Implement crypto signature verification routines using OpenSSL.

extensions/browser/api/cast_channel/cast_auth_util_nss.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_auth_util.h"
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <pk11pub.h>
 #include <seccomon.h>
@@ skipping 12 matching lines @@
 namespace extensions {
 namespace core_api {
 namespace cast_channel {
 namespace {
 typedef scoped_ptr<
     CERTCertificate,
     crypto::NSSDestroyer<CERTCertificate, CERT_DestroyCertificate> >
         ScopedCERTCertificate;
 
 // Authenticates the given credentials:
-// 1. |signature| verification of |data| using |certificate|.
+// 1. |signature| verification of |peer_cert| using |certificate|.
 // 2. |certificate| is signed by a trusted CA.
 AuthResult VerifyCredentials(const AuthResponse& response,
-                             const std::string& data) {
+                             const std::string& peer_cert) {
   const std::string kErrorPrefix("Failed to verify credentials: ");
   const std::string& certificate = response.client_auth_certificate();
   const std::string& signature = response.signature();
 
   // If the list of intermediates is empty then use kPublicKeyICA1 as
   // the trusted CA (legacy case).
   // Otherwise, use the first intermediate in the list as long as it
   // is in the allowed list of intermediates.
   int num_intermediates = response.intermediate_certificate_size();
 
@@ skipping 32 matching lines @@
         "Failed to parse certificate.",
         AuthResult::ERROR_NSS_CERT_PARSING_FAILED,
         PORT_GetError());
   }
 
   // Check that the certificate is signed by trusted CA.
   // NOTE: We const_cast trusted_ca_key_der since on some platforms
   // SECKEY_ImportDERPublicKey API takes in SECItem* and not const
   // SECItem*.
   crypto::ScopedSECKEYPublicKey ca_public_key(
       SECKEY_ImportDERPublicKey(&trusted_ca_key_der, CKK_RSA));

[davidben, 2014/10/30 18:37:22]

Minor: While you're here, may as well check for ca_public_key being NULL on this
side too. (Fortunately, CERT_VerifySignedDataWithPublicKey does check for NULL
in the argument, so nothing bad should happen. And those keys are hard-coded
anyway.)

[Kevin M, 2014/10/31 21:39:37]

Done.

   SECStatus verified = CERT_VerifySignedDataWithPublicKey(
       &cert->signatureWrap, ca_public_key.get(), NULL);
   if (verified != SECSuccess) {
     return AuthResult::CreateWithNSSError(
         "Cert not signed by trusted CA",
         AuthResult::ERROR_NSS_CERT_NOT_SIGNED_BY_TRUSTED_CA,
         PORT_GetError());
   }
 
   VLOG(1) << "Cert signed by trusted CA";
 
-  // Verify that the |signature| matches |data|.
+  // Verify that the |signature| matches |peer_cert|.
   crypto::ScopedSECKEYPublicKey public_key(CERT_ExtractPublicKey(cert.get()));
   if (!public_key.get()) {
     return AuthResult::CreateWithNSSError(
         "Unable to extract public key from certificate",
         AuthResult::ERROR_NSS_CANNOT_EXTRACT_PUBLIC_KEY,
         PORT_GetError());
   }
   SECItem signature_item;
   signature_item.type = siBuffer;
   signature_item.data = reinterpret_cast<unsigned char*>(
       const_cast<char*>(signature.data()));
   signature_item.len = signature.length();
   verified = VFY_VerifyDataDirect(
-      reinterpret_cast<unsigned char*>(const_cast<char*>(data.data())),
+      reinterpret_cast<unsigned char*>(const_cast<char*>(peer_cert.data())),
       data.size(),
       public_key.get(),
       &signature_item,
       SEC_OID_PKCS1_RSA_ENCRYPTION,
       SEC_OID_SHA1, NULL, NULL);
 
   if (verified != SECSuccess) {
     return AuthResult::CreateWithNSSError(
         "Signed blobs did not match",
         AuthResult::ERROR_NSS_SIGNED_BLOBS_MISMATCH,
@@ skipping 31 matching lines @@
             << ", NSS error code: " << result.nss_error_code;
     return result;
   }
 
   return AuthResult();
 }
 
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions