| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/ct_log_verifier.h" | 5 #include "net/cert/ct_log_verifier.h" |
| 6 | 6 |
| 7 #include <cryptohi.h> | 7 #include <cryptohi.h> |
| 8 #include <keyhi.h> | 8 #include <keyhi.h> |
| 9 #include <nss.h> | 9 #include <nss.h> |
| 10 #include <pk11pub.h> | 10 #include <pk11pub.h> |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 56 } | 56 } |
| 57 } | 57 } |
| 58 | 58 |
| 59 } // namespace | 59 } // namespace |
| 60 | 60 |
| 61 CTLogVerifier::~CTLogVerifier() { | 61 CTLogVerifier::~CTLogVerifier() { |
| 62 if (public_key_) | 62 if (public_key_) |
| 63 SECKEY_DestroyPublicKey(public_key_); | 63 SECKEY_DestroyPublicKey(public_key_); |
| 64 } | 64 } |
| 65 | 65 |
| 66 CTLogVerifier::CTLogVerifier() : | 66 CTLogVerifier::CTLogVerifier() |
| 67 hash_algorithm_(ct::DigitallySigned::HASH_ALGO_NONE), | 67 : hash_algorithm_(ct::DigitallySigned::HASH_ALGO_NONE), |
| 68 signature_algorithm_(ct::DigitallySigned::SIG_ALGO_ANONYMOUS), | 68 signature_algorithm_(ct::DigitallySigned::SIG_ALGO_ANONYMOUS), |
| 69 public_key_(NULL) {} | 69 public_key_(NULL) {} |
| 70 | 70 |
| 71 bool CTLogVerifier::Init(const base::StringPiece& public_key, | 71 bool CTLogVerifier::Init(const base::StringPiece& public_key, |
| 72 const base::StringPiece& description) { | 72 const base::StringPiece& description) { |
| 73 SECItem key_data; | 73 SECItem key_data; |
| 74 | 74 |
| 75 crypto::EnsureNSSInit(); | 75 crypto::EnsureNSSInit(); |
| 76 | 76 |
| 77 key_data.data = reinterpret_cast<unsigned char*>( | 77 key_data.data = reinterpret_cast<unsigned char*>( |
| 78 const_cast<char*>(public_key.data())); | 78 const_cast<char*>(public_key.data())); |
| 79 key_data.len = public_key.size(); | 79 key_data.len = public_key.size(); |
| (...skipping 21 matching lines...) Expand all Loading... |
| 101 switch (SECKEY_GetPublicKeyType(public_key_)) { | 101 switch (SECKEY_GetPublicKeyType(public_key_)) { |
| 102 case rsaKey: | 102 case rsaKey: |
| 103 hash_algorithm_ = ct::DigitallySigned::HASH_ALGO_SHA256; | 103 hash_algorithm_ = ct::DigitallySigned::HASH_ALGO_SHA256; |
| 104 signature_algorithm_ = ct::DigitallySigned::SIG_ALGO_RSA; | 104 signature_algorithm_ = ct::DigitallySigned::SIG_ALGO_RSA; |
| 105 break; | 105 break; |
| 106 case ecKey: | 106 case ecKey: |
| 107 hash_algorithm_ = ct::DigitallySigned::HASH_ALGO_SHA256; | 107 hash_algorithm_ = ct::DigitallySigned::HASH_ALGO_SHA256; |
| 108 signature_algorithm_ = ct::DigitallySigned::SIG_ALGO_ECDSA; | 108 signature_algorithm_ = ct::DigitallySigned::SIG_ALGO_ECDSA; |
| 109 break; | 109 break; |
| 110 default: | 110 default: |
| 111 DVLOG(1) << "Unsupported key type: " << | 111 DVLOG(1) << "Unsupported key type: " |
| 112 SECKEY_GetPublicKeyType(public_key_); | 112 << SECKEY_GetPublicKeyType(public_key_); |
| 113 return false; | 113 return false; |
| 114 } | 114 } |
| 115 | 115 |
| 116 // Extra sanity check: Require RSA keys of at least 2048 bits. | 116 // Extra sanity check: Require RSA keys of at least 2048 bits. |
| 117 if (signature_algorithm_ == ct::DigitallySigned::SIG_ALGO_RSA && | 117 if (signature_algorithm_ == ct::DigitallySigned::SIG_ALGO_RSA && |
| 118 SECKEY_PublicKeyStrengthInBits(public_key_) < 2048) { | 118 SECKEY_PublicKeyStrengthInBits(public_key_) < 2048) { |
| 119 DVLOG(1) << "Too small a public key."; | 119 DVLOG(1) << "Too small a public key."; |
| 120 return false; | 120 return false; |
| 121 } | 121 } |
| 122 | 122 |
| (...skipping 10 matching lines...) Expand all Loading... |
| 133 SECStatus rv = VFY_VerifyDataDirect( | 133 SECStatus rv = VFY_VerifyDataDirect( |
| 134 reinterpret_cast<const unsigned char*>(data_to_sign.data()), | 134 reinterpret_cast<const unsigned char*>(data_to_sign.data()), |
| 135 data_to_sign.size(), public_key_, &sig_data, | 135 data_to_sign.size(), public_key_, &sig_data, |
| 136 GetNSSSigAlg(signature_algorithm_), GetNSSHashAlg(hash_algorithm_), | 136 GetNSSSigAlg(signature_algorithm_), GetNSSHashAlg(hash_algorithm_), |
| 137 NULL, NULL); | 137 NULL, NULL); |
| 138 DVLOG(1) << "Signature verification result: " << (rv == SECSuccess); | 138 DVLOG(1) << "Signature verification result: " << (rv == SECSuccess); |
| 139 return rv == SECSuccess; | 139 return rv == SECSuccess; |
| 140 } | 140 } |
| 141 | 141 |
| 142 } // namespace net | 142 } // namespace net |
| OLD | NEW |