OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "components/rappor/byte_vector_utils.h" | |
6 | |
7 #include <string> | |
8 | |
9 #include "base/logging.h" | |
10 #include "base/rand_util.h" | |
11 #include "base/strings/string_number_conversions.h" | |
12 #include "crypto/random.h" | |
13 | |
14 namespace rappor { | |
15 | |
16 ByteVector* ByteVectorOr(const ByteVector& lhs, ByteVector* rhs) { | |
17 DCHECK_EQ(lhs.size(), rhs->size()); | |
18 for (size_t i = 0, len = lhs.size(); i < len; ++i) { | |
19 (*rhs)[i] = lhs[i] | (*rhs)[i]; | |
20 } | |
21 return rhs; | |
22 } | |
23 | |
24 ByteVector* ByteVectorMerge(const ByteVector& mask, | |
25 const ByteVector& lhs, | |
26 ByteVector* rhs) { | |
27 DCHECK_EQ(lhs.size(), rhs->size()); | |
28 for (size_t i = 0, len = lhs.size(); i < len; ++i) { | |
29 (*rhs)[i] = (lhs[i] & ~mask[i]) | ((*rhs)[i] & mask[i]); | |
30 } | |
31 return rhs; | |
32 } | |
33 | |
34 int CountBits(const ByteVector& vector) { | |
35 int bit_count = 0; | |
36 for(size_t i = 0; i < vector.size(); ++i) { | |
Alexei Svitkine (slow)
2014/02/12 18:13:05
Nit: space after for
Steven Holte
2014/02/12 22:28:50
Done.
| |
37 uint8_t byte = vector[i]; | |
38 for (int j = 0; j < 8 ; ++j) { | |
39 if (byte & (1 << j)) | |
40 bit_count++; | |
41 } | |
42 } | |
43 return bit_count; | |
44 } | |
45 | |
46 ByteVectorGenerator::ByteVectorGenerator(size_t byte_count) | |
47 : byte_count_(byte_count) {} | |
48 | |
49 ByteVectorGenerator::~ByteVectorGenerator() {} | |
50 | |
51 ByteVector ByteVectorGenerator::GetRandomByteVector() { | |
52 ByteVector bytes(byte_count_); | |
53 crypto::RandBytes(&bytes[0], bytes.size()); | |
54 return bytes; | |
55 } | |
56 | |
57 ByteVector ByteVectorGenerator::GetWeightedRandomByteVector( | |
58 Probability probability) { | |
59 ByteVector bytes = GetRandomByteVector(); | |
60 switch (probability) { | |
61 case PROBABILITY_75: | |
62 return *ByteVectorOr(GetRandomByteVector(), &bytes); | |
63 case PROBABILITY_50: | |
64 return bytes; | |
65 } | |
66 NOTREACHED(); | |
67 return bytes; | |
68 } | |
69 | |
70 HmacByteVectorGenerator::HmacByteVectorGenerator( | |
71 size_t byte_count, | |
72 const std::string& entropy_input, | |
73 const std::string& personalization_string) | |
74 : ByteVectorGenerator(byte_count), | |
75 hmac_(crypto::HMAC::SHA256), | |
76 value_(hmac_.DigestLength(), 0x01), | |
77 requested_bytes_(0) { | |
78 // HMAC_DRBG Instantiate Process | |
79 // 1. seed_material = entropy_input + nonce + personalization_string | |
80 // Note: We are using the 8.6.7 interpretation, where the entropy_input and | |
81 // nonce are acquired at the same time from the same source. | |
82 DCHECK_EQ(entropy_input.size(), kEntropyInputSize); | |
Alexei Svitkine (slow)
2014/02/12 18:13:05
Nit: expected value should be on the left
Steven Holte
2014/02/12 22:28:50
Done.
| |
83 std::string seed_material(entropy_input + personalization_string); | |
84 // 2. Key = 0x00 00...00 | |
85 ByteVector key(hmac_.DigestLength(), 0x00); | |
86 // 3. V = 0x01 01...01 | |
87 // (value_ in initializer list) | |
88 | |
89 // 4. (Key, V) = HMAC_DRBG_Update(seed_material, Key, V) | |
90 Update(seed_material, key); | |
91 } | |
92 | |
93 HmacByteVectorGenerator::~HmacByteVectorGenerator() {} | |
94 | |
95 const size_t HmacByteVectorGenerator::kEntropyInputSize = (128 / 8) * 3 / 2; | |
96 | |
97 // static | |
98 std::string HmacByteVectorGenerator::GenerateEntropyInput() { | |
99 return base::RandBytesAsString(kEntropyInputSize); | |
100 } | |
101 | |
102 void HmacByteVectorGenerator::Update(const std::string& provided_data, | |
103 const ByteVector& key1) { | |
104 std::string value1(value_.begin(), value_.end()); | |
105 // HMAC_DRBG Update Process | |
106 // 1. K = HMAC(K, V || 0x00 || provided_data) | |
107 ByteVector key2(hmac_.DigestLength()); | |
108 crypto::HMAC hmac1(crypto::HMAC::SHA256); | |
109 if (!hmac1.Init(std::string(key1.begin(), key1.end()))) | |
Alexei Svitkine (slow)
2014/02/12 18:13:05
I'm not super happy with the amount of copying of
Steven Holte
2014/02/12 22:28:50
Using StringPiece.
| |
110 NOTREACHED(); | |
111 if (!hmac1.Sign(value1 + char(0x00) + provided_data, &key2[0], key2.size())) | |
112 NOTREACHED(); | |
113 // 2. V = HMAC(K, V) | |
114 crypto::HMAC hmac2(crypto::HMAC::SHA256); | |
115 if (!hmac2.Init(std::string(key2.begin(), key2.end()))) | |
116 NOTREACHED(); | |
117 if (!hmac2.Sign(value1, &value_[0], value_.size())) | |
118 NOTREACHED(); | |
119 // 3. If (provided_data = Null), then return K and V. | |
120 DCHECK_GE(provided_data.size(), kEntropyInputSize); | |
121 // 4. K = HMAC(K, V || 0x01 || provided_data) | |
122 std::string value2(value_.begin(), value_.end()); | |
123 ByteVector key3(hmac_.DigestLength()); | |
124 if (!hmac2.Sign(value2 + char(0x01) + provided_data, &key3[0], key3.size())) | |
Alexei Svitkine (slow)
2014/02/12 18:13:05
This logic seems very similar to what you do for t
Steven Holte
2014/02/12 22:28:50
Added helper function for K = HMAC(K, data)
Alexei Svitkine (slow)
2014/02/12 22:42:36
Thanks, this is much cleaner!
| |
125 NOTREACHED(); | |
126 // 5. V = HMAC(K, V) | |
127 if (!hmac_.Init(std::string(key3.begin(), key3.end()))) | |
128 NOTREACHED(); | |
129 if (!hmac_.Sign(value2, &value_[0], value_.size())) | |
130 NOTREACHED(); | |
131 } | |
132 | |
133 ByteVector HmacByteVectorGenerator::GetRandomByteVector() { | |
134 ByteVector bytes(byte_count_); | |
135 uint8_t* data = bytes.data(); | |
136 size_t digest_length = hmac_.DigestLength(); | |
Alexei Svitkine (slow)
2014/02/12 18:13:05
Nit: const
I'd also put this at the top of the fu
Steven Holte
2014/02/12 22:28:50
Done.
| |
137 size_t bytes_to_go = byte_count_; | |
138 while (bytes_to_go > 0) { | |
139 size_t requested_byte_in_digest = requested_bytes_ % digest_length; | |
140 if (requested_byte_in_digest == 0) { | |
141 // Do step 4.1 of the HMAC_DRBG Generate Process for more bits. | |
142 // V = HMAC(Key, V) | |
143 if (!hmac_.Sign(std::string(value_.begin(), value_.end()), | |
144 &value_[0], value_.size())) { | |
145 NOTREACHED(); | |
146 } | |
147 } | |
148 size_t n = std::min(bytes_to_go, | |
149 digest_length - requested_byte_in_digest); | |
150 memcpy(data, &value_[requested_byte_in_digest], n); | |
151 data += n; | |
152 bytes_to_go -= n; | |
153 requested_bytes_ += n; | |
154 // Check max_number_of_bits_per_request from 10.1 Table 2 | |
155 // max_number_of_bits_per_request == 2^19 bits == 2^16 bytes | |
156 DCHECK_LT(requested_bytes_, 1U << 16); | |
157 } | |
158 return bytes; | |
159 } | |
160 | |
161 } // namespace rappor | |
OLD | NEW |