Check that usage isn't empty when generateKey() is called

content/child/webcrypto/test/rsa_ssa_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "content/child/webcrypto/algorithm_dispatch.h"
 #include "content/child/webcrypto/crypto_data.h"
 #include "content/child/webcrypto/status.h"
 #include "content/child/webcrypto/test/test_helpers.h"
@@ skipping 300 matching lines @@
 TEST(WebCryptoRsaSsaTest, GenerateKeyPairRsa) {
   // Note: using unrealistic short key lengths here to avoid bogging down tests.
 
   // Successful WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 key generation (sha256)
   const unsigned int modulus_length = 256;
   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
   blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
       blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
       blink::WebCryptoAlgorithmIdSha256, modulus_length, public_exponent);
   bool extractable = true;
-  const blink::WebCryptoKeyUsageMask usages = 0;
+  const blink::WebCryptoKeyUsageMask public_usages =
+      blink::WebCryptoKeyUsageVerify;
+  const blink::WebCryptoKeyUsageMask private_usages =
+      blink::WebCryptoKeyUsageSign;
+  const blink::WebCryptoKeyUsageMask usages = public_usages | private_usages;
   blink::WebCryptoKey public_key;
   blink::WebCryptoKey private_key;
 
   EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, extractable, usages,
                                                &public_key, &private_key));
-  EXPECT_FALSE(public_key.isNull());
-  EXPECT_FALSE(private_key.isNull());
+  ASSERT_FALSE(public_key.isNull());
+  ASSERT_FALSE(private_key.isNull());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
   EXPECT_EQ(modulus_length,
             public_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(modulus_length,
             private_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
             public_key.algorithm().rsaHashedParams()->hash().id());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
             private_key.algorithm().rsaHashedParams()->hash().id());
   EXPECT_TRUE(public_key.extractable());
   EXPECT_EQ(extractable, private_key.extractable());
-  EXPECT_EQ(usages, public_key.usages());
-  EXPECT_EQ(usages, private_key.usages());
+  EXPECT_EQ(public_usages, public_key.usages());
+  EXPECT_EQ(private_usages, private_key.usages());
 
   // Try exporting the generated key pair, and then re-importing to verify that
   // the exported data was valid.
   std::vector<uint8_t> public_key_spki;
   EXPECT_EQ(Status::Success(), ExportKey(blink::WebCryptoKeyFormatSpki,
                                          public_key, &public_key_spki));
 
   if (SupportsRsaPrivateKeyImport()) {
     public_key = blink::WebCryptoKey::createNull();
-    EXPECT_EQ(
+    ASSERT_EQ(
         Status::Success(),
         ImportKey(blink::WebCryptoKeyFormatSpki, CryptoData(public_key_spki),
                   CreateRsaHashedImportAlgorithm(
                       blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                       blink::WebCryptoAlgorithmIdSha256),
-                  true, usages, &public_key));
+                  true, public_usages, &public_key));
     EXPECT_EQ(modulus_length,
               public_key.algorithm().rsaHashedParams()->modulusLengthBits());
 
     std::vector<uint8_t> private_key_pkcs8;
     EXPECT_EQ(Status::Success(), ExportKey(blink::WebCryptoKeyFormatPkcs8,
                                            private_key, &private_key_pkcs8));
     private_key = blink::WebCryptoKey::createNull();
-    EXPECT_EQ(
+    ASSERT_EQ(
         Status::Success(),
         ImportKey(blink::WebCryptoKeyFormatPkcs8, CryptoData(private_key_pkcs8),
                   CreateRsaHashedImportAlgorithm(
                       blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                       blink::WebCryptoAlgorithmIdSha256),
-                  true, usages, &private_key));
+                  true, private_usages, &private_key));
     EXPECT_EQ(modulus_length,
               private_key.algorithm().rsaHashedParams()->modulusLengthBits());
   }
 
   // Fail with bad modulus.
   algorithm = CreateRsaHashedKeyGenAlgorithm(
       blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
       blink::WebCryptoAlgorithmIdSha256, 0, public_exponent);
   EXPECT_EQ(Status::ErrorGenerateRsaUnsupportedModulus(),
             GenerateKeyPair(algorithm, extractable, usages, &public_key,
@@ skipping 25 matching lines @@
       blink::WebCryptoAlgorithmIdSha256, modulus_length,
       exponent_with_leading_zeros);
   EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
             GenerateKeyPair(algorithm, extractable, usages, &public_key,
                             &private_key));
 
   // Key generation success using exponent with leading zeros.
   exponent_with_leading_zeros.insert(exponent_with_leading_zeros.end(),
                                      public_exponent.begin(),
                                      public_exponent.end());
-  algorithm = CreateRsaHashedKeyGenAlgorithm(
-      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
-      blink::WebCryptoAlgorithmIdSha256, modulus_length,
-      exponent_with_leading_zeros);
+  algorithm =
+      CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
+                                     blink::WebCryptoAlgorithmIdSha256,
+                                     modulus_length,
+                                     exponent_with_leading_zeros);
   EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, extractable, usages,
                                                &public_key, &private_key));
   EXPECT_FALSE(public_key.isNull());
   EXPECT_FALSE(private_key.isNull());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
   EXPECT_TRUE(public_key.extractable());
   EXPECT_EQ(extractable, private_key.extractable());
-  EXPECT_EQ(usages, public_key.usages());
-  EXPECT_EQ(usages, private_key.usages());
+  EXPECT_EQ(public_usages, public_key.usages());
+  EXPECT_EQ(private_usages, private_key.usages());
 
   // Successful WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 key generation (sha1)
-  algorithm = CreateRsaHashedKeyGenAlgorithm(
-      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
-      blink::WebCryptoAlgorithmIdSha1, modulus_length, public_exponent);
-  EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, false, usages,
-                                               &public_key, &private_key));
+  algorithm =
+      CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
+                                     blink::WebCryptoAlgorithmIdSha1,
+                                     modulus_length,
+                                     public_exponent);
+  EXPECT_EQ(
+      Status::Success(),
+      GenerateKeyPair(algorithm, false, usages, &public_key, &private_key));
   EXPECT_FALSE(public_key.isNull());
   EXPECT_FALSE(private_key.isNull());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
   EXPECT_EQ(modulus_length,
             public_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(modulus_length,
             private_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
             public_key.algorithm().rsaHashedParams()->hash().id());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
             private_key.algorithm().rsaHashedParams()->hash().id());
   // Even though "extractable" was set to false, the public key remains
   // extractable.
   EXPECT_TRUE(public_key.extractable());
   EXPECT_FALSE(private_key.extractable());
-  EXPECT_EQ(usages, public_key.usages());
-  EXPECT_EQ(usages, private_key.usages());
+  EXPECT_EQ(public_usages, public_key.usages());
+  EXPECT_EQ(private_usages, private_key.usages());
 
   // Exporting a private key as SPKI format doesn't make sense. However this
   // will first fail because the key is not extractable.
   std::vector<uint8_t> output;
   EXPECT_EQ(Status::ErrorKeyNotExtractable(),
             ExportKey(blink::WebCryptoKeyFormatSpki, private_key, &output));
 
   // Re-generate an extractable private_key and try to export it as SPKI format.
   // This should fail since spki is for public keys.
   EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, true, usages,
@@ skipping 14 matching lines @@
 
   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
 
   for (size_t i = 0; i < arraysize(kBadModulusBits); ++i) {
     const unsigned int modulus_length_bits = kBadModulusBits[i];
     blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
         blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
         blink::WebCryptoAlgorithmIdSha256, modulus_length_bits,
         public_exponent);
     bool extractable = true;
-    const blink::WebCryptoKeyUsageMask usages = 0;
+    const blink::WebCryptoKeyUsageMask usages = blink::WebCryptoKeyUsageSign;
     blink::WebCryptoKey public_key;
     blink::WebCryptoKey private_key;
 
     EXPECT_EQ(Status::ErrorGenerateRsaUnsupportedModulus(),
               GenerateKeyPair(algorithm, extractable, usages, &public_key,
                               &private_key));
   }
 }
 
 // Try generating RSA key pairs using unsupported public exponents. Only
@@ skipping 15 matching lines @@
     SCOPED_TRACE(i);
     blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
         blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
         blink::WebCryptoAlgorithmIdSha256, modulus_length,
         HexStringToBytes(kPublicExponents[i]));
 
     blink::WebCryptoKey public_key;
     blink::WebCryptoKey private_key;
 
     EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
-              GenerateKeyPair(algorithm, true, 0, &public_key, &private_key));
+              GenerateKeyPair(algorithm, true, blink::WebCryptoKeyUsageSign,
+                              &public_key, &private_key));
   }
 }
 
 TEST(WebCryptoRsaSsaTest, SignVerifyFailures) {
   if (!SupportsRsaPrivateKeyImport())
     return;
 
   // Import a key pair.
   blink::WebCryptoAlgorithm import_algorithm =
       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
@@ skipping 254 matching lines @@
                                 blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                 blink::WebCryptoAlgorithmIdSha256,
                                 modulus_length, public_exponent),
                             true, blink::WebCryptoKeyUsageSign, &public_key,
                             &private_key));
 
   EXPECT_EQ(0, public_key.usages());
   EXPECT_EQ(blink::WebCryptoKeyUsageSign, private_key.usages());
 }
 
+TEST(WebCryptoRsaSsaTest, GenerateKeyPairEmptyUsages) {
+  const unsigned int modulus_length = 256;
+  const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
+
+  blink::WebCryptoKey public_key;
+  blink::WebCryptoKey private_key;
+
+  ASSERT_EQ(Status::ErrorCreateKeyEmptyUsages(),
+            GenerateKeyPair(CreateRsaHashedKeyGenAlgorithm(
+                                blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
+                                blink::WebCryptoAlgorithmIdSha256,
+                                modulus_length, public_exponent),
+                            true, 0, &public_key, &private_key));
+}
+
 TEST(WebCryptoRsaSsaTest, ImportExportJwkRsaPublicKey) {
   struct TestCase {
     const blink::WebCryptoAlgorithmId hash;
     const blink::WebCryptoKeyUsageMask usage;
     const char* const jwk_alg;
   };
   const TestCase kTests[] = {
       {blink::WebCryptoAlgorithmIdSha1, blink::WebCryptoKeyUsageVerify, "RS1"},
       {blink::WebCryptoAlgorithmIdSha256,
        blink::WebCryptoKeyUsageVerify,
@@ skipping 130 matching lines @@
 
     const base::DictionaryValue* test;
     ASSERT_TRUE(tests->GetDictionary(test_index, &test));
 
     blink::WebCryptoKeyFormat key_format = GetKeyFormatFromJsonTestCase(test);
     std::vector<uint8_t> key_data =
         GetKeyDataFromJsonTestCase(test, key_format);
     std::string test_error;
     ASSERT_TRUE(test->GetString("error", &test_error));
 
+    blink::WebCryptoKeyUsageMask usages = blink::WebCryptoKeyUsageSign;
+    if (key_format == blink::WebCryptoKeyFormatSpki)
+      usages = blink::WebCryptoKeyUsageVerify;
     blink::WebCryptoKey key;
     Status status = ImportKey(key_format, CryptoData(key_data),
                               CreateRsaHashedImportAlgorithm(
                                   blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                   blink::WebCryptoAlgorithmIdSha256),
-                              true, 0, &key);
+                              true, usages, &key);
     EXPECT_EQ(test_error, StatusToString(status));
   }
 }
 
 }  // namespace
 
 }  // namespace webcrypto
 
 }  // namespace content