[webcrypto] Add RSA key generation using NSS.

content/renderer/webcrypto/webcrypto_impl.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/webcrypto/webcrypto_impl.h"
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "third_party/WebKit/public/platform/WebArrayBuffer.h"
 #include "third_party/WebKit/public/platform/WebCryptoAlgorithm.h"
 #include "third_party/WebKit/public/platform/WebCryptoKey.h"
 
 namespace content {
 
+namespace {
+
+bool IsAlgorithmAsymmetric(const WebKit::WebCryptoAlgorithm& algorithm) {
+  const WebKit::WebCryptoAlgorithmId algorithm_id = algorithm.id();

[eroman, 2013/10/31 22:18:36]

[optional]: seems equally short to inline.

[padolph, 2013/11/01 20:35:31]

Done.

+  // TODO(padolph): include all other asymmetric algorithms once they are
+  // defined, e.g. EC and DH.
+  return (algorithm_id == WebKit::WebCryptoAlgorithmIdRsaEsPkcs1v1_5 ||
+          algorithm_id == WebKit::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 ||
+          algorithm_id == WebKit::WebCryptoAlgorithmIdRsaOaep);
+}
+
+}  // namespace
+
 WebCryptoImpl::WebCryptoImpl() {
   Init();
 }
 
 // static
 // TODO(eroman): This works by re-allocating a new buffer. It would be better if
 //               the WebArrayBuffer could just be truncated instead.
 void WebCryptoImpl::ShrinkBuffer(
     WebKit::WebArrayBuffer* buffer,
     unsigned new_size) {
@@ skipping 62 matching lines @@
     result.completeWithBuffer(buffer);
   }
 }
 
 void WebCryptoImpl::generateKey(
     const WebKit::WebCryptoAlgorithm& algorithm,
     bool extractable,
     WebKit::WebCryptoKeyUsageMask usage_mask,
     WebKit::WebCryptoResult result) {
   DCHECK(!algorithm.isNull());
-  WebKit::WebCryptoKey key = NullKey();
-  if (!GenerateKeyInternal(algorithm, extractable, usage_mask, &key)) {
-    result.completeWithError();
+  if (IsAlgorithmAsymmetric(algorithm)) {
+    WebKit::WebCryptoKey public_key = NullKey();

[eroman, 2013/10/31 22:18:36]

[optional]: I recommend using WebKit::WebCryptoKey::createNull() in place of
NullKey(). That way if my changelist lands before yours (which removes
NullKey()) you won't have to rebase.

[padolph, 2013/11/01 20:35:31]

Done.

+    WebKit::WebCryptoKey private_key = NullKey();
+    if (!GenerateKeyPairInternal(
+             algorithm, extractable, usage_mask, &public_key, &private_key)) {
+      result.completeWithError();
+    } else {
+      DCHECK(public_key.handle());
+      DCHECK(private_key.handle());
+      DCHECK_EQ(algorithm.id(), public_key.algorithm().id());
+      DCHECK_EQ(algorithm.id(), private_key.algorithm().id());
+      DCHECK_EQ(true, public_key.extractable());

[eroman, 2013/10/31 22:18:36]

Shouldn't this be comparing against "extractable" not "true"?

[padolph, 2013/11/01 20:35:31]

This is related to the spec bug you and Ryan discussed in the comments in this
CL in webcrypto_impl_nss.cc. I'll switch it to the (IMO errant) behavior and add
a comment referencing the bug.

+      DCHECK_EQ(extractable, private_key.extractable());
+      DCHECK_EQ(usage_mask, public_key.usages());
+      DCHECK_EQ(usage_mask, private_key.usages());
+      result.completeWithKeyPair(public_key, private_key);
+    }
   } else {
-    DCHECK(key.handle());
-    DCHECK_EQ(algorithm.id(), key.algorithm().id());
-    DCHECK_EQ(extractable, key.extractable());
-    DCHECK_EQ(usage_mask, key.usages());
-    result.completeWithKey(key);
+    WebKit::WebCryptoKey key = NullKey();
+    if (!GenerateKeyInternal(algorithm, extractable, usage_mask, &key)) {
+      result.completeWithError();
+    } else {
+      DCHECK(key.handle());
+      DCHECK_EQ(algorithm.id(), key.algorithm().id());
+      DCHECK_EQ(extractable, key.extractable());
+      DCHECK_EQ(usage_mask, key.usages());
+      result.completeWithKey(key);
+    }
   }
 }
 
 void WebCryptoImpl::importKey(
     WebKit::WebCryptoKeyFormat format,
     const unsigned char* key_data,
     unsigned key_data_size,
     const WebKit::WebCryptoAlgorithm& algorithm_or_null,
     bool extractable,
     WebKit::WebCryptoKeyUsageMask usage_mask,
@@ skipping 47 matching lines @@
                                data,
                                data_size,
                                &signature_match)) {
     result.completeWithError();
   } else {
     result.completeWithBoolean(signature_match);
   }
 }
 
 }  // namespace content