chrome.platformKeys.getKeyPair: Check requested algorithm against certificate.

chrome/browser/extensions/api/platform_keys/platform_keys_api.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/platform_keys/platform_keys_api.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/platform_keys/platform_keys.h"
 #include "chrome/browser/chromeos/platform_keys/platform_keys_service.h"
 #include "chrome/browser/chromeos/platform_keys/platform_keys_service_factory.h"
 #include "chrome/common/extensions/api/platform_keys_internal.h"
 #include "content/public/browser/browser_thread.h"
 #include "net/cert/x509_certificate.h"
 
 namespace extensions {
 
 namespace api_pk = api::platform_keys;
 namespace api_pki = api::platform_keys_internal;
 
 namespace {
 
 const char kErrorAlgorithmNotSupported[] = "Algorithm not supported.";
+const char kErrorAlgorithmNotPermittedByCertificate[] =
+    "The requested Algorithm is not permitted by the certificate.";
 const char kErrorInvalidX509Cert[] =
     "Certificate is not a valid X.509 certificate.";
 
+const char kWebCryptoRSASSA_PKCS1_v1_5[] = "RSASSA-PKCS1-v1_5";
+
 struct PublicKeyInfo {
   // The X.509 Subject Public Key Info of the key in DER encoding.
   std::string public_key_spki_der;
 
   // The type of the key.
   net::X509Certificate::PublicKeyType key_type =
       net::X509Certificate::kPublicKeyTypeUnknown;
 
   // The size of the key in bits.
   size_t key_size_bits = 0;
 };
 
 // Builds a partial WebCrypto Algorithm object from the parameters available in
 // |key_info|, which must the info of an RSA key. This doesn't include sign/hash
 // parameters and thus isn't complete.
 // platform_keys::GetPublicKey() enforced the public exponent 65537.
 void BuildWebCryptoRSAAlgorithmDictionary(const PublicKeyInfo& key_info,
                                           base::DictionaryValue* algorithm) {
   CHECK_EQ(net::X509Certificate::kPublicKeyTypeRSA, key_info.key_type);
-  algorithm->SetStringWithoutPathExpansion("name", "RSASSA-PKCS1-v1_5");
+  algorithm->SetStringWithoutPathExpansion("name", kWebCryptoRSASSA_PKCS1_v1_5);
   algorithm->SetIntegerWithoutPathExpansion("modulusLength",
                                             key_info.key_size_bits);
 
   // Equals 65537.
   const unsigned char defaultPublicExponent[] = {0x01, 0x00, 0x01};
   algorithm->SetWithoutPathExpansion(
       "publicExponent",
       base::BinaryValue::CreateWithCopiedBuffer(
           reinterpret_cast<const char*>(defaultPublicExponent),
           arraysize(defaultPublicExponent)));
@@ skipping 55 matching lines @@
 
   PublicKeyInfo key_info;
   key_info.public_key_spki_der =
       chromeos::platform_keys::GetSubjectPublicKeyInfo(cert_x509);
   if (!chromeos::platform_keys::GetPublicKey(cert_x509, &key_info.key_type,
                                              &key_info.key_size_bits) ||
       key_info.key_type != net::X509Certificate::kPublicKeyTypeRSA) {
     return RespondNow(Error(kErrorAlgorithmNotSupported));
   }
 
+  // Currently, the only supported combination is:
+  //   A certificate declaring rsaEncryption in the SubjectPublicKeyInfo used
+  //   with the RSASSA-PKCS1-v1.5 algorithm.
+  if (params->algorithm_name != kWebCryptoRSASSA_PKCS1_v1_5) {
+    return RespondNow(Error(kErrorAlgorithmNotPermittedByCertificate));
+  }
+
   api_pki::GetPublicKey::Results::Algorithm algorithm;
   BuildWebCryptoRSAAlgorithmDictionary(key_info,
                                        &algorithm.additional_properties);
 
   return RespondNow(ArgumentList(api_pki::GetPublicKey::Results::Create(
       std::vector<char>(key_info.public_key_spki_der.begin(),
                         key_info.public_key_spki_der.end()),
       algorithm)));
 }
 
@@ skipping 122 matching lines @@
     const std::string& error_message) {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
   if (error_message.empty())
     Respond(ArgumentList(api_pki::Sign::Results::Create(
         std::vector<char>(signature.begin(), signature.end()))));
   else
     Respond(Error(error_message));
 }
 
 }  // namespace extensions