OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/jwk_serializer.h" | 5 #include "net/cert/jwk_serializer.h" |
6 | 6 |
7 #include <cert.h> | 7 #include <cert.h> |
8 #include <keyhi.h> | 8 #include <keyhi.h> |
9 #include <nss.h> | 9 #include <nss.h> |
10 | 10 |
(...skipping 15 matching lines...) Expand all Loading... |
26 static const int kPrime256v1PublicKeyLength = 64; | 26 static const int kPrime256v1PublicKeyLength = 64; |
27 // The public key value is encoded as 0x04 + 64 bytes of public key. | 27 // The public key value is encoded as 0x04 + 64 bytes of public key. |
28 // NSS gives the length as the bit length. | 28 // NSS gives the length as the bit length. |
29 if (spki->subjectPublicKey.len != (kPrime256v1PublicKeyLength + 1) * 8 || | 29 if (spki->subjectPublicKey.len != (kPrime256v1PublicKeyLength + 1) * 8 || |
30 spki->subjectPublicKey.data[0] != kUncompressedEncodingType) | 30 spki->subjectPublicKey.data[0] != kUncompressedEncodingType) |
31 return false; | 31 return false; |
32 | 32 |
33 public_key_jwk->SetString("kty", "EC"); | 33 public_key_jwk->SetString("kty", "EC"); |
34 public_key_jwk->SetString("crv", "P-256"); | 34 public_key_jwk->SetString("crv", "P-256"); |
35 | 35 |
36 base::StringPiece x( | 36 base::StringPiece x(reinterpret_cast<char*>(spki->subjectPublicKey.data + 1), |
37 reinterpret_cast<char*>(spki->subjectPublicKey.data + 1), | 37 kPrime256v1PublicKeyLength / 2); |
38 kPrime256v1PublicKeyLength / 2); | |
39 std::string x_b64; | 38 std::string x_b64; |
40 base::Base64Encode(x, &x_b64); | 39 base::Base64Encode(x, &x_b64); |
41 public_key_jwk->SetString("x", x_b64); | 40 public_key_jwk->SetString("x", x_b64); |
42 | 41 |
43 base::StringPiece y( | 42 base::StringPiece y(reinterpret_cast<char*>(spki->subjectPublicKey.data + 1 + |
44 reinterpret_cast<char*>(spki->subjectPublicKey.data + 1 + | 43 kPrime256v1PublicKeyLength / 2), |
45 kPrime256v1PublicKeyLength / 2), | 44 kPrime256v1PublicKeyLength / 2); |
46 kPrime256v1PublicKeyLength / 2); | |
47 std::string y_b64; | 45 std::string y_b64; |
48 base::Base64Encode(y, &y_b64); | 46 base::Base64Encode(y, &y_b64); |
49 public_key_jwk->SetString("y", y_b64); | 47 public_key_jwk->SetString("y", y_b64); |
50 return true; | 48 return true; |
51 } | 49 } |
52 | 50 |
53 bool ConvertEcPublicKeyInfoToJwk( | 51 bool ConvertEcPublicKeyInfoToJwk(CERTSubjectPublicKeyInfo* spki, |
54 CERTSubjectPublicKeyInfo* spki, | 52 base::DictionaryValue* public_key_jwk) { |
55 base::DictionaryValue* public_key_jwk) { | |
56 // 1.2.840.10045.3.1.7 | 53 // 1.2.840.10045.3.1.7 |
57 // (iso.member-body.us.ansi-x9-62.ellipticCurve.primeCurve.prime256v1) | 54 // (iso.member-body.us.ansi-x9-62.ellipticCurve.primeCurve.prime256v1) |
58 // (This includes the DER-encoded type (OID) and length: parameters can be | 55 // (This includes the DER-encoded type (OID) and length: parameters can be |
59 // anything, so the DER type isn't implied, and NSS includes it.) | 56 // anything, so the DER type isn't implied, and NSS includes it.) |
60 static const unsigned char kPrime256v1[] = { | 57 static const unsigned char kPrime256v1[] = {0x06, 0x08, 0x2a, 0x86, 0x48, |
61 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 | 58 0xce, 0x3d, 0x03, 0x01, 0x07}; |
62 }; | |
63 if (spki->algorithm.parameters.len == sizeof(kPrime256v1) && | 59 if (spki->algorithm.parameters.len == sizeof(kPrime256v1) && |
64 !memcmp(spki->algorithm.parameters.data, kPrime256v1, | 60 !memcmp( |
65 sizeof(kPrime256v1))) { | 61 spki->algorithm.parameters.data, kPrime256v1, sizeof(kPrime256v1))) { |
66 return ConvertEcPrime256v1PublicKeyInfoToJwk(spki, public_key_jwk); | 62 return ConvertEcPrime256v1PublicKeyInfoToJwk(spki, public_key_jwk); |
67 } | 63 } |
68 // TODO(juanlang): other curves | 64 // TODO(juanlang): other curves |
69 return false; | 65 return false; |
70 } | 66 } |
71 | 67 |
72 typedef scoped_ptr< | 68 typedef scoped_ptr<CERTSubjectPublicKeyInfo, |
73 CERTSubjectPublicKeyInfo, | 69 crypto::NSSDestroyer<CERTSubjectPublicKeyInfo, |
74 crypto::NSSDestroyer<CERTSubjectPublicKeyInfo, | 70 SECKEY_DestroySubjectPublicKeyInfo> > |
75 SECKEY_DestroySubjectPublicKeyInfo> > | |
76 ScopedCERTSubjectPublicKeyInfo; | 71 ScopedCERTSubjectPublicKeyInfo; |
77 | 72 |
78 } // namespace | 73 } // namespace |
79 | 74 |
80 bool ConvertSpkiFromDerToJwk( | 75 bool ConvertSpkiFromDerToJwk(const base::StringPiece& spki_der, |
81 const base::StringPiece& spki_der, | 76 base::DictionaryValue* public_key_jwk) { |
82 base::DictionaryValue* public_key_jwk) { | |
83 public_key_jwk->Clear(); | 77 public_key_jwk->Clear(); |
84 | 78 |
85 crypto::EnsureNSSInit(); | 79 crypto::EnsureNSSInit(); |
86 | 80 |
87 if (!NSS_IsInitialized()) | 81 if (!NSS_IsInitialized()) |
88 return false; | 82 return false; |
89 | 83 |
90 SECItem sec_item; | 84 SECItem sec_item; |
91 sec_item.data = const_cast<unsigned char*>( | 85 sec_item.data = const_cast<unsigned char*>( |
92 reinterpret_cast<const unsigned char*>(spki_der.data())); | 86 reinterpret_cast<const unsigned char*>(spki_der.data())); |
93 sec_item.len = spki_der.size(); | 87 sec_item.len = spki_der.size(); |
94 ScopedCERTSubjectPublicKeyInfo spki( | 88 ScopedCERTSubjectPublicKeyInfo spki( |
95 SECKEY_DecodeDERSubjectPublicKeyInfo(&sec_item)); | 89 SECKEY_DecodeDERSubjectPublicKeyInfo(&sec_item)); |
96 if (!spki) | 90 if (!spki) |
97 return false; | 91 return false; |
98 | 92 |
99 // 1.2.840.10045.2 | 93 // 1.2.840.10045.2 |
100 // (iso.member-body.us.ansi-x9-62.id-ecPublicKey) | 94 // (iso.member-body.us.ansi-x9-62.id-ecPublicKey) |
101 // (This omits the ASN.1 encoding of the type (OID) and length: the fact that | 95 // (This omits the ASN.1 encoding of the type (OID) and length: the fact that |
102 // this is an OID is already clear, and NSS omits it here.) | 96 // this is an OID is already clear, and NSS omits it here.) |
103 static const unsigned char kIdEcPublicKey[] = { | 97 static const unsigned char kIdEcPublicKey[] = {0x2A, 0x86, 0x48, 0xCE, |
104 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01 | 98 0x3D, 0x02, 0x01}; |
105 }; | |
106 bool rv = false; | 99 bool rv = false; |
107 if (spki->algorithm.algorithm.len == sizeof(kIdEcPublicKey) && | 100 if (spki->algorithm.algorithm.len == sizeof(kIdEcPublicKey) && |
108 !memcmp(spki->algorithm.algorithm.data, kIdEcPublicKey, | 101 !memcmp(spki->algorithm.algorithm.data, |
| 102 kIdEcPublicKey, |
109 sizeof(kIdEcPublicKey))) { | 103 sizeof(kIdEcPublicKey))) { |
110 rv = ConvertEcPublicKeyInfoToJwk(spki.get(), public_key_jwk); | 104 rv = ConvertEcPublicKeyInfoToJwk(spki.get(), public_key_jwk); |
111 } | 105 } |
112 // TODO(juanlang): other algorithms | 106 // TODO(juanlang): other algorithms |
113 return rv; | 107 return rv; |
114 } | 108 } |
115 | 109 |
116 } // namespace JwkSerializer | 110 } // namespace JwkSerializer |
117 | 111 |
118 } // namespace net | 112 } // namespace net |
OLD | NEW |