Sign self-signed certs with SHA256.

net/cert/x509_util.cc

Index: net/cert/x509_util.cc
===================================================================
--- net/cert/x509_util.cc	(revision 229411)
+++ net/cert/x509_util.cc	(working copy)
@@ -4,13 +4,25 @@
 
 #include "net/cert/x509_util.h"
 
+#include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/time/time.h"
+#include "crypto/ec_private_key.h"
+#include "crypto/rsa_private_key.h"
 #include "net/cert/x509_certificate.h"
 
 namespace net {
 
 namespace x509_util {
 
+// RSA keys created by CreateKeyAndSelfSignedCert will be of this length.
+static const uint16 kRSAKeyLength = 1024;

[Ryan Sleevi, 2013/10/18 22:45:23]

Switching to SHA-256 but using RSA-1024 provides no security benefits. RSA-2048
or greater.

[bemasc, 2013/10/19 00:47:45]

Done.

[bemasc, 2013/10/21 17:46:06]

I've switched this back to RSA-1024.  juberti@ recommends that we land this
change with RSA-1024, and benchmark on the slowest supported ARM devices before
upgrading to 2048.

+
+// Certificates created by CreateKeyAndSelfSignedCert will be signed with this
+// digest algorithm.

[Ryan Sleevi, 2013/10/18 22:45:23]

It's a bit odd, this comment, since you use it in CreateKeyAndDomainBoundCertEC

[bemasc, 2013/10/19 00:47:45]

Fixed.

+static const crypto::HMAC::HashAlgorithm kSignatureDigestAlgorithm =
+    crypto::HMAC::SHA256;
+
 ClientCertSorter::ClientCertSorter() : now_(base::Time::Now()) {}
 
 bool ClientCertSorter::operator()(
@@ -44,6 +56,68 @@
   return a_intermediates.size() < b_intermediates.size();
 }
 
+bool CreateKeyAndDomainBoundCertEC(const std::string& domain,
+                                   uint32 serial_number,
+                                   base::Time not_valid_before,
+                                   base::Time not_valid_after,
+                                   crypto::ECPrivateKey** key,
+                                   std::string* der_cert) {
+  scoped_ptr<crypto::ECPrivateKey> new_key(crypto::ECPrivateKey::Create());
+  if (!new_key.get())
+    return false;
+
+  bool success = CreateDomainBoundCertECInternal(new_key.get(),
+                                                 kSignatureDigestAlgorithm,
+                                                 domain,
+                                                 serial_number,
+                                                 not_valid_before,
+                                                 not_valid_after,
+                                                 der_cert);
+  if (success) {
+    *key = new_key.release();
+  }
+  return success;
+}
+
+bool CreateKeyAndSelfSignedCert(const std::string& subject,
+                                uint32 serial_number,
+                                base::Time not_valid_before,
+                                base::Time not_valid_after,
+                                crypto::RSAPrivateKey** key,
+                                std::string* der_cert) {
+  scoped_ptr<crypto::RSAPrivateKey> new_key(
+      crypto::RSAPrivateKey::Create(kRSAKeyLength));
+  if (!new_key.get())
+    return false;
+
+  bool success = CreateSelfSignedCertInternal(new_key.get(),
+                                              kSignatureDigestAlgorithm,
+                                              subject,
+                                              serial_number,
+                                              not_valid_before,
+                                              not_valid_after,
+                                              der_cert);
+  if (success) {
+    *key = new_key.release();
+  }
+  return success;
+}
+
+bool CreateSha1SelfSignedCert(crypto::RSAPrivateKey* key,
+                                    const std::string& subject,
+                                    uint32 serial_number,
+                                    base::Time not_valid_before,
+                                    base::Time not_valid_after,
+                                    std::string* der_cert) {
+  return CreateSelfSignedCertInternal(key,
+                                      crypto::HMAC::SHA1,
+                                      subject,
+                                      serial_number,
+                                      not_valid_before,
+                                      not_valid_after,
+                                      der_cert);
+}
+
 }  // namespace x509_util
 
 }  // namespace net