Check TBSCertificate.algorithm and Certificate.signatureAlgorithm for consistency when verifying ce…

net/cert/x509_certificate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_X509_CERTIFICATE_H_
 #define NET_CERT_X509_CERTIFICATE_H_
 
 #include <stddef.h>
 #include <string.h>
 
@@ skipping 62 matching lines @@
 
   enum PublicKeyType {
     kPublicKeyTypeUnknown,
     kPublicKeyTypeRSA,
     kPublicKeyTypeDSA,
     kPublicKeyTypeECDSA,
     kPublicKeyTypeDH,
     kPublicKeyTypeECDH
   };
 
-  enum SignatureHashAlgorithm {
-    kSignatureHashAlgorithmMd2,
-    kSignatureHashAlgorithmMd4,
-    kSignatureHashAlgorithmMd5,
-    kSignatureHashAlgorithmSha1,
-    kSignatureHashAlgorithmOther,
-  };
-
   enum Format {
     // The data contains a single DER-encoded certificate, or a PEM-encoded
     // DER certificate with the PEM encoding block name of "CERTIFICATE".
     // Any subsequent blocks will be ignored.
     FORMAT_SINGLE_CERTIFICATE = 1 << 0,
 
     // The data contains a sequence of one or more PEM-encoded, DER
     // certificates, with the PEM encoding block name of "CERTIFICATE".
     // All PEM blocks will be parsed, until the first error is encountered.
     FORMAT_PEM_CERT_SEQUENCE = 1 << 1,
@@ skipping 215 matching lines @@
   // the first element.
   bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const;
 
   // Sets |*size_bits| to be the length of the public key in bits, and sets
   // |*type| to one of the |PublicKeyType| values. In case of
   // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0.
   static void GetPublicKeyInfo(OSCertHandle cert_handle,
                                size_t* size_bits,
                                PublicKeyType* type);
 
-  // Returns the digest algorithm used in |cert_handle|'s signature.
-  // If the digest algorithm cannot be determined, or if it is not one
-  // of the explicitly enumerated values, kSignatureHashAlgorithmOther
-  // will be returned.
-  // NOTE: No validation of the signature is performed, and thus invalid
-  // signatures may result in seemingly meaningful values.
-  static SignatureHashAlgorithm GetSignatureHashAlgorithm(
-      OSCertHandle cert_handle);
-
   // Returns the OSCertHandle of this object. Because of caching, this may
   // differ from the OSCertHandle originally supplied during initialization.
   // Note: On Windows, CryptoAPI may return unexpected results if this handle
   // is used across multiple threads. For more details, see
   // CreateOSCertChainForCert().
   OSCertHandle os_cert_handle() const { return cert_handle_; }
 
   // Returns true if two OSCertHandles refer to identical certificates.
   static bool IsSameOSCert(OSCertHandle a, OSCertHandle b);
 
@@ skipping 120 matching lines @@
   // Untrusted intermediate certificates associated with this certificate
   // that may be needed for chain building.
   OSCertHandles intermediate_ca_certs_;
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_X509_CERTIFICATE_H_