OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <secerr.h> | 5 #include <secerr.h> |
6 | 6 |
7 #include "content/child/webcrypto/crypto_data.h" | 7 #include "content/child/webcrypto/crypto_data.h" |
8 #include "content/child/webcrypto/nss/aes_key_nss.h" | 8 #include "content/child/webcrypto/nss/aes_key_nss.h" |
9 #include "content/child/webcrypto/nss/key_nss.h" | 9 #include "content/child/webcrypto/nss/key_nss.h" |
10 #include "content/child/webcrypto/nss/sym_key_nss.h" | 10 #include "content/child/webcrypto/nss/sym_key_nss.h" |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
81 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA) | 81 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA) |
82 return Status::OperationError(); | 82 return Status::OperationError(); |
83 #endif | 83 #endif |
84 | 84 |
85 *unwrapped_key = new_key.Pass(); | 85 *unwrapped_key = new_key.Pass(); |
86 return Status::Success(); | 86 return Status::Success(); |
87 } | 87 } |
88 | 88 |
89 Status WrapSymKeyAesKw(PK11SymKey* key, | 89 Status WrapSymKeyAesKw(PK11SymKey* key, |
90 PK11SymKey* wrapping_key, | 90 PK11SymKey* wrapping_key, |
91 std::vector<uint8>* buffer) { | 91 std::vector<uint8_t>* buffer) { |
92 // The data size must be at least 16 bytes and a multiple of 8 bytes. | 92 // The data size must be at least 16 bytes and a multiple of 8 bytes. |
93 // RFC 3394 does not specify a maximum allowed data length, but since only | 93 // RFC 3394 does not specify a maximum allowed data length, but since only |
94 // keys are being wrapped in this application (which are small), a reasonable | 94 // keys are being wrapped in this application (which are small), a reasonable |
95 // max limit is whatever will fit into an unsigned. For the max size test, | 95 // max limit is whatever will fit into an unsigned. For the max size test, |
96 // note that AES Key Wrap always adds 8 bytes to the input data size. | 96 // note that AES Key Wrap always adds 8 bytes to the input data size. |
97 const unsigned int input_length = PK11_GetKeyLength(key); | 97 const unsigned int input_length = PK11_GetKeyLength(key); |
98 DCHECK_GE(input_length, 16u); | 98 DCHECK_GE(input_length, 16u); |
99 DCHECK((input_length % 8) == 0); | 99 DCHECK((input_length % 8) == 0); |
100 if (input_length > UINT_MAX - 8) | 100 if (input_length > UINT_MAX - 8) |
101 return Status::ErrorDataTooLarge(); | 101 return Status::ErrorDataTooLarge(); |
(...skipping 26 matching lines...) Expand all Loading... |
128 AesKwCryptoAlgorithmNss() | 128 AesKwCryptoAlgorithmNss() |
129 : AesAlgorithm( | 129 : AesAlgorithm( |
130 CKM_NSS_AES_KEY_WRAP, | 130 CKM_NSS_AES_KEY_WRAP, |
131 CKF_WRAP | CKF_WRAP, | 131 CKF_WRAP | CKF_WRAP, |
132 blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey, | 132 blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey, |
133 "KW") {} | 133 "KW") {} |
134 | 134 |
135 virtual Status Encrypt(const blink::WebCryptoAlgorithm& algorithm, | 135 virtual Status Encrypt(const blink::WebCryptoAlgorithm& algorithm, |
136 const blink::WebCryptoKey& wrapping_key, | 136 const blink::WebCryptoKey& wrapping_key, |
137 const CryptoData& data, | 137 const CryptoData& data, |
138 std::vector<uint8>* buffer) const OVERRIDE { | 138 std::vector<uint8_t>* buffer) const OVERRIDE { |
139 if (data.byte_length() < 16) | 139 if (data.byte_length() < 16) |
140 return Status::ErrorDataTooSmall(); | 140 return Status::ErrorDataTooSmall(); |
141 if (data.byte_length() % 8) | 141 if (data.byte_length() % 8) |
142 return Status::ErrorInvalidAesKwDataLength(); | 142 return Status::ErrorInvalidAesKwDataLength(); |
143 | 143 |
144 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must | 144 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must |
145 // be temporarily viewed as a symmetric key to be wrapped (encrypted). | 145 // be temporarily viewed as a symmetric key to be wrapped (encrypted). |
146 SECItem data_item = MakeSECItemForBuffer(data); | 146 SECItem data_item = MakeSECItemForBuffer(data); |
147 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); | 147 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot()); |
148 crypto::ScopedPK11SymKey data_as_sym_key( | 148 crypto::ScopedPK11SymKey data_as_sym_key( |
149 PK11_ImportSymKey(slot.get(), | 149 PK11_ImportSymKey(slot.get(), |
150 CKK_GENERIC_SECRET, | 150 CKK_GENERIC_SECRET, |
151 PK11_OriginUnwrap, | 151 PK11_OriginUnwrap, |
152 CKA_SIGN, | 152 CKA_SIGN, |
153 &data_item, | 153 &data_item, |
154 NULL)); | 154 NULL)); |
155 if (!data_as_sym_key) | 155 if (!data_as_sym_key) |
156 return Status::OperationError(); | 156 return Status::OperationError(); |
157 | 157 |
158 return WrapSymKeyAesKw( | 158 return WrapSymKeyAesKw( |
159 data_as_sym_key.get(), SymKeyNss::Cast(wrapping_key)->key(), buffer); | 159 data_as_sym_key.get(), SymKeyNss::Cast(wrapping_key)->key(), buffer); |
160 } | 160 } |
161 | 161 |
162 virtual Status Decrypt(const blink::WebCryptoAlgorithm& algorithm, | 162 virtual Status Decrypt(const blink::WebCryptoAlgorithm& algorithm, |
163 const blink::WebCryptoKey& wrapping_key, | 163 const blink::WebCryptoKey& wrapping_key, |
164 const CryptoData& data, | 164 const CryptoData& data, |
165 std::vector<uint8>* buffer) const OVERRIDE { | 165 std::vector<uint8_t>* buffer) const OVERRIDE { |
166 if (data.byte_length() < 24) | 166 if (data.byte_length() < 24) |
167 return Status::ErrorDataTooSmall(); | 167 return Status::ErrorDataTooSmall(); |
168 if (data.byte_length() % 8) | 168 if (data.byte_length() % 8) |
169 return Status::ErrorInvalidAesKwDataLength(); | 169 return Status::ErrorInvalidAesKwDataLength(); |
170 | 170 |
171 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must | 171 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must |
172 // be temporarily viewed as a symmetric key to be unwrapped (decrypted). | 172 // be temporarily viewed as a symmetric key to be unwrapped (decrypted). |
173 crypto::ScopedPK11SymKey decrypted; | 173 crypto::ScopedPK11SymKey decrypted; |
174 Status status = DoUnwrapSymKeyAesKw(data, | 174 Status status = DoUnwrapSymKeyAesKw(data, |
175 SymKeyNss::Cast(wrapping_key)->key(), | 175 SymKeyNss::Cast(wrapping_key)->key(), |
(...skipping 18 matching lines...) Expand all Loading... |
194 | 194 |
195 } // namespace | 195 } // namespace |
196 | 196 |
197 AlgorithmImplementation* CreatePlatformAesKwImplementation() { | 197 AlgorithmImplementation* CreatePlatformAesKwImplementation() { |
198 return new AesKwCryptoAlgorithmNss; | 198 return new AesKwCryptoAlgorithmNss; |
199 } | 199 } |
200 | 200 |
201 } // namespace webcrypto | 201 } // namespace webcrypto |
202 | 202 |
203 } // namespace content | 203 } // namespace content |
OLD | NEW |