| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <openssl/hmac.h> | 5 #include <openssl/hmac.h> |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "base/numerics/safe_math.h" | 8 #include "base/numerics/safe_math.h" |
| 9 #include "base/stl_util.h" | 9 #include "base/stl_util.h" |
| 10 #include "content/child/webcrypto/algorithm_implementation.h" | 10 #include "content/child/webcrypto/algorithm_implementation.h" |
| (...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 63 if (!success || hmac_actual_length != hmac_expected_length) | 63 if (!success || hmac_actual_length != hmac_expected_length) |
| 64 return Status::OperationError(); | 64 return Status::OperationError(); |
| 65 | 65 |
| 66 return Status::Success(); | 66 return Status::Success(); |
| 67 } | 67 } |
| 68 | 68 |
| 69 class HmacImplementation : public AlgorithmImplementation { | 69 class HmacImplementation : public AlgorithmImplementation { |
| 70 public: | 70 public: |
| 71 HmacImplementation() {} | 71 HmacImplementation() {} |
| 72 | 72 |
| 73 virtual Status GenerateKey(const blink::WebCryptoAlgorithm& algorithm, | 73 Status GenerateKey(const blink::WebCryptoAlgorithm& algorithm, |
| 74 bool extractable, | 74 bool extractable, |
| 75 blink::WebCryptoKeyUsageMask usage_mask, | 75 blink::WebCryptoKeyUsageMask usage_mask, |
| 76 GenerateKeyResult* result) const override { | 76 GenerateKeyResult* result) const override { |
| 77 Status status = CheckKeyCreationUsages(kAllKeyUsages, usage_mask); | 77 Status status = CheckKeyCreationUsages(kAllKeyUsages, usage_mask); |
| 78 if (status.IsError()) | 78 if (status.IsError()) |
| 79 return status; | 79 return status; |
| 80 | 80 |
| 81 const blink::WebCryptoHmacKeyGenParams* params = | 81 const blink::WebCryptoHmacKeyGenParams* params = |
| 82 algorithm.hmacKeyGenParams(); | 82 algorithm.hmacKeyGenParams(); |
| 83 | 83 |
| 84 unsigned int keylen_bits = 0; | 84 unsigned int keylen_bits = 0; |
| 85 status = GetHmacKeyGenLengthInBits(params, &keylen_bits); | 85 status = GetHmacKeyGenLengthInBits(params, &keylen_bits); |
| 86 if (status.IsError()) | 86 if (status.IsError()) |
| 87 return status; | 87 return status; |
| 88 | 88 |
| 89 return GenerateSecretKeyOpenSsl(blink::WebCryptoKeyAlgorithm::createHmac( | 89 return GenerateSecretKeyOpenSsl(blink::WebCryptoKeyAlgorithm::createHmac( |
| 90 params->hash().id(), keylen_bits), | 90 params->hash().id(), keylen_bits), |
| 91 extractable, | 91 extractable, |
| 92 usage_mask, | 92 usage_mask, |
| 93 keylen_bits / 8, | 93 keylen_bits / 8, |
| 94 result); | 94 result); |
| 95 } | 95 } |
| 96 | 96 |
| 97 virtual Status VerifyKeyUsagesBeforeImportKey( | 97 Status VerifyKeyUsagesBeforeImportKey( |
| 98 blink::WebCryptoKeyFormat format, | 98 blink::WebCryptoKeyFormat format, |
| 99 blink::WebCryptoKeyUsageMask usage_mask) const override { | 99 blink::WebCryptoKeyUsageMask usage_mask) const override { |
| 100 switch (format) { | 100 switch (format) { |
| 101 case blink::WebCryptoKeyFormatRaw: | 101 case blink::WebCryptoKeyFormatRaw: |
| 102 case blink::WebCryptoKeyFormatJwk: | 102 case blink::WebCryptoKeyFormatJwk: |
| 103 return CheckKeyCreationUsages(kAllKeyUsages, usage_mask); | 103 return CheckKeyCreationUsages(kAllKeyUsages, usage_mask); |
| 104 default: | 104 default: |
| 105 return Status::ErrorUnsupportedImportKeyFormat(); | 105 return Status::ErrorUnsupportedImportKeyFormat(); |
| 106 } | 106 } |
| 107 } | 107 } |
| 108 | 108 |
| 109 virtual Status ImportKeyRaw(const CryptoData& key_data, | 109 Status ImportKeyRaw(const CryptoData& key_data, |
| 110 const blink::WebCryptoAlgorithm& algorithm, | 110 const blink::WebCryptoAlgorithm& algorithm, |
| 111 bool extractable, | 111 bool extractable, |
| 112 blink::WebCryptoKeyUsageMask usage_mask, | 112 blink::WebCryptoKeyUsageMask usage_mask, |
| 113 blink::WebCryptoKey* key) const override { | 113 blink::WebCryptoKey* key) const override { |
| 114 const blink::WebCryptoAlgorithm& hash = | 114 const blink::WebCryptoAlgorithm& hash = |
| 115 algorithm.hmacImportParams()->hash(); | 115 algorithm.hmacImportParams()->hash(); |
| 116 | 116 |
| 117 base::CheckedNumeric<unsigned int> keylen_bits(key_data.byte_length()); | 117 base::CheckedNumeric<unsigned int> keylen_bits(key_data.byte_length()); |
| 118 keylen_bits *= 8; | 118 keylen_bits *= 8; |
| 119 | 119 |
| 120 if (!keylen_bits.IsValid()) | 120 if (!keylen_bits.IsValid()) |
| 121 return Status::ErrorDataTooLarge(); | 121 return Status::ErrorDataTooLarge(); |
| 122 | 122 |
| 123 return ImportKeyRawOpenSsl(key_data, | 123 return ImportKeyRawOpenSsl(key_data, |
| 124 blink::WebCryptoKeyAlgorithm::createHmac( | 124 blink::WebCryptoKeyAlgorithm::createHmac( |
| 125 hash.id(), keylen_bits.ValueOrDie()), | 125 hash.id(), keylen_bits.ValueOrDie()), |
| 126 extractable, | 126 extractable, |
| 127 usage_mask, | 127 usage_mask, |
| 128 key); | 128 key); |
| 129 } | 129 } |
| 130 | 130 |
| 131 virtual Status ImportKeyJwk(const CryptoData& key_data, | 131 Status ImportKeyJwk(const CryptoData& key_data, |
| 132 const blink::WebCryptoAlgorithm& algorithm, | 132 const blink::WebCryptoAlgorithm& algorithm, |
| 133 bool extractable, | 133 bool extractable, |
| 134 blink::WebCryptoKeyUsageMask usage_mask, | 134 blink::WebCryptoKeyUsageMask usage_mask, |
| 135 blink::WebCryptoKey* key) const override { | 135 blink::WebCryptoKey* key) const override { |
| 136 const char* algorithm_name = | 136 const char* algorithm_name = |
| 137 GetJwkHmacAlgorithmName(algorithm.hmacImportParams()->hash().id()); | 137 GetJwkHmacAlgorithmName(algorithm.hmacImportParams()->hash().id()); |
| 138 if (!algorithm_name) | 138 if (!algorithm_name) |
| 139 return Status::ErrorUnexpected(); | 139 return Status::ErrorUnexpected(); |
| 140 | 140 |
| 141 std::vector<uint8_t> raw_data; | 141 std::vector<uint8_t> raw_data; |
| 142 Status status = ReadSecretKeyJwk( | 142 Status status = ReadSecretKeyJwk( |
| 143 key_data, algorithm_name, extractable, usage_mask, &raw_data); | 143 key_data, algorithm_name, extractable, usage_mask, &raw_data); |
| 144 if (status.IsError()) | 144 if (status.IsError()) |
| 145 return status; | 145 return status; |
| 146 | 146 |
| 147 return ImportKeyRaw( | 147 return ImportKeyRaw( |
| 148 CryptoData(raw_data), algorithm, extractable, usage_mask, key); | 148 CryptoData(raw_data), algorithm, extractable, usage_mask, key); |
| 149 } | 149 } |
| 150 | 150 |
| 151 virtual Status ExportKeyRaw(const blink::WebCryptoKey& key, | 151 Status ExportKeyRaw(const blink::WebCryptoKey& key, |
| 152 std::vector<uint8_t>* buffer) const override { | 152 std::vector<uint8_t>* buffer) const override { |
| 153 *buffer = SymKeyOpenSsl::Cast(key)->raw_key_data(); | 153 *buffer = SymKeyOpenSsl::Cast(key)->raw_key_data(); |
| 154 return Status::Success(); | 154 return Status::Success(); |
| 155 } | 155 } |
| 156 | 156 |
| 157 virtual Status ExportKeyJwk(const blink::WebCryptoKey& key, | 157 Status ExportKeyJwk(const blink::WebCryptoKey& key, |
| 158 std::vector<uint8_t>* buffer) const override { | 158 std::vector<uint8_t>* buffer) const override { |
| 159 SymKeyOpenSsl* sym_key = SymKeyOpenSsl::Cast(key); | 159 SymKeyOpenSsl* sym_key = SymKeyOpenSsl::Cast(key); |
| 160 const std::vector<uint8_t>& raw_data = sym_key->raw_key_data(); | 160 const std::vector<uint8_t>& raw_data = sym_key->raw_key_data(); |
| 161 | 161 |
| 162 const char* algorithm_name = | 162 const char* algorithm_name = |
| 163 GetJwkHmacAlgorithmName(key.algorithm().hmacParams()->hash().id()); | 163 GetJwkHmacAlgorithmName(key.algorithm().hmacParams()->hash().id()); |
| 164 if (!algorithm_name) | 164 if (!algorithm_name) |
| 165 return Status::ErrorUnexpected(); | 165 return Status::ErrorUnexpected(); |
| 166 | 166 |
| 167 WriteSecretKeyJwk(CryptoData(raw_data), | 167 WriteSecretKeyJwk(CryptoData(raw_data), |
| 168 algorithm_name, | 168 algorithm_name, |
| 169 key.extractable(), | 169 key.extractable(), |
| 170 key.usages(), | 170 key.usages(), |
| 171 buffer); | 171 buffer); |
| 172 | 172 |
| 173 return Status::Success(); | 173 return Status::Success(); |
| 174 } | 174 } |
| 175 | 175 |
| 176 virtual Status Sign(const blink::WebCryptoAlgorithm& algorithm, | 176 Status Sign(const blink::WebCryptoAlgorithm& algorithm, |
| 177 const blink::WebCryptoKey& key, | 177 const blink::WebCryptoKey& key, |
| 178 const CryptoData& data, | 178 const CryptoData& data, |
| 179 std::vector<uint8_t>* buffer) const override { | 179 std::vector<uint8_t>* buffer) const override { |
| 180 const blink::WebCryptoAlgorithm& hash = | 180 const blink::WebCryptoAlgorithm& hash = |
| 181 key.algorithm().hmacParams()->hash(); | 181 key.algorithm().hmacParams()->hash(); |
| 182 | 182 |
| 183 return SignHmac( | 183 return SignHmac( |
| 184 SymKeyOpenSsl::Cast(key)->raw_key_data(), hash, data, buffer); | 184 SymKeyOpenSsl::Cast(key)->raw_key_data(), hash, data, buffer); |
| 185 } | 185 } |
| 186 | 186 |
| 187 virtual Status Verify(const blink::WebCryptoAlgorithm& algorithm, | 187 Status Verify(const blink::WebCryptoAlgorithm& algorithm, |
| 188 const blink::WebCryptoKey& key, | 188 const blink::WebCryptoKey& key, |
| 189 const CryptoData& signature, | 189 const CryptoData& signature, |
| 190 const CryptoData& data, | 190 const CryptoData& data, |
| 191 bool* signature_match) const override { | 191 bool* signature_match) const override { |
| 192 std::vector<uint8_t> result; | 192 std::vector<uint8_t> result; |
| 193 Status status = Sign(algorithm, key, data, &result); | 193 Status status = Sign(algorithm, key, data, &result); |
| 194 | 194 |
| 195 if (status.IsError()) | 195 if (status.IsError()) |
| 196 return status; | 196 return status; |
| 197 | 197 |
| 198 // Do not allow verification of truncated MACs. | 198 // Do not allow verification of truncated MACs. |
| 199 *signature_match = result.size() == signature.byte_length() && | 199 *signature_match = result.size() == signature.byte_length() && |
| 200 crypto::SecureMemEqual(vector_as_array(&result), | 200 crypto::SecureMemEqual(vector_as_array(&result), |
| 201 signature.bytes(), | 201 signature.bytes(), |
| 202 signature.byte_length()); | 202 signature.byte_length()); |
| 203 | 203 |
| 204 return Status::Success(); | 204 return Status::Success(); |
| 205 } | 205 } |
| 206 }; | 206 }; |
| 207 | 207 |
| 208 } // namespace | 208 } // namespace |
| 209 | 209 |
| 210 AlgorithmImplementation* CreatePlatformHmacImplementation() { | 210 AlgorithmImplementation* CreatePlatformHmacImplementation() { |
| 211 return new HmacImplementation; | 211 return new HmacImplementation; |
| 212 } | 212 } |
| 213 | 213 |
| 214 } // namespace webcrypto | 214 } // namespace webcrypto |
| 215 | 215 |
| 216 } // namespace content | 216 } // namespace content |
| OLD | NEW |