| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <openssl/bn.h> | 5 #include <openssl/bn.h> |
| 6 #include <openssl/dsa.h> | 6 #include <openssl/dsa.h> |
| 7 #include <openssl/ecdsa.h> | 7 #include <openssl/ecdsa.h> |
| 8 #include <openssl/err.h> | 8 #include <openssl/err.h> |
| 9 #include <openssl/evp.h> | 9 #include <openssl/evp.h> |
| 10 #include <openssl/pem.h> | 10 #include <openssl/pem.h> |
| (...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 55 namespace android { | 55 namespace android { |
| 56 | 56 |
| 57 namespace { | 57 namespace { |
| 58 | 58 |
| 59 typedef crypto::ScopedOpenSSL<EVP_PKEY, EVP_PKEY_free> ScopedEVP_PKEY; | 59 typedef crypto::ScopedOpenSSL<EVP_PKEY, EVP_PKEY_free> ScopedEVP_PKEY; |
| 60 typedef crypto::ScopedOpenSSL<RSA, RSA_free> ScopedRSA; | 60 typedef crypto::ScopedOpenSSL<RSA, RSA_free> ScopedRSA; |
| 61 typedef crypto::ScopedOpenSSL<DSA, DSA_free> ScopedDSA; | 61 typedef crypto::ScopedOpenSSL<DSA, DSA_free> ScopedDSA; |
| 62 typedef crypto::ScopedOpenSSL<EC_KEY, EC_KEY_free> ScopedEC_KEY; | 62 typedef crypto::ScopedOpenSSL<EC_KEY, EC_KEY_free> ScopedEC_KEY; |
| 63 typedef crypto::ScopedOpenSSL<BIGNUM, BN_free> ScopedBIGNUM; | 63 typedef crypto::ScopedOpenSSL<BIGNUM, BN_free> ScopedBIGNUM; |
| 64 | 64 |
| 65 typedef crypto::ScopedOpenSSL< | 65 typedef crypto::ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free> |
| 66 PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free> | 66 ScopedPKCS8_PRIV_KEY_INFO; |
| 67 ScopedPKCS8_PRIV_KEY_INFO; | |
| 68 | 67 |
| 69 typedef base::android::ScopedJavaLocalRef<jobject> ScopedJava; | 68 typedef base::android::ScopedJavaLocalRef<jobject> ScopedJava; |
| 70 | 69 |
| 71 JNIEnv* InitEnv() { | 70 JNIEnv* InitEnv() { |
| 72 JNIEnv* env = base::android::AttachCurrentThread(); | 71 JNIEnv* env = base::android::AttachCurrentThread(); |
| 73 static bool inited = false; | 72 static bool inited = false; |
| 74 if (!inited) { | 73 if (!inited) { |
| 75 RegisterNativesImpl(env); | 74 RegisterNativesImpl(env); |
| 76 inited = true; | 75 inited = true; |
| 77 } | 76 } |
| (...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 118 base::FilePath certs_dir = GetTestCertsDirectory(); | 117 base::FilePath certs_dir = GetTestCertsDirectory(); |
| 119 base::FilePath file_path = certs_dir.AppendASCII(filename); | 118 base::FilePath file_path = certs_dir.AppendASCII(filename); |
| 120 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); | 119 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); |
| 121 if (!handle.get()) { | 120 if (!handle.get()) { |
| 122 LOG(ERROR) << "Could not open private key file: " << filename; | 121 LOG(ERROR) << "Could not open private key file: " << filename; |
| 123 return NULL; | 122 return NULL; |
| 124 } | 123 } |
| 125 // Assume it is PEM_encoded. Load it as an EVP_PKEY. | 124 // Assume it is PEM_encoded. Load it as an EVP_PKEY. |
| 126 EVP_PKEY* pkey = PEM_read_PrivateKey(handle.get(), NULL, NULL, NULL); | 125 EVP_PKEY* pkey = PEM_read_PrivateKey(handle.get(), NULL, NULL, NULL); |
| 127 if (!pkey) { | 126 if (!pkey) { |
| 128 LOG(ERROR) << "Could not load public key file: " << filename | 127 LOG(ERROR) << "Could not load public key file: " << filename << ", " |
| 129 << ", " << GetOpenSSLErrorString(); | 128 << GetOpenSSLErrorString(); |
| 130 return NULL; | 129 return NULL; |
| 131 } | 130 } |
| 132 return pkey; | 131 return pkey; |
| 133 } | 132 } |
| 134 | 133 |
| 135 // Convert a private key into its PKCS#8 encoded representation. | 134 // Convert a private key into its PKCS#8 encoded representation. |
| 136 // |pkey| is the EVP_PKEY handle for the private key. | 135 // |pkey| is the EVP_PKEY handle for the private key. |
| 137 // |pkcs8| will receive the PKCS#8 bytes. | 136 // |pkcs8| will receive the PKCS#8 bytes. |
| 138 // Returns true on success, false otherwise. | 137 // Returns true on success, false otherwise. |
| 139 bool GetPrivateKeyPkcs8Bytes(const ScopedEVP_PKEY& pkey, | 138 bool GetPrivateKeyPkcs8Bytes(const ScopedEVP_PKEY& pkey, std::string* pkcs8) { |
| 140 std::string* pkcs8) { | |
| 141 // Convert to PKCS#8 object. | 139 // Convert to PKCS#8 object. |
| 142 ScopedPKCS8_PRIV_KEY_INFO p8_info(EVP_PKEY2PKCS8(pkey.get())); | 140 ScopedPKCS8_PRIV_KEY_INFO p8_info(EVP_PKEY2PKCS8(pkey.get())); |
| 143 if (!p8_info.get()) { | 141 if (!p8_info.get()) { |
| 144 LOG(ERROR) << "Can't get PKCS#8 private key from EVP_PKEY: " | 142 LOG(ERROR) << "Can't get PKCS#8 private key from EVP_PKEY: " |
| 145 << GetOpenSSLErrorString(); | 143 << GetOpenSSLErrorString(); |
| 146 return false; | 144 return false; |
| 147 } | 145 } |
| 148 | 146 |
| 149 // Then convert it | 147 // Then convert it |
| 150 int len = i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), NULL); | 148 int len = i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), NULL); |
| 151 unsigned char* p = OpenSSLWriteInto(pkcs8, static_cast<size_t>(len)); | 149 unsigned char* p = OpenSSLWriteInto(pkcs8, static_cast<size_t>(len)); |
| 152 i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), &p); | 150 i2d_PKCS8_PRIV_KEY_INFO(p8_info.get(), &p); |
| 153 return true; | 151 return true; |
| 154 } | 152 } |
| 155 | 153 |
| 156 bool ImportPrivateKeyFileAsPkcs8(const char* filename, | 154 bool ImportPrivateKeyFileAsPkcs8(const char* filename, std::string* pkcs8) { |
| 157 std::string* pkcs8) { | |
| 158 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(filename)); | 155 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(filename)); |
| 159 if (!pkey.get()) | 156 if (!pkey.get()) |
| 160 return false; | 157 return false; |
| 161 return GetPrivateKeyPkcs8Bytes(pkey, pkcs8); | 158 return GetPrivateKeyPkcs8Bytes(pkey, pkcs8); |
| 162 } | 159 } |
| 163 | 160 |
| 164 // Same as ImportPrivateKey, but for public ones. | 161 // Same as ImportPrivateKey, but for public ones. |
| 165 EVP_PKEY* ImportPublicKeyFile(const char* filename) { | 162 EVP_PKEY* ImportPublicKeyFile(const char* filename) { |
| 166 // Load file as PEM data. | 163 // Load file as PEM data. |
| 167 base::FilePath certs_dir = GetTestCertsDirectory(); | 164 base::FilePath certs_dir = GetTestCertsDirectory(); |
| 168 base::FilePath file_path = certs_dir.AppendASCII(filename); | 165 base::FilePath file_path = certs_dir.AppendASCII(filename); |
| 169 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); | 166 ScopedStdioHandle handle(base::OpenFile(file_path, "rb")); |
| 170 if (!handle.get()) { | 167 if (!handle.get()) { |
| 171 LOG(ERROR) << "Could not open public key file: " << filename; | 168 LOG(ERROR) << "Could not open public key file: " << filename; |
| 172 return NULL; | 169 return NULL; |
| 173 } | 170 } |
| 174 EVP_PKEY* pkey = PEM_read_PUBKEY(handle.get(), NULL, NULL, NULL); | 171 EVP_PKEY* pkey = PEM_read_PUBKEY(handle.get(), NULL, NULL, NULL); |
| 175 if (!pkey) { | 172 if (!pkey) { |
| 176 LOG(ERROR) << "Could not load public key file: " << filename | 173 LOG(ERROR) << "Could not load public key file: " << filename << ", " |
| 177 << ", " << GetOpenSSLErrorString(); | 174 << GetOpenSSLErrorString(); |
| 178 return NULL; | 175 return NULL; |
| 179 } | 176 } |
| 180 return pkey; | 177 return pkey; |
| 181 } | 178 } |
| 182 | 179 |
| 183 // Retrieve a JNI local ref from encoded PKCS#8 data. | 180 // Retrieve a JNI local ref from encoded PKCS#8 data. |
| 184 ScopedJava GetPKCS8PrivateKeyJava(PrivateKeyType key_type, | 181 ScopedJava GetPKCS8PrivateKeyJava(PrivateKeyType key_type, |
| 185 const std::string& pkcs8_key) { | 182 const std::string& pkcs8_key) { |
| 186 JNIEnv* env = InitEnv(); | 183 JNIEnv* env = InitEnv(); |
| 187 base::android::ScopedJavaLocalRef<jbyteArray> bytes( | 184 base::android::ScopedJavaLocalRef<jbyteArray> bytes( |
| 188 base::android::ToJavaByteArray( | 185 base::android::ToJavaByteArray( |
| 189 env, | 186 env, |
| 190 reinterpret_cast<const uint8*>(pkcs8_key.data()), | 187 reinterpret_cast<const uint8*>(pkcs8_key.data()), |
| 191 pkcs8_key.size())); | 188 pkcs8_key.size())); |
| 192 | 189 |
| 193 ScopedJava key( | 190 ScopedJava key(Java_AndroidKeyStoreTestUtil_createPrivateKeyFromPKCS8( |
| 194 Java_AndroidKeyStoreTestUtil_createPrivateKeyFromPKCS8( | 191 env, key_type, bytes.obj())); |
| 195 env, key_type, bytes.obj())); | |
| 196 | 192 |
| 197 return key; | 193 return key; |
| 198 } | 194 } |
| 199 | 195 |
| 200 const char kTestRsaKeyFile[] = "android-test-key-rsa.pem"; | 196 const char kTestRsaKeyFile[] = "android-test-key-rsa.pem"; |
| 201 | 197 |
| 202 // The RSA test hash must be 36 bytes exactly. | 198 // The RSA test hash must be 36 bytes exactly. |
| 203 const char kTestRsaHash[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; | 199 const char kTestRsaHash[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; |
| 204 | 200 |
| 205 // Retrieve a JNI local ref for our test RSA key. | 201 // Retrieve a JNI local ref for our test RSA key. |
| (...skipping 24 matching lines...) Expand all Loading... |
| 230 // signature bits directly. However, one can use the public key | 226 // signature bits directly. However, one can use the public key |
| 231 // to do the check. | 227 // to do the check. |
| 232 bool VerifyTestDSASignature(const base::StringPiece& message, | 228 bool VerifyTestDSASignature(const base::StringPiece& message, |
| 233 const base::StringPiece& signature) { | 229 const base::StringPiece& signature) { |
| 234 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestDsaPublicKeyFile)); | 230 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestDsaPublicKeyFile)); |
| 235 if (!pkey.get()) | 231 if (!pkey.get()) |
| 236 return false; | 232 return false; |
| 237 | 233 |
| 238 ScopedDSA pub_key(EVP_PKEY_get1_DSA(pkey.get())); | 234 ScopedDSA pub_key(EVP_PKEY_get1_DSA(pkey.get())); |
| 239 if (!pub_key.get()) { | 235 if (!pub_key.get()) { |
| 240 LOG(ERROR) << "Could not get DSA public key: " | 236 LOG(ERROR) << "Could not get DSA public key: " << GetOpenSSLErrorString(); |
| 241 << GetOpenSSLErrorString(); | |
| 242 return false; | 237 return false; |
| 243 } | 238 } |
| 244 | 239 |
| 245 const unsigned char* digest = | 240 const unsigned char* digest = |
| 246 reinterpret_cast<const unsigned char*>(message.data()); | 241 reinterpret_cast<const unsigned char*>(message.data()); |
| 247 int digest_len = static_cast<int>(message.size()); | 242 int digest_len = static_cast<int>(message.size()); |
| 248 const unsigned char* sigbuf = | 243 const unsigned char* sigbuf = |
| 249 reinterpret_cast<const unsigned char*>(signature.data()); | 244 reinterpret_cast<const unsigned char*>(signature.data()); |
| 250 int siglen = static_cast<int>(signature.size()); | 245 int siglen = static_cast<int>(signature.size()); |
| 251 | 246 |
| 252 int ret = DSA_verify( | 247 int ret = DSA_verify(0, digest, digest_len, sigbuf, siglen, pub_key.get()); |
| 253 0, digest, digest_len, sigbuf, siglen, pub_key.get()); | |
| 254 if (ret != 1) { | 248 if (ret != 1) { |
| 255 LOG(ERROR) << "DSA_verify() failed: " << GetOpenSSLErrorString(); | 249 LOG(ERROR) << "DSA_verify() failed: " << GetOpenSSLErrorString(); |
| 256 return false; | 250 return false; |
| 257 } | 251 } |
| 258 return true; | 252 return true; |
| 259 } | 253 } |
| 260 | 254 |
| 261 const char kTestEcdsaKeyFile[] = "android-test-key-ecdsa.pem"; | 255 const char kTestEcdsaKeyFile[] = "android-test-key-ecdsa.pem"; |
| 262 const char kTestEcdsaPublicKeyFile[] = "android-test-key-ecdsa-public.pem"; | 256 const char kTestEcdsaPublicKeyFile[] = "android-test-key-ecdsa-public.pem"; |
| 263 | 257 |
| (...skipping 13 matching lines...) Expand all Loading... |
| 277 // random elements in the signature, it is not possible to compare | 271 // random elements in the signature, it is not possible to compare |
| 278 // signature bits directly. However, one can use the public key | 272 // signature bits directly. However, one can use the public key |
| 279 // to do the check. | 273 // to do the check. |
| 280 bool VerifyTestECDSASignature(const base::StringPiece& message, | 274 bool VerifyTestECDSASignature(const base::StringPiece& message, |
| 281 const base::StringPiece& signature) { | 275 const base::StringPiece& signature) { |
| 282 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestEcdsaPublicKeyFile)); | 276 ScopedEVP_PKEY pkey(ImportPublicKeyFile(kTestEcdsaPublicKeyFile)); |
| 283 if (!pkey.get()) | 277 if (!pkey.get()) |
| 284 return false; | 278 return false; |
| 285 ScopedEC_KEY pub_key(EVP_PKEY_get1_EC_KEY(pkey.get())); | 279 ScopedEC_KEY pub_key(EVP_PKEY_get1_EC_KEY(pkey.get())); |
| 286 if (!pub_key.get()) { | 280 if (!pub_key.get()) { |
| 287 LOG(ERROR) << "Could not get ECDSA public key: " | 281 LOG(ERROR) << "Could not get ECDSA public key: " << GetOpenSSLErrorString(); |
| 288 << GetOpenSSLErrorString(); | |
| 289 return false; | 282 return false; |
| 290 } | 283 } |
| 291 | 284 |
| 292 const unsigned char* digest = | 285 const unsigned char* digest = |
| 293 reinterpret_cast<const unsigned char*>(message.data()); | 286 reinterpret_cast<const unsigned char*>(message.data()); |
| 294 int digest_len = static_cast<int>(message.size()); | 287 int digest_len = static_cast<int>(message.size()); |
| 295 const unsigned char* sigbuf = | 288 const unsigned char* sigbuf = |
| 296 reinterpret_cast<const unsigned char*>(signature.data()); | 289 reinterpret_cast<const unsigned char*>(signature.data()); |
| 297 int siglen = static_cast<int>(signature.size()); | 290 int siglen = static_cast<int>(signature.size()); |
| 298 | 291 |
| 299 int ret = ECDSA_verify( | 292 int ret = ECDSA_verify(0, digest, digest_len, sigbuf, siglen, pub_key.get()); |
| 300 0, digest, digest_len, sigbuf, siglen, pub_key.get()); | |
| 301 if (ret != 1) { | 293 if (ret != 1) { |
| 302 LOG(ERROR) << "ECDSA_verify() failed: " << GetOpenSSLErrorString(); | 294 LOG(ERROR) << "ECDSA_verify() failed: " << GetOpenSSLErrorString(); |
| 303 return false; | 295 return false; |
| 304 } | 296 } |
| 305 return true; | 297 return true; |
| 306 } | 298 } |
| 307 | 299 |
| 308 // Sign a message with OpenSSL, return the result as a string. | 300 // Sign a message with OpenSSL, return the result as a string. |
| 309 // |message| is the message to be signed. | 301 // |message| is the message to be signed. |
| 310 // |openssl_key| is an OpenSSL EVP_PKEY to use. | 302 // |openssl_key| is an OpenSSL EVP_PKEY to use. |
| 311 // |result| receives the result. | 303 // |result| receives the result. |
| 312 // Returns true on success, false otherwise. | 304 // Returns true on success, false otherwise. |
| 313 bool SignWithOpenSSL(const base::StringPiece& message, | 305 bool SignWithOpenSSL(const base::StringPiece& message, |
| 314 EVP_PKEY* openssl_key, | 306 EVP_PKEY* openssl_key, |
| 315 std::string* result) { | 307 std::string* result) { |
| 316 const unsigned char* digest = | 308 const unsigned char* digest = |
| 317 reinterpret_cast<const unsigned char*>(message.data()); | 309 reinterpret_cast<const unsigned char*>(message.data()); |
| 318 unsigned int digest_len = static_cast<unsigned int>(message.size()); | 310 unsigned int digest_len = static_cast<unsigned int>(message.size()); |
| 319 std::string signature; | 311 std::string signature; |
| 320 size_t signature_size; | 312 size_t signature_size; |
| 321 size_t max_signature_size; | 313 size_t max_signature_size; |
| 322 int key_type = EVP_PKEY_id(openssl_key); | 314 int key_type = EVP_PKEY_id(openssl_key); |
| 323 switch (key_type) { | 315 switch (key_type) { |
| 324 case EVP_PKEY_RSA: | 316 case EVP_PKEY_RSA: { |
| 325 { | |
| 326 ScopedRSA rsa(EVP_PKEY_get1_RSA(openssl_key)); | 317 ScopedRSA rsa(EVP_PKEY_get1_RSA(openssl_key)); |
| 327 if (!rsa.get()) { | 318 if (!rsa.get()) { |
| 328 LOG(ERROR) << "Could not get RSA from EVP_PKEY: " | 319 LOG(ERROR) << "Could not get RSA from EVP_PKEY: " |
| 329 << GetOpenSSLErrorString(); | 320 << GetOpenSSLErrorString(); |
| 330 return false; | 321 return false; |
| 331 } | 322 } |
| 332 // With RSA, the signature will always be RSA_size() bytes. | 323 // With RSA, the signature will always be RSA_size() bytes. |
| 333 max_signature_size = static_cast<size_t>(RSA_size(rsa.get())); | 324 max_signature_size = static_cast<size_t>(RSA_size(rsa.get())); |
| 334 unsigned char* p = OpenSSLWriteInto(&signature, | 325 unsigned char* p = OpenSSLWriteInto(&signature, max_signature_size); |
| 335 max_signature_size); | |
| 336 unsigned int p_len = 0; | 326 unsigned int p_len = 0; |
| 337 int ret = RSA_sign( | 327 int ret = |
| 338 NID_md5_sha1, digest, digest_len, p, &p_len, rsa.get()); | 328 RSA_sign(NID_md5_sha1, digest, digest_len, p, &p_len, rsa.get()); |
| 339 if (ret != 1) { | 329 if (ret != 1) { |
| 340 LOG(ERROR) << "RSA_sign() failed: " << GetOpenSSLErrorString(); | 330 LOG(ERROR) << "RSA_sign() failed: " << GetOpenSSLErrorString(); |
| 341 return false; | 331 return false; |
| 342 } | 332 } |
| 343 signature_size = static_cast<size_t>(p_len); | 333 signature_size = static_cast<size_t>(p_len); |
| 344 break; | 334 break; |
| 345 } | 335 } |
| 346 case EVP_PKEY_DSA: | 336 case EVP_PKEY_DSA: { |
| 347 { | |
| 348 ScopedDSA dsa(EVP_PKEY_get1_DSA(openssl_key)); | 337 ScopedDSA dsa(EVP_PKEY_get1_DSA(openssl_key)); |
| 349 if (!dsa.get()) { | 338 if (!dsa.get()) { |
| 350 LOG(ERROR) << "Could not get DSA from EVP_PKEY: " | 339 LOG(ERROR) << "Could not get DSA from EVP_PKEY: " |
| 351 << GetOpenSSLErrorString(); | 340 << GetOpenSSLErrorString(); |
| 352 return false; | 341 return false; |
| 353 } | 342 } |
| 354 // Note, the actual signature can be smaller than DSA_size() | 343 // Note, the actual signature can be smaller than DSA_size() |
| 355 max_signature_size = static_cast<size_t>(DSA_size(dsa.get())); | 344 max_signature_size = static_cast<size_t>(DSA_size(dsa.get())); |
| 356 unsigned char* p = OpenSSLWriteInto(&signature, | 345 unsigned char* p = OpenSSLWriteInto(&signature, max_signature_size); |
| 357 max_signature_size); | |
| 358 unsigned int p_len = 0; | 346 unsigned int p_len = 0; |
| 359 // Note: first parameter is ignored by function. | 347 // Note: first parameter is ignored by function. |
| 360 int ret = DSA_sign(0, digest, digest_len, p, &p_len, dsa.get()); | 348 int ret = DSA_sign(0, digest, digest_len, p, &p_len, dsa.get()); |
| 361 if (ret != 1) { | 349 if (ret != 1) { |
| 362 LOG(ERROR) << "DSA_sign() failed: " << GetOpenSSLErrorString(); | 350 LOG(ERROR) << "DSA_sign() failed: " << GetOpenSSLErrorString(); |
| 363 return false; | 351 return false; |
| 364 } | 352 } |
| 365 signature_size = static_cast<size_t>(p_len); | 353 signature_size = static_cast<size_t>(p_len); |
| 366 break; | 354 break; |
| 367 } | 355 } |
| 368 case EVP_PKEY_EC: | 356 case EVP_PKEY_EC: { |
| 369 { | |
| 370 ScopedEC_KEY ecdsa(EVP_PKEY_get1_EC_KEY(openssl_key)); | 357 ScopedEC_KEY ecdsa(EVP_PKEY_get1_EC_KEY(openssl_key)); |
| 371 if (!ecdsa.get()) { | 358 if (!ecdsa.get()) { |
| 372 LOG(ERROR) << "Could not get EC_KEY from EVP_PKEY: " | 359 LOG(ERROR) << "Could not get EC_KEY from EVP_PKEY: " |
| 373 << GetOpenSSLErrorString(); | 360 << GetOpenSSLErrorString(); |
| 374 return false; | 361 return false; |
| 375 } | 362 } |
| 376 // Note, the actual signature can be smaller than ECDSA_size() | 363 // Note, the actual signature can be smaller than ECDSA_size() |
| 377 max_signature_size = ECDSA_size(ecdsa.get()); | 364 max_signature_size = ECDSA_size(ecdsa.get()); |
| 378 unsigned char* p = OpenSSLWriteInto(&signature, | 365 unsigned char* p = OpenSSLWriteInto(&signature, max_signature_size); |
| 379 max_signature_size); | |
| 380 unsigned int p_len = 0; | 366 unsigned int p_len = 0; |
| 381 // Note: first parameter is ignored by function. | 367 // Note: first parameter is ignored by function. |
| 382 int ret = ECDSA_sign( | 368 int ret = ECDSA_sign(0, digest, digest_len, p, &p_len, ecdsa.get()); |
| 383 0, digest, digest_len, p, &p_len, ecdsa.get()); | |
| 384 if (ret != 1) { | 369 if (ret != 1) { |
| 385 LOG(ERROR) << "ECDSA_sign() fialed: " << GetOpenSSLErrorString(); | 370 LOG(ERROR) << "ECDSA_sign() fialed: " << GetOpenSSLErrorString(); |
| 386 return false; | 371 return false; |
| 387 } | 372 } |
| 388 signature_size = static_cast<size_t>(p_len); | 373 signature_size = static_cast<size_t>(p_len); |
| 389 break; | 374 break; |
| 390 } | 375 } |
| 391 default: | 376 default: |
| 392 LOG(WARNING) << "Invalid OpenSSL key type: " << key_type; | 377 LOG(WARNING) << "Invalid OpenSSL key type: " << key_type; |
| 393 return false; | 378 return false; |
| 394 } | 379 } |
| 395 | 380 |
| 396 if (signature_size == 0) { | 381 if (signature_size == 0) { |
| 397 LOG(ERROR) << "Signature is empty!"; | 382 LOG(ERROR) << "Signature is empty!"; |
| 398 return false; | 383 return false; |
| 399 } | 384 } |
| 400 if (signature_size > max_signature_size) { | 385 if (signature_size > max_signature_size) { |
| 401 LOG(ERROR) << "Signature size mismatch, actual " << signature_size | 386 LOG(ERROR) << "Signature size mismatch, actual " << signature_size |
| 402 << ", expected <= " << max_signature_size; | 387 << ", expected <= " << max_signature_size; |
| 403 return false; | 388 return false; |
| 404 } | 389 } |
| 405 signature.resize(signature_size); | 390 signature.resize(signature_size); |
| 406 result->swap(signature); | 391 result->swap(signature); |
| 407 return true; | 392 return true; |
| 408 } | 393 } |
| 409 | 394 |
| 410 // Check that a generated signature for a given message matches | 395 // Check that a generated signature for a given message matches |
| 411 // OpenSSL output byte-by-byte. | 396 // OpenSSL output byte-by-byte. |
| 412 // |message| is the input message. | 397 // |message| is the input message. |
| 413 // |signature| is the generated signature for the message. | 398 // |signature| is the generated signature for the message. |
| 414 // |openssl_key| is a raw EVP_PKEY for the same private key than the | 399 // |openssl_key| is a raw EVP_PKEY for the same private key than the |
| 415 // one which was used to generate the signature. | 400 // one which was used to generate the signature. |
| 416 // Returns true on success, false otherwise. | 401 // Returns true on success, false otherwise. |
| 417 bool CompareSignatureWithOpenSSL(const base::StringPiece& message, | 402 bool CompareSignatureWithOpenSSL(const base::StringPiece& message, |
| 418 const base::StringPiece& signature, | 403 const base::StringPiece& signature, |
| 419 EVP_PKEY* openssl_key) { | 404 EVP_PKEY* openssl_key) { |
| 420 std::string openssl_signature; | 405 std::string openssl_signature; |
| 421 SignWithOpenSSL(message, openssl_key, &openssl_signature); | 406 SignWithOpenSSL(message, openssl_key, &openssl_signature); |
| 422 | 407 |
| 423 if (signature.size() != openssl_signature.size()) { | 408 if (signature.size() != openssl_signature.size()) { |
| 424 LOG(ERROR) << "Signature size mismatch, actual " | 409 LOG(ERROR) << "Signature size mismatch, actual " << signature.size() |
| 425 << signature.size() << ", expected " | 410 << ", expected " << openssl_signature.size(); |
| 426 << openssl_signature.size(); | |
| 427 return false; | 411 return false; |
| 428 } | 412 } |
| 429 for (size_t n = 0; n < signature.size(); ++n) { | 413 for (size_t n = 0; n < signature.size(); ++n) { |
| 430 if (openssl_signature[n] != signature[n]) { | 414 if (openssl_signature[n] != signature[n]) { |
| 431 LOG(ERROR) << "Signature byte mismatch at index " << n | 415 LOG(ERROR) << "Signature byte mismatch at index " << n << "actual " |
| 432 << "actual " << signature[n] << ", expected " | 416 << signature[n] << ", expected " << openssl_signature[n]; |
| 433 << openssl_signature[n]; | 417 LOG(ERROR) << "Actual signature : " << base::HexEncode(signature.data(), |
| 434 LOG(ERROR) << "Actual signature : " | 418 signature.size()); |
| 435 << base::HexEncode(signature.data(), signature.size()); | 419 LOG(ERROR) << "Expected signature: " << base::HexEncode( |
| 436 LOG(ERROR) << "Expected signature: " | 420 openssl_signature.data(), |
| 437 << base::HexEncode(openssl_signature.data(), | 421 openssl_signature.size()); |
| 438 openssl_signature.size()); | |
| 439 return false; | 422 return false; |
| 440 } | 423 } |
| 441 } | 424 } |
| 442 return true; | 425 return true; |
| 443 } | 426 } |
| 444 | 427 |
| 445 // Sign a message with our platform API. | 428 // Sign a message with our platform API. |
| 446 // | 429 // |
| 447 // |android_key| is a JNI reference to the platform PrivateKey object. | 430 // |android_key| is a JNI reference to the platform PrivateKey object. |
| 448 // |openssl_key| is a pointer to an OpenSSL key object for the exact | 431 // |openssl_key| is a pointer to an OpenSSL key object for the exact |
| 449 // same key content. | 432 // same key content. |
| 450 // |message| is a message. | 433 // |message| is a message. |
| 451 // |result| will receive the result. | 434 // |result| will receive the result. |
| 452 void DoKeySigning(jobject android_key, | 435 void DoKeySigning(jobject android_key, |
| 453 EVP_PKEY* openssl_key, | 436 EVP_PKEY* openssl_key, |
| 454 const base::StringPiece& message, | 437 const base::StringPiece& message, |
| 455 std::string* result) { | 438 std::string* result) { |
| 456 // First, get the platform signature. | 439 // First, get the platform signature. |
| 457 std::vector<uint8> android_signature; | 440 std::vector<uint8> android_signature; |
| 458 ASSERT_TRUE( | 441 ASSERT_TRUE( |
| 459 RawSignDigestWithPrivateKey(android_key, | 442 RawSignDigestWithPrivateKey(android_key, message, &android_signature)); |
| 460 message, | |
| 461 &android_signature)); | |
| 462 | 443 |
| 463 result->assign( | 444 result->assign(reinterpret_cast<const char*>(&android_signature[0]), |
| 464 reinterpret_cast<const char*>(&android_signature[0]), | 445 android_signature.size()); |
| 465 android_signature.size()); | |
| 466 } | 446 } |
| 467 | 447 |
| 468 // Sign a message with our OpenSSL EVP_PKEY wrapper around platform | 448 // Sign a message with our OpenSSL EVP_PKEY wrapper around platform |
| 469 // APIS. | 449 // APIS. |
| 470 // | 450 // |
| 471 // |android_key| is a JNI reference to the platform PrivateKey object. | 451 // |android_key| is a JNI reference to the platform PrivateKey object. |
| 472 // |openssl_key| is a pointer to an OpenSSL key object for the exact | 452 // |openssl_key| is a pointer to an OpenSSL key object for the exact |
| 473 // same key content. | 453 // same key content. |
| 474 // |message| is a message. | 454 // |message| is a message. |
| 475 // |result| will receive the result. | 455 // |result| will receive the result. |
| 476 void DoKeySigningWithWrapper(EVP_PKEY* wrapper_key, | 456 void DoKeySigningWithWrapper(EVP_PKEY* wrapper_key, |
| 477 EVP_PKEY* openssl_key, | 457 EVP_PKEY* openssl_key, |
| 478 const base::StringPiece& message, | 458 const base::StringPiece& message, |
| 479 std::string* result) { | 459 std::string* result) { |
| 480 // First, get the platform signature. | 460 // First, get the platform signature. |
| 481 std::string wrapper_signature; | 461 std::string wrapper_signature; |
| 482 SignWithOpenSSL(message, wrapper_key, &wrapper_signature); | 462 SignWithOpenSSL(message, wrapper_key, &wrapper_signature); |
| 483 ASSERT_NE(0U, wrapper_signature.size()); | 463 ASSERT_NE(0U, wrapper_signature.size()); |
| 484 | 464 |
| 485 result->assign( | 465 result->assign(reinterpret_cast<const char*>(&wrapper_signature[0]), |
| 486 reinterpret_cast<const char*>(&wrapper_signature[0]), | 466 wrapper_signature.size()); |
| 487 wrapper_signature.size()); | |
| 488 } | 467 } |
| 489 | 468 |
| 490 } // namespace | 469 } // namespace |
| 491 | 470 |
| 492 TEST(AndroidKeyStore,GetRSAKeyModulus) { | 471 TEST(AndroidKeyStore, GetRSAKeyModulus) { |
| 493 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 472 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
| 494 InitEnv(); | 473 InitEnv(); |
| 495 | 474 |
| 496 // Load the test RSA key. | 475 // Load the test RSA key. |
| 497 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestRsaKeyFile)); | 476 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestRsaKeyFile)); |
| 498 ASSERT_TRUE(pkey.get()); | 477 ASSERT_TRUE(pkey.get()); |
| 499 | 478 |
| 500 // Convert it to encoded PKCS#8 bytes. | 479 // Convert it to encoded PKCS#8 bytes. |
| 501 std::string pkcs8_data; | 480 std::string pkcs8_data; |
| 502 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); | 481 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); |
| 503 | 482 |
| 504 // Create platform PrivateKey object from it. | 483 // Create platform PrivateKey object from it. |
| 505 ScopedJava key_java = GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_RSA, | 484 ScopedJava key_java = |
| 506 pkcs8_data); | 485 GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_RSA, pkcs8_data); |
| 507 ASSERT_FALSE(key_java.is_null()); | 486 ASSERT_FALSE(key_java.is_null()); |
| 508 | 487 |
| 509 // Retrieve the corresponding modulus through JNI | 488 // Retrieve the corresponding modulus through JNI |
| 510 std::vector<uint8> modulus_java; | 489 std::vector<uint8> modulus_java; |
| 511 ASSERT_TRUE(GetRSAKeyModulus(key_java.obj(), &modulus_java)); | 490 ASSERT_TRUE(GetRSAKeyModulus(key_java.obj(), &modulus_java)); |
| 512 | 491 |
| 513 // Create an OpenSSL BIGNUM from it. | 492 // Create an OpenSSL BIGNUM from it. |
| 514 ScopedBIGNUM bn( | 493 ScopedBIGNUM bn( |
| 515 BN_bin2bn( | 494 BN_bin2bn(reinterpret_cast<const unsigned char*>(&modulus_java[0]), |
| 516 reinterpret_cast<const unsigned char*>(&modulus_java[0]), | 495 static_cast<int>(modulus_java.size()), |
| 517 static_cast<int>(modulus_java.size()), | 496 NULL)); |
| 518 NULL)); | |
| 519 ASSERT_TRUE(bn.get()); | 497 ASSERT_TRUE(bn.get()); |
| 520 | 498 |
| 521 // Compare it to the one in the RSA key, they must be identical. | 499 // Compare it to the one in the RSA key, they must be identical. |
| 522 ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey.get())); | 500 ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey.get())); |
| 523 ASSERT_TRUE(rsa.get()) << GetOpenSSLErrorString(); | 501 ASSERT_TRUE(rsa.get()) << GetOpenSSLErrorString(); |
| 524 | 502 |
| 525 ASSERT_EQ(0, BN_cmp(bn.get(), rsa.get()->n)); | 503 ASSERT_EQ(0, BN_cmp(bn.get(), rsa.get()->n)); |
| 526 } | 504 } |
| 527 | 505 |
| 528 TEST(AndroidKeyStore,GetDSAKeyParamQ) { | 506 TEST(AndroidKeyStore, GetDSAKeyParamQ) { |
| 529 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 507 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
| 530 InitEnv(); | 508 InitEnv(); |
| 531 | 509 |
| 532 // Load the test DSA key. | 510 // Load the test DSA key. |
| 533 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestDsaKeyFile)); | 511 ScopedEVP_PKEY pkey(ImportPrivateKeyFile(kTestDsaKeyFile)); |
| 534 ASSERT_TRUE(pkey.get()); | 512 ASSERT_TRUE(pkey.get()); |
| 535 | 513 |
| 536 // Convert it to encoded PKCS#8 bytes. | 514 // Convert it to encoded PKCS#8 bytes. |
| 537 std::string pkcs8_data; | 515 std::string pkcs8_data; |
| 538 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); | 516 ASSERT_TRUE(GetPrivateKeyPkcs8Bytes(pkey, &pkcs8_data)); |
| 539 | 517 |
| 540 // Create platform PrivateKey object from it. | 518 // Create platform PrivateKey object from it. |
| 541 ScopedJava key_java = GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_DSA, | 519 ScopedJava key_java = |
| 542 pkcs8_data); | 520 GetPKCS8PrivateKeyJava(PRIVATE_KEY_TYPE_DSA, pkcs8_data); |
| 543 ASSERT_FALSE(key_java.is_null()); | 521 ASSERT_FALSE(key_java.is_null()); |
| 544 | 522 |
| 545 // Retrieve the corresponding Q parameter through JNI | 523 // Retrieve the corresponding Q parameter through JNI |
| 546 std::vector<uint8> q_java; | 524 std::vector<uint8> q_java; |
| 547 ASSERT_TRUE(GetDSAKeyParamQ(key_java.obj(), &q_java)); | 525 ASSERT_TRUE(GetDSAKeyParamQ(key_java.obj(), &q_java)); |
| 548 | 526 |
| 549 // Create an OpenSSL BIGNUM from it. | 527 // Create an OpenSSL BIGNUM from it. |
| 550 ScopedBIGNUM bn( | 528 ScopedBIGNUM bn(BN_bin2bn(reinterpret_cast<const unsigned char*>(&q_java[0]), |
| 551 BN_bin2bn( | 529 static_cast<int>(q_java.size()), |
| 552 reinterpret_cast<const unsigned char*>(&q_java[0]), | 530 NULL)); |
| 553 static_cast<int>(q_java.size()), | |
| 554 NULL)); | |
| 555 ASSERT_TRUE(bn.get()); | 531 ASSERT_TRUE(bn.get()); |
| 556 | 532 |
| 557 // Compare it to the one in the RSA key, they must be identical. | 533 // Compare it to the one in the RSA key, they must be identical. |
| 558 ScopedDSA dsa(EVP_PKEY_get1_DSA(pkey.get())); | 534 ScopedDSA dsa(EVP_PKEY_get1_DSA(pkey.get())); |
| 559 ASSERT_TRUE(dsa.get()) << GetOpenSSLErrorString(); | 535 ASSERT_TRUE(dsa.get()) << GetOpenSSLErrorString(); |
| 560 | 536 |
| 561 ASSERT_EQ(0, BN_cmp(bn.get(), dsa.get()->q)); | 537 ASSERT_EQ(0, BN_cmp(bn.get(), dsa.get()->q)); |
| 562 } | 538 } |
| 563 | 539 |
| 564 TEST(AndroidKeyStore,GetPrivateKeyTypeRSA) { | 540 TEST(AndroidKeyStore, GetPrivateKeyTypeRSA) { |
| 565 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 541 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
| 566 | 542 |
| 567 ScopedJava rsa_key = GetRSATestKeyJava(); | 543 ScopedJava rsa_key = GetRSATestKeyJava(); |
| 568 ASSERT_FALSE(rsa_key.is_null()); | 544 ASSERT_FALSE(rsa_key.is_null()); |
| 569 EXPECT_EQ(PRIVATE_KEY_TYPE_RSA, | 545 EXPECT_EQ(PRIVATE_KEY_TYPE_RSA, GetPrivateKeyType(rsa_key.obj())); |
| 570 GetPrivateKeyType(rsa_key.obj())); | |
| 571 } | 546 } |
| 572 | 547 |
| 573 TEST(AndroidKeyStore,SignWithPrivateKeyRSA) { | 548 TEST(AndroidKeyStore, SignWithPrivateKeyRSA) { |
| 574 ScopedJava rsa_key = GetRSATestKeyJava(); | 549 ScopedJava rsa_key = GetRSATestKeyJava(); |
| 575 ASSERT_FALSE(rsa_key.is_null()); | 550 ASSERT_FALSE(rsa_key.is_null()); |
| 576 | 551 |
| 577 if (IsOnAndroidOlderThan_4_2()) { | 552 if (IsOnAndroidOlderThan_4_2()) { |
| 578 LOG(INFO) << "This test can't run on Android < 4.2"; | 553 LOG(INFO) << "This test can't run on Android < 4.2"; |
| 579 return; | 554 return; |
| 580 } | 555 } |
| 581 | 556 |
| 582 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); | 557 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); |
| 583 ASSERT_TRUE(openssl_key.get()); | 558 ASSERT_TRUE(openssl_key.get()); |
| 584 | 559 |
| 585 std::string message = kTestRsaHash; | 560 std::string message = kTestRsaHash; |
| 586 ASSERT_EQ(36U, message.size()); | 561 ASSERT_EQ(36U, message.size()); |
| 587 | 562 |
| 588 std::string signature; | 563 std::string signature; |
| 589 DoKeySigning(rsa_key.obj(), openssl_key.get(), message, &signature); | 564 DoKeySigning(rsa_key.obj(), openssl_key.get(), message, &signature); |
| 590 ASSERT_TRUE( | 565 ASSERT_TRUE( |
| 591 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); | 566 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); |
| 592 // All good. | 567 // All good. |
| 593 } | 568 } |
| 594 | 569 |
| 595 TEST(AndroidKeyStore,SignWithWrapperKeyRSA) { | 570 TEST(AndroidKeyStore, SignWithWrapperKeyRSA) { |
| 596 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 571 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 597 | 572 |
| 598 ScopedJava rsa_key = GetRSATestKeyJava(); | 573 ScopedJava rsa_key = GetRSATestKeyJava(); |
| 599 ASSERT_FALSE(rsa_key.is_null()); | 574 ASSERT_FALSE(rsa_key.is_null()); |
| 600 | 575 |
| 601 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(rsa_key.obj())); | 576 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(rsa_key.obj())); |
| 602 ASSERT_TRUE(wrapper_key.get() != NULL); | 577 ASSERT_TRUE(wrapper_key.get() != NULL); |
| 603 | 578 |
| 604 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); | 579 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile)); |
| 605 ASSERT_TRUE(openssl_key.get()); | 580 ASSERT_TRUE(openssl_key.get()); |
| 606 | 581 |
| 607 // Check that RSA_size() works properly on the wrapper key. | 582 // Check that RSA_size() works properly on the wrapper key. |
| 608 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), | 583 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), EVP_PKEY_size(wrapper_key.get())); |
| 609 EVP_PKEY_size(wrapper_key.get())); | |
| 610 | 584 |
| 611 // Message size must be 36 for RSA_sign(NID_md5_sha1,...) to return | 585 // Message size must be 36 for RSA_sign(NID_md5_sha1,...) to return |
| 612 // without an error. | 586 // without an error. |
| 613 std::string message = kTestRsaHash; | 587 std::string message = kTestRsaHash; |
| 614 ASSERT_EQ(36U, message.size()); | 588 ASSERT_EQ(36U, message.size()); |
| 615 | 589 |
| 616 std::string signature; | 590 std::string signature; |
| 617 DoKeySigningWithWrapper(wrapper_key.get(), | 591 DoKeySigningWithWrapper( |
| 618 openssl_key.get(), | 592 wrapper_key.get(), openssl_key.get(), message, &signature); |
| 619 message, | |
| 620 &signature); | |
| 621 ASSERT_TRUE( | 593 ASSERT_TRUE( |
| 622 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); | 594 CompareSignatureWithOpenSSL(message, signature, openssl_key.get())); |
| 623 } | 595 } |
| 624 | 596 |
| 625 TEST(AndroidKeyStore,GetPrivateKeyTypeDSA) { | 597 TEST(AndroidKeyStore, GetPrivateKeyTypeDSA) { |
| 626 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 598 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
| 627 | 599 |
| 628 ScopedJava dsa_key = GetDSATestKeyJava(); | 600 ScopedJava dsa_key = GetDSATestKeyJava(); |
| 629 ASSERT_FALSE(dsa_key.is_null()); | 601 ASSERT_FALSE(dsa_key.is_null()); |
| 630 EXPECT_EQ(PRIVATE_KEY_TYPE_DSA, | 602 EXPECT_EQ(PRIVATE_KEY_TYPE_DSA, GetPrivateKeyType(dsa_key.obj())); |
| 631 GetPrivateKeyType(dsa_key.obj())); | |
| 632 } | 603 } |
| 633 | 604 |
| 634 TEST(AndroidKeyStore,SignWithPrivateKeyDSA) { | 605 TEST(AndroidKeyStore, SignWithPrivateKeyDSA) { |
| 635 ScopedJava dsa_key = GetDSATestKeyJava(); | 606 ScopedJava dsa_key = GetDSATestKeyJava(); |
| 636 ASSERT_FALSE(dsa_key.is_null()); | 607 ASSERT_FALSE(dsa_key.is_null()); |
| 637 | 608 |
| 638 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); | 609 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); |
| 639 ASSERT_TRUE(openssl_key.get()); | 610 ASSERT_TRUE(openssl_key.get()); |
| 640 | 611 |
| 641 std::string message = kTestDsaHash; | 612 std::string message = kTestDsaHash; |
| 642 ASSERT_EQ(20U, message.size()); | 613 ASSERT_EQ(20U, message.size()); |
| 643 | 614 |
| 644 std::string signature; | 615 std::string signature; |
| 645 DoKeySigning(dsa_key.obj(), openssl_key.get(), message, &signature); | 616 DoKeySigning(dsa_key.obj(), openssl_key.get(), message, &signature); |
| 646 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); | 617 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); |
| 647 } | 618 } |
| 648 | 619 |
| 649 TEST(AndroidKeyStore,SignWithWrapperKeyDSA) { | 620 TEST(AndroidKeyStore, SignWithWrapperKeyDSA) { |
| 650 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 621 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 651 | 622 |
| 652 ScopedJava dsa_key = GetDSATestKeyJava(); | 623 ScopedJava dsa_key = GetDSATestKeyJava(); |
| 653 ASSERT_FALSE(dsa_key.is_null()); | 624 ASSERT_FALSE(dsa_key.is_null()); |
| 654 | 625 |
| 655 ScopedEVP_PKEY wrapper_key( | 626 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(dsa_key.obj())); |
| 656 GetOpenSSLPrivateKeyWrapper(dsa_key.obj())); | |
| 657 ASSERT_TRUE(wrapper_key.get()); | 627 ASSERT_TRUE(wrapper_key.get()); |
| 658 | 628 |
| 659 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); | 629 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestDsaKeyFile)); |
| 660 ASSERT_TRUE(openssl_key.get()); | 630 ASSERT_TRUE(openssl_key.get()); |
| 661 | 631 |
| 662 // Check that DSA_size() works correctly on the wrapper. | 632 // Check that DSA_size() works correctly on the wrapper. |
| 663 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), | 633 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), EVP_PKEY_size(wrapper_key.get())); |
| 664 EVP_PKEY_size(wrapper_key.get())); | |
| 665 | 634 |
| 666 std::string message = kTestDsaHash; | 635 std::string message = kTestDsaHash; |
| 667 std::string signature; | 636 std::string signature; |
| 668 DoKeySigningWithWrapper(wrapper_key.get(), | 637 DoKeySigningWithWrapper( |
| 669 openssl_key.get(), | 638 wrapper_key.get(), openssl_key.get(), message, &signature); |
| 670 message, | |
| 671 &signature); | |
| 672 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); | 639 ASSERT_TRUE(VerifyTestDSASignature(message, signature)); |
| 673 } | 640 } |
| 674 | 641 |
| 675 TEST(AndroidKeyStore,GetPrivateKeyTypeECDSA) { | 642 TEST(AndroidKeyStore, GetPrivateKeyTypeECDSA) { |
| 676 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); | 643 crypto::OpenSSLErrStackTracer err_trace(FROM_HERE); |
| 677 | 644 |
| 678 ScopedJava ecdsa_key = GetECDSATestKeyJava(); | 645 ScopedJava ecdsa_key = GetECDSATestKeyJava(); |
| 679 ASSERT_FALSE(ecdsa_key.is_null()); | 646 ASSERT_FALSE(ecdsa_key.is_null()); |
| 680 EXPECT_EQ(PRIVATE_KEY_TYPE_ECDSA, | 647 EXPECT_EQ(PRIVATE_KEY_TYPE_ECDSA, GetPrivateKeyType(ecdsa_key.obj())); |
| 681 GetPrivateKeyType(ecdsa_key.obj())); | |
| 682 } | 648 } |
| 683 | 649 |
| 684 TEST(AndroidKeyStore,SignWithPrivateKeyECDSA) { | 650 TEST(AndroidKeyStore, SignWithPrivateKeyECDSA) { |
| 685 ScopedJava ecdsa_key = GetECDSATestKeyJava(); | 651 ScopedJava ecdsa_key = GetECDSATestKeyJava(); |
| 686 ASSERT_FALSE(ecdsa_key.is_null()); | 652 ASSERT_FALSE(ecdsa_key.is_null()); |
| 687 | 653 |
| 688 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); | 654 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); |
| 689 ASSERT_TRUE(openssl_key.get()); | 655 ASSERT_TRUE(openssl_key.get()); |
| 690 | 656 |
| 691 std::string message = kTestEcdsaHash; | 657 std::string message = kTestEcdsaHash; |
| 692 std::string signature; | 658 std::string signature; |
| 693 DoKeySigning(ecdsa_key.obj(), openssl_key.get(), message, &signature); | 659 DoKeySigning(ecdsa_key.obj(), openssl_key.get(), message, &signature); |
| 694 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); | 660 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); |
| 695 } | 661 } |
| 696 | 662 |
| 697 TEST(AndroidKeyStore, SignWithWrapperKeyECDSA) { | 663 TEST(AndroidKeyStore, SignWithWrapperKeyECDSA) { |
| 698 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 664 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 699 | 665 |
| 700 ScopedJava ecdsa_key = GetECDSATestKeyJava(); | 666 ScopedJava ecdsa_key = GetECDSATestKeyJava(); |
| 701 ASSERT_FALSE(ecdsa_key.is_null()); | 667 ASSERT_FALSE(ecdsa_key.is_null()); |
| 702 | 668 |
| 703 ScopedEVP_PKEY wrapper_key( | 669 ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(ecdsa_key.obj())); |
| 704 GetOpenSSLPrivateKeyWrapper(ecdsa_key.obj())); | |
| 705 ASSERT_TRUE(wrapper_key.get()); | 670 ASSERT_TRUE(wrapper_key.get()); |
| 706 | 671 |
| 707 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); | 672 ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile)); |
| 708 ASSERT_TRUE(openssl_key.get()); | 673 ASSERT_TRUE(openssl_key.get()); |
| 709 | 674 |
| 710 // Check that ECDSA size works correctly on the wrapper. | 675 // Check that ECDSA size works correctly on the wrapper. |
| 711 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), | 676 EXPECT_EQ(EVP_PKEY_size(openssl_key.get()), EVP_PKEY_size(wrapper_key.get())); |
| 712 EVP_PKEY_size(wrapper_key.get())); | |
| 713 | 677 |
| 714 std::string message = kTestEcdsaHash; | 678 std::string message = kTestEcdsaHash; |
| 715 std::string signature; | 679 std::string signature; |
| 716 DoKeySigningWithWrapper(wrapper_key.get(), | 680 DoKeySigningWithWrapper( |
| 717 openssl_key.get(), | 681 wrapper_key.get(), openssl_key.get(), message, &signature); |
| 718 message, | |
| 719 &signature); | |
| 720 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); | 682 ASSERT_TRUE(VerifyTestECDSASignature(message, signature)); |
| 721 } | 683 } |
| 722 | 684 |
| 723 } // namespace android | 685 } // namespace android |
| 724 } // namespace net | 686 } // namespace net |
| OLD | NEW |