Certificate Transparency: Code for unpacking EV cert hashes whitelist

net/cert/x509_certificate_win.cc

Index: net/cert/x509_certificate_win.cc
diff --git a/net/cert/x509_certificate_win.cc b/net/cert/x509_certificate_win.cc
index ab92b6f2a628fcc10185274291d2f9c353ae346f..44d8b222db31381549a6c963387e73eb4b53abe9 100644
--- a/net/cert/x509_certificate_win.cc
+++ b/net/cert/x509_certificate_win.cc
@@ -14,6 +14,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "crypto/capi_util.h"
 #include "crypto/scoped_capi_types.h"
+#include "crypto/sha2.h"
 #include "net/base/net_errors.h"
 
 #pragma comment(lib, "crypt32.lib")
@@ -315,6 +316,24 @@ SHA1HashValue X509Certificate::CalculateFingerprint(
   return sha1;
 }
 
+// static
+SHA256HashValue X509Certificate::CalculateFingerprint256(OSCertHandle cert) {
+  DCHECK(NULL != cert->pbCertEncoded);
+  DCHECK_NE(static_cast<DWORD>(0), cert->cbCertEncoded);

[Ryan Sleevi, 2014/10/01 20:15:43]

just use 0u ?

[Eran Messeri, 2014/10/03 12:00:11]

Done.

+
+  SHA256HashValue sha256;
+  DWORD sha256_size = sizeof(sha256.data);

[Ryan Sleevi, 2014/10/01 20:15:43]

No longer the correct type now, is it?

[Eran Messeri, 2014/10/03 12:00:11]

Done.

+
+  // Use crypto::SHA256HashString for two reasons:
+  // * < Windows Vista does not have universal SHA-256 support.
+  // * More efficient on Windows > Vista (less overhead since non-default CSP
+  // is not needed).
+  base::StringPiece der_cert(reinterpret_cast<const char*>(cert->pbCertEncoded),
+                             cert->cbCertEncoded);
+  crypto::SHA256HashString(der_cert, sha256.data, sha256_size);
+  return sha256;
+}
+
 // TODO(wtc): This function is implemented with NSS low-level hash
 // functions to ensure it is fast.  Reimplement this function with
 // CryptoAPI.  May need to cache the HCRYPTPROV to reduce the overhead.