enterprise.platformKeys: Respect the 'hash' argument of generateKey.

chrome/browser/chromeos/platform_keys/platform_keys_nss.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/platform_keys/platform_keys.h"
 
 #include <cryptohi.h>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 133 matching lines @@
   const unsigned int modulus_length_;
 
  private:
   // Must be called on origin thread, use CallBack() therefore.
   GenerateKeyCallback callback_;
 };
 
 class SignState : public NSSOperationState {
  public:
   SignState(const std::string& public_key,
+            const std::string& hash_algorithm_name,
             const std::string& data,
             const SignCallback& callback);
   virtual ~SignState() {}
 
   virtual void OnError(const tracked_objects::Location& from,
                        const std::string& error_message) OVERRIDE {
     CallBack(from, std::string() /* no signature */, error_message);
   }
 
   void CallBack(const tracked_objects::Location& from,
                 const std::string& signature,
                 const std::string& error_message) {
     origin_task_runner_->PostTask(
         from, base::Bind(callback_, signature, error_message));
   }
 
   const std::string public_key_;
+  const std::string hash_algorithm_name_;
   const std::string data_;
 
  private:
   // Must be called on origin thread, use CallBack() therefore.
   SignCallback callback_;
 };
 
 class GetCertificatesState : public NSSOperationState {
  public:
   explicit GetCertificatesState(const GetCertificatesCallback& callback);
@@ skipping 70 matching lines @@
     : origin_task_runner_(base::ThreadTaskRunnerHandle::Get()) {
 }
 
 GenerateRSAKeyState::GenerateRSAKeyState(unsigned int modulus_length,
                                          const GenerateKeyCallback& callback)
     : modulus_length_(modulus_length),
       callback_(callback) {
 }
 
 SignState::SignState(const std::string& public_key,
+                     const std::string& hash_algorithm_name,
                      const std::string& data,
                      const SignCallback& callback)
-    : public_key_(public_key), data_(data), callback_(callback) {
+    : public_key_(public_key),
+      hash_algorithm_name_(hash_algorithm_name),
+      data_(data),
+      callback_(callback) {
 }
 
 GetCertificatesState::GetCertificatesState(
     const GetCertificatesCallback& callback)
     : callback_(callback) {
 }
 
 ImportCertificateState::ImportCertificateState(
     scoped_refptr<net::X509Certificate> certificate,
     const ImportCertificateCallback& callback)
@@ skipping 51 matching lines @@
       public_key_uint8, public_key_uint8 + state->public_key_.size());
 
   // TODO(pneubeck): This searches all slots. Change to look only at |slot_|.
   scoped_ptr<crypto::RSAPrivateKey> rsa_key(
       crypto::RSAPrivateKey::FindFromPublicKeyInfo(public_key_vector));
   if (!rsa_key || rsa_key->key()->pkcs11Slot != state->slot_) {
     state->OnError(FROM_HERE, kErrorKeyNotFound);
     return;
   }
 
+  SECOidTag sign_alg_tag;
+  if (state->hash_algorithm_name_ == "SHA-1") {
+    sign_alg_tag = SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION;

[not at google - send to devlin, 2014/06/16 17:05:31]

can you just pass in this enum rather than parsing it?

[pneubeck (no reviews), 2014/06/17 09:12:17]

SECOidTag is NSS specific and can't be moved to the header.
I added an enum specific to platform_keys, which makes this implementation at
least independent of these particular strings.

[not at google - send to devlin, 2014/06/17 18:18:48]

I see. If the schema compiler issue were fixed to generate enums properly then
you could pass those in right?

+  } else if (state->hash_algorithm_name_ == "SHA-256") {
+    sign_alg_tag = SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION;
+  } else if (state->hash_algorithm_name_ == "SHA-384") {
+    sign_alg_tag = SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION;
+  } else if (state->hash_algorithm_name_ == "SHA-512") {
+    sign_alg_tag = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION;
+  } else {
+    state->OnError(FROM_HERE, kErrorAlgorithmNotSupported);
+    return;
+  }
+
   SECItem sign_result = {siBuffer, NULL, 0};
   if (SEC_SignData(&sign_result,
                    reinterpret_cast<const unsigned char*>(state->data_.data()),
                    state->data_.size(),
                    rsa_key->key(),
-                   SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION) != SECSuccess) {
+                   sign_alg_tag) != SECSuccess) {
     LOG(ERROR) << "Couldn't sign.";
     state->OnError(FROM_HERE, kErrorInternal);
     return;
   }
 
   std::string signature(reinterpret_cast<const char*>(sign_result.data),
                         sign_result.len);
   state->CallBack(FROM_HERE, signature, std::string() /* no error */);
 }
 
@@ skipping 134 matching lines @@
   // Get the pointer to |state| before base::Passed releases |state|.
   NSSOperationState* state_ptr = state.get();
   GetCertDatabase(token_id,
                   base::Bind(&GenerateRSAKeyWithDB, base::Passed(&state)),
                   profile,
                   state_ptr);
 }
 
 void Sign(const std::string& token_id,
           const std::string& public_key,
+          const std::string& hash_algorithm_name,
           const std::string& data,
           const SignCallback& callback,
           Profile* profile) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  scoped_ptr<SignState> state(new SignState(public_key, data, callback));
+  scoped_ptr<SignState> state(
+      new SignState(public_key, hash_algorithm_name, data, callback));
   // Get the pointer to |state| before base::Passed releases |state|.
   NSSOperationState* state_ptr = state.get();
 
   // The NSSCertDatabase object is not required. But in case it's not available
   // we would get more informative error messages and we can double check that
   // we use a key of the correct token.
   GetCertDatabase(token_id,
                   base::Bind(&RSASignWithDB, base::Passed(&state)),
                   profile,
                   state_ptr);
@@ skipping 45 matching lines @@
   // we would get more informative error messages.
   GetCertDatabase(token_id,
                   base::Bind(&RemoveCertificateWithDB, base::Passed(&state)),
                   profile,
                   state_ptr);
 }
 
 }  // namespace platform_keys
 
 }  // namespace chromeos