| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <secerr.h> | 5 #include <secerr.h> |
| 6 | 6 |
| 7 #include "content/child/webcrypto/crypto_data.h" | 7 #include "content/child/webcrypto/crypto_data.h" |
| 8 #include "content/child/webcrypto/nss/aes_key_nss.h" | 8 #include "content/child/webcrypto/nss/aes_key_nss.h" |
| 9 #include "content/child/webcrypto/nss/key_nss.h" | 9 #include "content/child/webcrypto/nss/key_nss.h" |
| 10 #include "content/child/webcrypto/nss/sym_key_nss.h" | 10 #include "content/child/webcrypto/nss/sym_key_nss.h" |
| (...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 81 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA) | 81 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA) |
| 82 return Status::OperationError(); | 82 return Status::OperationError(); |
| 83 #endif | 83 #endif |
| 84 | 84 |
| 85 *unwrapped_key = new_key.Pass(); | 85 *unwrapped_key = new_key.Pass(); |
| 86 return Status::Success(); | 86 return Status::Success(); |
| 87 } | 87 } |
| 88 | 88 |
| 89 Status WrapSymKeyAesKw(PK11SymKey* key, | 89 Status WrapSymKeyAesKw(PK11SymKey* key, |
| 90 PK11SymKey* wrapping_key, | 90 PK11SymKey* wrapping_key, |
| 91 std::vector<uint8>* buffer) { | 91 std::vector<uint8_t>* buffer) { |
| 92 // The data size must be at least 16 bytes and a multiple of 8 bytes. | 92 // The data size must be at least 16 bytes and a multiple of 8 bytes. |
| 93 // RFC 3394 does not specify a maximum allowed data length, but since only | 93 // RFC 3394 does not specify a maximum allowed data length, but since only |
| 94 // keys are being wrapped in this application (which are small), a reasonable | 94 // keys are being wrapped in this application (which are small), a reasonable |
| 95 // max limit is whatever will fit into an unsigned. For the max size test, | 95 // max limit is whatever will fit into an unsigned. For the max size test, |
| 96 // note that AES Key Wrap always adds 8 bytes to the input data size. | 96 // note that AES Key Wrap always adds 8 bytes to the input data size. |
| 97 const unsigned int input_length = PK11_GetKeyLength(key); | 97 const unsigned int input_length = PK11_GetKeyLength(key); |
| 98 DCHECK_GE(input_length, 16u); | 98 DCHECK_GE(input_length, 16u); |
| 99 DCHECK((input_length % 8) == 0); | 99 DCHECK((input_length % 8) == 0); |
| 100 if (input_length > UINT_MAX - 8) | 100 if (input_length > UINT_MAX - 8) |
| 101 return Status::ErrorDataTooLarge(); | 101 return Status::ErrorDataTooLarge(); |
| (...skipping 26 matching lines...) Expand all Loading... |
| 128 AesKwCryptoAlgorithmNss() | 128 AesKwCryptoAlgorithmNss() |
| 129 : AesAlgorithm( | 129 : AesAlgorithm( |
| 130 CKM_NSS_AES_KEY_WRAP, | 130 CKM_NSS_AES_KEY_WRAP, |
| 131 CKF_WRAP | CKF_WRAP, | 131 CKF_WRAP | CKF_WRAP, |
| 132 blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey, | 132 blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey, |
| 133 "KW") {} | 133 "KW") {} |
| 134 | 134 |
| 135 virtual Status Encrypt(const blink::WebCryptoAlgorithm& algorithm, | 135 virtual Status Encrypt(const blink::WebCryptoAlgorithm& algorithm, |
| 136 const blink::WebCryptoKey& wrapping_key, | 136 const blink::WebCryptoKey& wrapping_key, |
| 137 const CryptoData& data, | 137 const CryptoData& data, |
| 138 std::vector<uint8>* buffer) const OVERRIDE { | 138 std::vector<uint8_t>* buffer) const OVERRIDE { |
| 139 if (data.byte_length() < 16) | 139 if (data.byte_length() < 16) |
| 140 return Status::ErrorDataTooSmall(); | 140 return Status::ErrorDataTooSmall(); |
| 141 if (data.byte_length() % 8) | 141 if (data.byte_length() % 8) |
| 142 return Status::ErrorInvalidAesKwDataLength(); | 142 return Status::ErrorInvalidAesKwDataLength(); |
| 143 | 143 |
| 144 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must | 144 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must |
| 145 // be temporarily viewed as a symmetric key to be wrapped (encrypted). | 145 // be temporarily viewed as a symmetric key to be wrapped (encrypted). |
| 146 SECItem data_item = MakeSECItemForBuffer(data); | 146 SECItem data_item = MakeSECItemForBuffer(data); |
| 147 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); | 147 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); |
| 148 crypto::ScopedPK11SymKey data_as_sym_key( | 148 crypto::ScopedPK11SymKey data_as_sym_key( |
| 149 PK11_ImportSymKey(slot.get(), | 149 PK11_ImportSymKey(slot.get(), |
| 150 CKK_GENERIC_SECRET, | 150 CKK_GENERIC_SECRET, |
| 151 PK11_OriginUnwrap, | 151 PK11_OriginUnwrap, |
| 152 CKA_SIGN, | 152 CKA_SIGN, |
| 153 &data_item, | 153 &data_item, |
| 154 NULL)); | 154 NULL)); |
| 155 if (!data_as_sym_key) | 155 if (!data_as_sym_key) |
| 156 return Status::OperationError(); | 156 return Status::OperationError(); |
| 157 | 157 |
| 158 return WrapSymKeyAesKw( | 158 return WrapSymKeyAesKw( |
| 159 data_as_sym_key.get(), SymKeyNss::Cast(wrapping_key)->key(), buffer); | 159 data_as_sym_key.get(), SymKeyNss::Cast(wrapping_key)->key(), buffer); |
| 160 } | 160 } |
| 161 | 161 |
| 162 virtual Status Decrypt(const blink::WebCryptoAlgorithm& algorithm, | 162 virtual Status Decrypt(const blink::WebCryptoAlgorithm& algorithm, |
| 163 const blink::WebCryptoKey& wrapping_key, | 163 const blink::WebCryptoKey& wrapping_key, |
| 164 const CryptoData& data, | 164 const CryptoData& data, |
| 165 std::vector<uint8>* buffer) const OVERRIDE { | 165 std::vector<uint8_t>* buffer) const OVERRIDE { |
| 166 if (data.byte_length() < 24) | 166 if (data.byte_length() < 24) |
| 167 return Status::ErrorDataTooSmall(); | 167 return Status::ErrorDataTooSmall(); |
| 168 if (data.byte_length() % 8) | 168 if (data.byte_length() % 8) |
| 169 return Status::ErrorInvalidAesKwDataLength(); | 169 return Status::ErrorInvalidAesKwDataLength(); |
| 170 | 170 |
| 171 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must | 171 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must |
| 172 // be temporarily viewed as a symmetric key to be unwrapped (decrypted). | 172 // be temporarily viewed as a symmetric key to be unwrapped (decrypted). |
| 173 crypto::ScopedPK11SymKey decrypted; | 173 crypto::ScopedPK11SymKey decrypted; |
| 174 Status status = DoUnwrapSymKeyAesKw(data, | 174 Status status = DoUnwrapSymKeyAesKw(data, |
| 175 SymKeyNss::Cast(wrapping_key)->key(), | 175 SymKeyNss::Cast(wrapping_key)->key(), |
| (...skipping 18 matching lines...) Expand all Loading... |
| 194 | 194 |
| 195 } // namespace | 195 } // namespace |
| 196 | 196 |
| 197 AlgorithmImplementation* CreatePlatformAesKwImplementation() { | 197 AlgorithmImplementation* CreatePlatformAesKwImplementation() { |
| 198 return new AesKwCryptoAlgorithmNss; | 198 return new AesKwCryptoAlgorithmNss; |
| 199 } | 199 } |
| 200 | 200 |
| 201 } // namespace webcrypto | 201 } // namespace webcrypto |
| 202 | 202 |
| 203 } // namespace content | 203 } // namespace content |
| OLD | NEW |