Easy Sign-in: Use TPM RSA key to sign nonce in sign-in protocol

chrome/browser/signin/easy_unlock_service.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/signin/easy_unlock_service.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/prefs/pref_registry_simple.h"
@@ skipping 21 matching lines @@
 #include "device/bluetooth/bluetooth_adapter_factory.h"
 #include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/common/one_shot_event.h"
 #include "grit/browser_resources.h"
 
 #if defined(OS_CHROMEOS)
 #include "base/sys_info.h"
 #include "chrome/browser/chromeos/login/easy_unlock/easy_unlock_key_manager.h"
+#include "chrome/browser/chromeos/login/easy_unlock/easy_unlock_tpm_key_manager.h"
+#include "chrome/browser/chromeos/login/easy_unlock/easy_unlock_tpm_key_manager_factory.h"
 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/power_manager_client.h"
+#include "components/user_manager/user_manager.h"
 #endif
 
 namespace {
 
 extensions::ComponentLoader* GetComponentLoader(
     content::BrowserContext* context) {
   extensions::ExtensionSystem* extension_system =
       extensions::ExtensionSystem::Get(context);
   ExtensionService* extension_service = extension_system->extension_service();
   return extension_service->component_loader();
@@ skipping 120 matching lines @@
   base::WeakPtrFactory<PowerMonitor> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(PowerMonitor);
 };
 #endif
 
 EasyUnlockService::EasyUnlockService(Profile* profile)
     : profile_(profile),
       bluetooth_detector_(new BluetoothDetector(this)),
       shut_down_(false),
+      tpm_key_checked_(false),
       weak_ptr_factory_(this) {
   extensions::ExtensionSystem::Get(profile_)->ready().Post(
       FROM_HERE,
       base::Bind(&EasyUnlockService::Initialize,
                  weak_ptr_factory_.GetWeakPtr()));
 }
 
 EasyUnlockService::~EasyUnlockService() {
 }
 
@@ skipping 14 matching lines @@
       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
   registry->RegisterBooleanPref(
       prefs::kEasyUnlockProximityRequired,
       false,
       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
 }
 
 // static
 void EasyUnlockService::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterDictionaryPref(prefs::kEasyUnlockHardlockState);
+#if defined(OS_CHROMEOS)
+  EasyUnlockTpmKeyManager::RegisterLocalStatePrefs(registry);
+#endif
 }
 
 // static
 void EasyUnlockService::ResetLocalStateForUser(const std::string& user_id) {
   DCHECK(!user_id.empty());
 
   PrefService* local_state = GetLocalState();
   if (!local_state)
     return;
 
   DictionaryPrefUpdate update(local_state, prefs::kEasyUnlockHardlockState);
   update->RemoveWithoutPathExpansion(user_id, NULL);
+
+#if defined(OS_CHROMEOS)
+  EasyUnlockTpmKeyManager::ResetLocalStateForUser(user_id);
+#endif
 }
 
 bool EasyUnlockService::IsAllowed() {
   if (shut_down_)
     return false;
 
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           proximity_auth::switches::kDisableEasyUnlock)) {
     return false;
   }
@@ skipping 284 matching lines @@
     return;
   extensions::ExtensionSystem* extension_system =
       extensions::ExtensionSystem::Get(profile_);
   extension_system->extension_service()->ReloadExtension(
       extension_misc::kEasyUnlockAppId);
   NotifyUserUpdated();
 }
 
 void EasyUnlockService::UpdateAppState() {
   if (IsAllowed()) {
+    EnsureTpmKeyPresentIfNeeded();
     LoadApp();
 
 #if defined(OS_CHROMEOS)
     if (!power_monitor_)
       power_monitor_.reset(new PowerMonitor(this));
 #endif
   } else {
     bool bluetooth_waking_up = false;
 #if defined(OS_CHROMEOS)
     // If the service is not allowed due to bluetooth not being detected just
@@ skipping 117 matching lines @@
 }
 #endif
 
 void EasyUnlockService::PrepareForSuspend() {
   DisableAppIfLoaded();
   if (screenlock_state_handler_ && screenlock_state_handler_->IsActive()) {
     UpdateScreenlockState(
         EasyUnlockScreenlockStateHandler::STATE_BLUETOOTH_CONNECTING);
   }
 }
+
+void EasyUnlockService::EnsureTpmKeyPresentIfNeeded() {
+  if (tpm_key_checked_ || GetType() != TYPE_REGULAR || GetUserEmail().empty())
+    return;
+
+#if defined(OS_CHROMEOS)
+  // If this is called before the session is started, the chances are Chrome
+  // is restarting in order to apply user flags. Don't check TPM keys in this
+  // case.
+  if (!user_manager::UserManager::Get() ||
+      !user_manager::UserManager::Get()->IsSessionStarted())
+    return;
+
+  // TODO(tbarzic): Set check_private_key only if previous sign-in attempt
+  // failed.
+  EasyUnlockTpmKeyManagerFactory::GetInstance()->Get(profile_)
+      ->PrepareTpmKey(GetUserEmail(),
+                      true /* check_private_key */,
+                      base::Closure());
+#endif  // defined(OS_CHROMEOS)
+
+  tpm_key_checked_ = true;
+}