enterprise.platformKeys: Respect the 'hash' argument of generateKey.

chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js

Index: chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js
diff --git a/chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js b/chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js
index b3aece17fdc6491a00294aa75ba5f4c092dcced3..531d46b70256b7c3b8f94f16c1addc76b9a2048b 100644
--- a/chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js
+++ b/chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js
@@ -118,7 +118,7 @@ SubtleCryptoImpl.prototype.generateKey =
         reject(CreateOperationError());
         return;
       }
-      resolve(new KeyPair(spki, algorithm, keyUsages));
+      resolve(new KeyPair(spki, normalizedAlgorithmParameters, keyUsages));
     });
   });
 };
@@ -141,16 +141,19 @@ SubtleCryptoImpl.prototype.sign = function(algorithm, key, dataView) {
     // might contain more data than dataView.
     var data = dataView.buffer.slice(dataView.byteOffset,
                                      dataView.byteOffset + dataView.byteLength);
-    internalAPI.sign(
-        subtleCrypto.tokenId, getSpki(key), data, function(signature) {
-          if (catchInvalidTokenError(reject))
-            return;
-          if (chrome.runtime.lastError) {
-            reject(CreateOperationError());
-            return;
-          }
-          resolve(signature);
-        });
+    internalAPI.sign(subtleCrypto.tokenId,
+                     getSpki(key),
+                     key.algorithm.hash.name,

[eroman, 2014/06/17 18:25:22]

Are users able to manipulate key.algorith.hash.name? Without your other freezing
change, this would then allow using the key with different hashes, which is not
desirable for the API.

To avoid this, can the hash instead be stored in the table that maps the public
key? I am not sure that it is really possible to prevent key.algorithm.hash.name
from being manipulated.

[pneubeck (no reviews), 2014/06/17 18:31:30]

I'll update the other CL now, which will copy the whole dictionary on each
access.

+                     data,
+                     function(signature) {
+      if (catchInvalidTokenError(reject))
+        return;
+      if (chrome.runtime.lastError) {
+        reject(CreateOperationError());
+        return;
+      }
+      resolve(signature);
+    });
   });
 };