Easy Sign-in: Use TPM RSA key to sign nonce in sign-in protocol

chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/memory/linked_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_crypto_delegate.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/easy_unlock_screenlock_state_handler.h"
 #include "chrome/browser/signin/easy_unlock_service.h"
 #include "chrome/browser/signin/screenlock_bridge.h"
 #include "chrome/common/extensions/api/easy_unlock_private.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/proximity_auth/bluetooth_util.h"
 #include "content/public/browser/browser_thread.h"
 #include "extensions/browser/browser_context_keyed_api_factory.h"
 #include "ui/base/l10n/l10n_util.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/chromeos_utils.h"
+#include "chrome/browser/chromeos/login/easy_unlock/easy_unlock_tpm_key_manager.h"
+#include "chrome/browser/chromeos/login/easy_unlock/easy_unlock_tpm_key_manager_factory.h"
 #include "chrome/browser/ui/webui/options/chromeos/user_image_source.h"
 #include "components/user_manager/user.h"
 #include "components/user_manager/user_manager.h"
 #endif
 
 namespace extensions {
 namespace api {
 
 namespace {
 
@@ skipping 562 matching lines @@
 
 EasyUnlockPrivateGetSignInChallengeFunction::
     ~EasyUnlockPrivateGetSignInChallengeFunction() {
 }
 
 bool EasyUnlockPrivateGetSignInChallengeFunction::RunAsync() {
   scoped_ptr<easy_unlock_private::GetSignInChallenge::Params> params(
       easy_unlock_private::GetSignInChallenge::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
 
+#if defined(OS_CHROMEOS)
   Profile* profile = Profile::FromBrowserContext(browser_context());
   const std::string challenge =
       EasyUnlockService::Get(profile)->GetChallenge();
-  // TODO(tbarzic): Implement nonce signing.
-  OnDone(challenge, std::string() /* signed_nonce */);
+  if (!challenge.empty() && !params->nonce.empty()) {
+    EasyUnlockTpmKeyManager* key_manager =
+        EasyUnlockTpmKeyManagerFactory::GetInstance()->Get(profile);
+    if (!key_manager) {
+      SetError("No EasyUnlockTpmKeyManager.");
+      return false;
+    }
+    key_manager->SignUsingTpmKey(
+        EasyUnlockService::Get(profile)->GetUserEmail(),
+        params->nonce,
+        base::Bind(&EasyUnlockPrivateGetSignInChallengeFunction::OnDone,
+                   this,
+                   challenge));
+  } else {
+    OnDone(challenge, std::string());
+  }
   return true;
+#else  // if !defined(OS_CHROMEOS)
+  SetError("Sign-in not supported.");
+  return false;
+#endif  // defined(OS_CHROMEOS)
 }
 
 void EasyUnlockPrivateGetSignInChallengeFunction::OnDone(
     const std::string& challenge,
     const std::string& signed_nonce) {
   results_ = easy_unlock_private::GetSignInChallenge::Results::Create(
       challenge, signed_nonce);
   SendResponse(true);
 }
 
@@ skipping 63 matching lines @@
   // TODO(tengs): Find a way to get the profile picture for non-ChromeOS
   // devices.
   results_ = easy_unlock_private::GetUserImage::Results::Create("");
   SetError("Not supported on non-ChromeOS platforms.");
 #endif
   return true;
 }
 
 }  // namespace api
 }  // namespace extensions