ASSERT_FALSE(ecdsa_key.is_null()); |
702 | 668 |
703 ScopedEVP_PKEY wrapper_key( | 669 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(ecdsa_key.obj())); |
704 GetOpenSSLPrivateKeyWrapper(ecdsa_key.obj())); | |
705 ASSERT_TRUE(wrapper_key.get()); | 670 ASSERT_TRUE(wrapper_key.get()); |
706 | 671 |
707 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); | 672 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); |
708 ASSERT_TRUE(openssl_key.get()); | 673 ASSERT_TRUE(openssl_key.get()); |
709 | 674 |
710 // Check that ECDSA size works correctly on the wrapper. | 675 // Check that ECDSA size works correctly on the wrapper. |
711 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), | 676 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), EVP_PKEY_size(wrapper_key.get())); |
712 EVP_PKEY_size(wrapper_key.get())); | |
713 | 677 |
714 std::string message = kTestEcdsaHash; | 678 std::string message = kTestEcdsaHash; |
715 std::string signature; | 679 std::string signature; |
716 DoKeySigningWithWrapper(wrapper_key.get(), | 680 DoKeySigningWithWrapper( |
717 openssl_key.get(), | 681 wrapper_key.get(), openssl_key.get(), message, &signature); |
718 message, | |
719 &signature); | |
720 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); | 682 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); |
721 } | 683 } |
722 | 684 |
723 } // namespace android | 685 } // namespace android |
724 } // namespace net | 686 } // namespace net |
OLD | NEW |