Home | History | Annotate | Download | only in webcrypto 
      1 // Copyright 2014 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "content/child/webcrypto/shared_crypto.h"
      6 
      7 #include "base/logging.h"
      8 #include "content/child/webcrypto/crypto_data.h"
      9 #include "content/child/webcrypto/jwk.h"
     10 #include "content/child/webcrypto/platform_crypto.h"
     11 #include "content/child/webcrypto/status.h"
     12 #include "content/child/webcrypto/webcrypto_util.h"
     13 #include "crypto/secure_util.h"
     14 #include "third_party/WebKit/public/platform/WebCryptoAlgorithm.h"
     15 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
     16 #include "third_party/WebKit/public/platform/WebCryptoKey.h"
     17 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
     18 
     19 namespace content {
     20 
     21 namespace webcrypto {
     22 
     23 // ------------
     24 // Threading:
     25 // ------------
     26 //
     27 // All functions in this file are called from the webcrypto worker pool except
     28 // for:
     29 //
     30 //   * SerializeKeyForClone()
     31 //   * DeserializeKeyForClone()
     32 //   * ImportKey() // TODO(eroman): Change this.
     33 
     34 namespace {
     35 
     36 // TODO(eroman): Move this helper to WebCryptoKey.
     37 bool KeyUsageAllows(const blink::WebCryptoKey& key,
     38                     const blink::WebCryptoKeyUsage usage) {
     39   return ((key.usages() & usage) != 0);
     40 }
     41 
     42 bool IsValidAesKeyLengthBits(unsigned int length_bits) {
     43   // 192-bit AES is disallowed.
     44   return length_bits == 128 || length_bits == 256;
     45 }
     46 
     47 bool IsValidAesKeyLengthBytes(unsigned int length_bytes) {
     48   // 192-bit AES is disallowed.
     49   return length_bytes == 16 || length_bytes == 32;
     50 }
     51 
     52 const size_t kAesBlockSizeBytes = 16;
     53 
     54 Status EncryptDecryptAesCbc(EncryptOrDecrypt mode,
     55                             const blink::WebCryptoAlgorithm& algorithm,
     56                             const blink::WebCryptoKey& key,
     57                             const CryptoData& data,
     58                             std::vector<uint8>* buffer) {
     59   platform::SymKey* sym_key;
     60   Status status = ToPlatformSymKey(key, &sym_key);
     61   if (status.IsError())
     62     return status;
     63 
     64   const blink::WebCryptoAesCbcParams* params = algorithm.aesCbcParams();
     65   if (!params)
     66     return Status::ErrorUnexpected();
     67 
     68   CryptoData iv(params->iv().data(), params->iv().size());
     69   if (iv.byte_length() != kAesBlockSizeBytes)
     70     return Status::ErrorIncorrectSizeAesCbcIv();
     71 
     72   return platform::EncryptDecryptAesCbc(mode, sym_key, data, iv, buffer);
     73 }
     74 
     75 Status EncryptDecryptAesGcm(EncryptOrDecrypt mode,
     76                             const blink::WebCryptoAlgorithm& algorithm,
     77                             const blink::WebCryptoKey& key,
     78                             const CryptoData& data,
     79                             std::vector<uint8>* buffer) {
     80   platform::SymKey* sym_key;
     81   Status status = ToPlatformSymKey(key, &sym_key);
     82   if (status.IsError())
     83     return status;
     84 
     85   const blink::WebCryptoAesGcmParams* params = algorithm.aesGcmParams();
     86   if (!params)
     87     return Status::ErrorUnexpected();
     88 
     89   unsigned int tag_length_bits = 128;
     90   if (params->hasTagLengthBits())
     91     tag_length_bits = params->optionalTagLengthBits();
     92 
     93   if (tag_length_bits != 32 && tag_length_bits != 64 && tag_length_bits != 96 &&
     94       tag_length_bits != 104 && tag_length_bits != 112 &&
     95       tag_length_bits != 120 && tag_length_bits != 128)
     96     return Status::ErrorInvalidAesGcmTagLength();
     97 
     98   return platform::EncryptDecryptAesGcm(
     99       mode,
    100       sym_key,
    101       data,
    102       CryptoData(params->iv()),
    103       CryptoData(params->optionalAdditionalData()),
    104       tag_length_bits,
    105       buffer);
    106 }
    107 
    108 Status EncryptRsaOaep(const blink::WebCryptoAlgorithm& algorithm,
    109                       const blink::WebCryptoKey& key,
    110                       const CryptoData& data,
    111                       std::vector<uint8>* buffer) {
    112   platform::PublicKey* public_key;
    113   Status status = ToPlatformPublicKey(key, &public_key);
    114   if (status.IsError())
    115     return status;
    116 
    117   const blink::WebCryptoRsaOaepParams* params = algorithm.rsaOaepParams();
    118   if (!params)
    119     return Status::ErrorUnexpected();
    120 
    121   return platform::EncryptRsaOaep(public_key,
    122                                   key.algorithm().rsaHashedParams()->hash(),
    123                                   CryptoData(params->optionalLabel()),
    124                                   data,
    125                                   buffer);
    126 }
    127 
    128 Status DecryptRsaOaep(const blink::WebCryptoAlgorithm& algorithm,
    129                       const blink::WebCryptoKey& key,
    130                       const CryptoData& data,
    131                       std::vector<uint8>* buffer) {
    132   platform::PrivateKey* private_key;
    133   Status status = ToPlatformPrivateKey(key, &private_key);
    134   if (status.IsError())
    135     return status;
    136 
    137   const blink::WebCryptoRsaOaepParams* params = algorithm.rsaOaepParams();
    138   if (!params)
    139     return Status::ErrorUnexpected();
    140 
    141   return platform::DecryptRsaOaep(private_key,
    142                                   key.algorithm().rsaHashedParams()->hash(),
    143                                   CryptoData(params->optionalLabel()),
    144                                   data,
    145                                   buffer);
    146 }
    147 
    148 Status SignHmac(const blink::WebCryptoAlgorithm& algorithm,
    149                 const blink::WebCryptoKey& key,
    150                 const CryptoData& data,
    151                 std::vector<uint8>* buffer) {
    152   platform::SymKey* sym_key;
    153   Status status = ToPlatformSymKey(key, &sym_key);
    154   if (status.IsError())
    155     return status;
    156 
    157   return platform::SignHmac(
    158       sym_key, key.algorithm().hmacParams()->hash(), data, buffer);
    159 }
    160 
    161 Status VerifyHmac(const blink::WebCryptoAlgorithm& algorithm,
    162                   const blink::WebCryptoKey& key,
    163                   const CryptoData& signature,
    164                   const CryptoData& data,
    165                   bool* signature_match) {
    166   std::vector<uint8> result;
    167   Status status = SignHmac(algorithm, key, data, &result);
    168   if (status.IsError())
    169     return status;
    170 
    171   // Do not allow verification of truncated MACs.
    172   *signature_match =
    173       result.size() == signature.byte_length() &&
    174       crypto::SecureMemEqual(
    175           Uint8VectorStart(result), signature.bytes(), signature.byte_length());
    176 
    177   return Status::Success();
    178 }
    179 
    180 Status SignRsaSsaPkcs1v1_5(const blink::WebCryptoAlgorithm& algorithm,
    181                            const blink::WebCryptoKey& key,
    182                            const CryptoData& data,
    183                            std::vector<uint8>* buffer) {
    184   platform::PrivateKey* private_key;
    185   Status status = ToPlatformPrivateKey(key, &private_key);
    186   if (status.IsError())
    187     return status;
    188 
    189   return platform::SignRsaSsaPkcs1v1_5(
    190       private_key, key.algorithm().rsaHashedParams()->hash(), data, buffer);
    191 }
    192 
    193 Status VerifyRsaSsaPkcs1v1_5(const blink::WebCryptoAlgorithm& algorithm,
    194                              const blink::WebCryptoKey& key,
    195                              const CryptoData& signature,
    196                              const CryptoData& data,
    197                              bool* signature_match) {
    198   platform::PublicKey* public_key;
    199   Status status = ToPlatformPublicKey(key, &public_key);
    200   if (status.IsError())
    201     return status;
    202 
    203   return platform::VerifyRsaSsaPkcs1v1_5(
    204       public_key,
    205       key.algorithm().rsaHashedParams()->hash(),
    206       signature,
    207       data,
    208       signature_match);
    209 }
    210 
    211 // Note that this function may be called from the target Blink thread.
    212 Status ImportKeyRaw(const CryptoData& key_data,
    213                     const blink::WebCryptoAlgorithm& algorithm,
    214                     bool extractable,
    215                     blink::WebCryptoKeyUsageMask usage_mask,
    216                     blink::WebCryptoKey* key) {
    217   switch (algorithm.id()) {
    218     case blink::WebCryptoAlgorithmIdAesCtr:
    219     case blink::WebCryptoAlgorithmIdAesCbc:
    220     case blink::WebCryptoAlgorithmIdAesGcm:
    221     case blink::WebCryptoAlgorithmIdAesKw:
    222       if (!IsValidAesKeyLengthBytes(key_data.byte_length())) {
    223         return key_data.byte_length() == 24
    224                    ? Status::ErrorAes192BitUnsupported()
    225                    : Status::ErrorImportAesKeyLength();
    226       }
    227     // Fallthrough intentional!
    228     case blink::WebCryptoAlgorithmIdHmac:
    229       return platform::ImportKeyRaw(
    230           algorithm, key_data, extractable, usage_mask, key);
    231     default:
    232       return Status::ErrorUnsupported();
    233   }
    234 }
    235 
    236 // Returns the key format to use for structured cloning.
    237 blink::WebCryptoKeyFormat GetCloneFormatForKeyType(
    238     blink::WebCryptoKeyType type) {
    239   switch (type) {
    240     case blink::WebCryptoKeyTypeSecret:
    241       return blink::WebCryptoKeyFormatRaw;
    242     case blink::WebCryptoKeyTypePublic:
    243       return blink::WebCryptoKeyFormatSpki;
    244     case blink::WebCryptoKeyTypePrivate:
    245       return blink::WebCryptoKeyFormatPkcs8;
    246   }
    247 
    248   NOTREACHED();
    249   return blink::WebCryptoKeyFormatRaw;
    250 }
    251 
    252 // Converts a KeyAlgorithm into an equivalent Algorithm for import.
    253 blink::WebCryptoAlgorithm KeyAlgorithmToImportAlgorithm(
    254     const blink::WebCryptoKeyAlgorithm& algorithm) {
    255   switch (algorithm.paramsType()) {
    256     case blink::WebCryptoKeyAlgorithmParamsTypeAes:
    257       return CreateAlgorithm(algorithm.id());
    258     case blink::WebCryptoKeyAlgorithmParamsTypeHmac:
    259       return CreateHmacImportAlgorithm(algorithm.hmacParams()->hash().id());
    260     case blink::WebCryptoKeyAlgorithmParamsTypeRsaHashed:
    261       return CreateRsaHashedImportAlgorithm(
    262           algorithm.id(), algorithm.rsaHashedParams()->hash().id());
    263     case blink::WebCryptoKeyAlgorithmParamsTypeNone:
    264       break;
    265     default:
    266       break;
    267   }
    268   return blink::WebCryptoAlgorithm::createNull();
    269 }
    270 
    271 // There is some duplicated information in the serialized format used by
    272 // structured clone (since the KeyAlgorithm is serialized separately from the
    273 // key data). Use this extra information to further validate what was
    274 // deserialized from the key data.
    275 //
    276 // A failure here implies either a bug in the code, or that the serialized data
    277 // was corrupted.
    278 bool ValidateDeserializedKey(const blink::WebCryptoKey& key,
    279                              const blink::WebCryptoKeyAlgorithm& algorithm,
    280                              blink::WebCryptoKeyType type) {
    281   if (algorithm.id() != key.algorithm().id())
    282     return false;
    283 
    284   if (key.type() != type)
    285     return false;
    286 
    287   switch (algorithm.paramsType()) {
    288     case blink::WebCryptoKeyAlgorithmParamsTypeAes:
    289       if (algorithm.aesParams()->lengthBits() !=
    290           key.algorithm().aesParams()->lengthBits())
    291         return false;
    292       break;
    293     case blink::WebCryptoKeyAlgorithmParamsTypeRsaHashed:
    294       if (algorithm.rsaHashedParams()->modulusLengthBits() !=
    295           key.algorithm().rsaHashedParams()->modulusLengthBits())
    296         return false;
    297       if (algorithm.rsaHashedParams()->publicExponent().size() !=
    298           key.algorithm().rsaHashedParams()->publicExponent().size())
    299         return false;
    300       if (memcmp(algorithm.rsaHashedParams()->publicExponent().data(),
    301                  key.algorithm().rsaHashedParams()->publicExponent().data(),
    302                  key.algorithm().rsaHashedParams()->publicExponent().size()) !=
    303           0)
    304         return false;
    305       break;
    306     case blink::WebCryptoKeyAlgorithmParamsTypeNone:
    307     case blink::WebCryptoKeyAlgorithmParamsTypeHmac:
    308       break;
    309     default:
    310       return false;
    311   }
    312 
    313   return true;
    314 }
    315 
    316 Status EncryptDecryptAesKw(EncryptOrDecrypt mode,
    317                            const blink::WebCryptoAlgorithm& algorithm,
    318                            const blink::WebCryptoKey& key,
    319                            const CryptoData& data,
    320                            std::vector<uint8>* buffer) {
    321   platform::SymKey* sym_key;
    322   Status status = ToPlatformSymKey(key, &sym_key);
    323   if (status.IsError())
    324     return status;
    325 
    326   unsigned int min_length = mode == ENCRYPT ? 16 : 24;
    327 
    328   if (data.byte_length() < min_length)
    329     return Status::ErrorDataTooSmall();
    330   if (data.byte_length() % 8)
    331     return Status::ErrorInvalidAesKwDataLength();
    332 
    333   if (status.IsError())
    334     return status;
    335   return platform::EncryptDecryptAesKw(mode, sym_key, data, buffer);
    336 }
    337 
    338 Status DecryptDontCheckKeyUsage(const blink::WebCryptoAlgorithm& algorithm,
    339                                 const blink::WebCryptoKey& key,
    340                                 const CryptoData& data,
    341                                 std::vector<uint8>* buffer) {
    342   if (algorithm.id() != key.algorithm().id())
    343     return Status::ErrorUnexpected();
    344   switch (algorithm.id()) {
    345     case blink::WebCryptoAlgorithmIdAesCbc:
    346       return EncryptDecryptAesCbc(DECRYPT, algorithm, key, data, buffer);
    347     case blink::WebCryptoAlgorithmIdAesGcm:
    348       return EncryptDecryptAesGcm(DECRYPT, algorithm, key, data, buffer);
    349     case blink::WebCryptoAlgorithmIdRsaOaep:
    350       return DecryptRsaOaep(algorithm, key, data, buffer);
    351     case blink::WebCryptoAlgorithmIdAesKw:
    352       return EncryptDecryptAesKw(DECRYPT, algorithm, key, data, buffer);
    353     default:
    354       return Status::ErrorUnsupported();
    355   }
    356 }
    357 
    358 Status EncryptDontCheckUsage(const blink::WebCryptoAlgorithm& algorithm,
    359                              const blink::WebCryptoKey& key,
    360                              const CryptoData& data,
    361                              std::vector<uint8>* buffer) {
    362   if (algorithm.id() != key.algorithm().id())
    363     return Status::ErrorUnexpected();
    364   switch (algorithm.id()) {
    365     case blink::WebCryptoAlgorithmIdAesCbc:
    366       return EncryptDecryptAesCbc(ENCRYPT, algorithm, key, data, buffer);
    367     case blink::WebCryptoAlgorithmIdAesGcm:
    368       return EncryptDecryptAesGcm(ENCRYPT, algorithm, key, data, buffer);
    369     case blink::WebCryptoAlgorithmIdAesKw:
    370       return EncryptDecryptAesKw(ENCRYPT, algorithm, key, data, buffer);
    371     case blink::WebCryptoAlgorithmIdRsaOaep:
    372       return EncryptRsaOaep(algorithm, key, data, buffer);
    373     default:
    374       return Status::ErrorUnsupported();
    375   }
    376 }
    377 
    378 Status UnwrapKeyDecryptAndImport(
    379     blink::WebCryptoKeyFormat format,
    380     const CryptoData& wrapped_key_data,
    381     const blink::WebCryptoKey& wrapping_key,
    382     const blink::WebCryptoAlgorithm& wrapping_algorithm,
    383     const blink::WebCryptoAlgorithm& algorithm,
    384     bool extractable,
    385     blink::WebCryptoKeyUsageMask usage_mask,
    386     blink::WebCryptoKey* key) {
    387   std::vector<uint8> buffer;
    388   Status status = DecryptDontCheckKeyUsage(
    389       wrapping_algorithm, wrapping_key, wrapped_key_data, &buffer);
    390   if (status.IsError())
    391     return status;
    392   // NOTE that returning the details of ImportKey() failures may leak
    393   // information about the plaintext of the encrypted key (for instance the JWK
    394   // key_ops). As long as the ImportKey error messages don't describe actual
    395   // key bytes however this should be OK. For more discussion see
    396   // http://crubg.com/372040
    397   return ImportKey(
    398       format, CryptoData(buffer), algorithm, extractable, usage_mask, key);
    399 }
    400 
    401 Status WrapKeyExportAndEncrypt(
    402     blink::WebCryptoKeyFormat format,
    403     const blink::WebCryptoKey& key_to_wrap,
    404     const blink::WebCryptoKey& wrapping_key,
    405     const blink::WebCryptoAlgorithm& wrapping_algorithm,
    406     std::vector<uint8>* buffer) {
    407   std::vector<uint8> exported_data;
    408   Status status = ExportKey(format, key_to_wrap, &exported_data);
    409   if (status.IsError())
    410     return status;
    411   return EncryptDontCheckUsage(
    412       wrapping_algorithm, wrapping_key, CryptoData(exported_data), buffer);
    413 }
    414 
    415 // Returns the internal block size for SHA-*
    416 unsigned int ShaBlockSizeBytes(blink::WebCryptoAlgorithmId hash_id) {
    417   switch (hash_id) {
    418     case blink::WebCryptoAlgorithmIdSha1:
    419     case blink::WebCryptoAlgorithmIdSha256:
    420       return 64;
    421     case blink::WebCryptoAlgorithmIdSha384:
    422     case blink::WebCryptoAlgorithmIdSha512:
    423       return 128;
    424     default:
    425       NOTREACHED();
    426       return 0;
    427   }
    428 }
    429 
    430 // Returns the mask of all key usages that are possible for |algorithm| and
    431 // |key_type|. If the combination of |algorithm| and |key_type| doesn't make
    432 // sense, then returns 0 (no usages).
    433 blink::WebCryptoKeyUsageMask GetValidKeyUsagesForKeyType(
    434     blink::WebCryptoAlgorithmId algorithm,
    435     blink::WebCryptoKeyType key_type) {
    436   if (IsAlgorithmAsymmetric(algorithm) ==
    437       (key_type == blink::WebCryptoKeyTypeSecret))
    438     return 0;
    439 
    440   switch (algorithm) {
    441     case blink::WebCryptoAlgorithmIdAesCbc:
    442     case blink::WebCryptoAlgorithmIdAesGcm:
    443     case blink::WebCryptoAlgorithmIdAesCtr:
    444       return blink::WebCryptoKeyUsageEncrypt | blink::WebCryptoKeyUsageDecrypt |
    445              blink::WebCryptoKeyUsageWrapKey |
    446              blink::WebCryptoKeyUsageUnwrapKey;
    447     case blink::WebCryptoAlgorithmIdAesKw:
    448       return blink::WebCryptoKeyUsageWrapKey |
    449              blink::WebCryptoKeyUsageUnwrapKey;
    450     case blink::WebCryptoAlgorithmIdHmac:
    451       return blink::WebCryptoKeyUsageSign | blink::WebCryptoKeyUsageVerify;
    452     case blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5:
    453       switch (key_type) {
    454         case blink::WebCryptoKeyTypePublic:
    455           return blink::WebCryptoKeyUsageVerify;
    456         case blink::WebCryptoKeyTypePrivate:
    457           return blink::WebCryptoKeyUsageSign;
    458         default:
    459           return 0;
    460       }
    461     case blink::WebCryptoAlgorithmIdRsaOaep:
    462       switch (key_type) {
    463         case blink::WebCryptoKeyTypePublic:
    464           return blink::WebCryptoKeyUsageEncrypt |
    465                  blink::WebCryptoKeyUsageWrapKey;
    466         case blink::WebCryptoKeyTypePrivate:
    467           return blink::WebCryptoKeyUsageDecrypt |
    468                  blink::WebCryptoKeyUsageUnwrapKey;
    469         default:
    470           return 0;
    471       }
    472     default:
    473       return 0;
    474   }
    475 }
    476 
    477 // Returns Status::Success() if |usages| is a valid set of key usages for
    478 // |algorithm| and |key_type|. Otherwise returns an error.
    479 // In the case of JWK format the check is incomplete for asymmetric algorithms.
    480 Status BestEffortCheckKeyUsagesForImport(blink::WebCryptoAlgorithmId algorithm,
    481                                          blink::WebCryptoKeyFormat format,
    482                                          blink::WebCryptoKeyUsageMask usages) {
    483   if (!IsAlgorithmAsymmetric(algorithm))
    484     return CheckKeyUsages(algorithm, blink::WebCryptoKeyTypeSecret, usages);
    485 
    486   // Try to infer the key type given the import format.
    487   blink::WebCryptoKeyType key_type;
    488   bool key_type_known = false;
    489 
    490   switch (format) {
    491     case blink::WebCryptoKeyFormatRaw:
    492       // TODO(eroman): The spec defines Diffie-Hellman raw import for public
    493       // keys, so this will need to be updated in the future when DH is
    494       // implemented.
    495       return Status::ErrorUnexpected();
    496     case blink::WebCryptoKeyFormatSpki:
    497       key_type = blink::WebCryptoKeyTypePublic;
    498       key_type_known = true;
    499       break;
    500     case blink::WebCryptoKeyFormatPkcs8:
    501       key_type = blink::WebCryptoKeyTypePrivate;
    502       key_type_known = true;
    503       break;
    504     case blink::WebCryptoKeyFormatJwk:
    505       key_type_known = false;
    506       break;
    507     default:
    508       return Status::ErrorUnexpected();
    509   }
    510 
    511   if (key_type_known)
    512     return CheckKeyUsages(algorithm, key_type, usages);
    513 
    514   // If the key type is not known, then the algorithm is asymmetric. Whether the
    515   // key data describes a public or private key isn't known yet. But it must at
    516   // least be ONE of those two.
    517   DCHECK(IsAlgorithmAsymmetric(algorithm));
    518 
    519   if (CheckKeyUsages(algorithm, blink::WebCryptoKeyTypePublic, usages)
    520           .IsError() &&
    521       CheckKeyUsages(algorithm, blink::WebCryptoKeyTypePrivate, usages)
    522           .IsError()) {
    523     return Status::ErrorCreateKeyBadUsages();
    524   }
    525 
    526   return Status::Success();
    527 }
    528 
    529 // Returns an error if |combined_usage_mask| is invalid for generating a key
    530 // pair for |algorithm|. Otherwise returns Status::Success(), and fills
    531 // |public_key_usages| with the usages for the public key, and
    532 // |private_key_usages| with those for the private key.
    533 Status CheckKeyUsagesForGenerateKeyPair(
    534     blink::WebCryptoAlgorithmId algorithm,
    535     blink::WebCryptoKeyUsageMask combined_usage_mask,
    536     blink::WebCryptoKeyUsageMask* public_key_usages,
    537     blink::WebCryptoKeyUsageMask* private_key_usages) {
    538   DCHECK(IsAlgorithmAsymmetric(algorithm));
    539 
    540   blink::WebCryptoKeyUsageMask all_public_key_usages =
    541       GetValidKeyUsagesForKeyType(algorithm, blink::WebCryptoKeyTypePublic);
    542   blink::WebCryptoKeyUsageMask all_private_key_usages =
    543       GetValidKeyUsagesForKeyType(algorithm, blink::WebCryptoKeyTypePrivate);
    544 
    545   if (!ContainsKeyUsages(all_public_key_usages | all_private_key_usages,
    546                          combined_usage_mask))
    547     return Status::ErrorCreateKeyBadUsages();
    548 
    549   *public_key_usages = combined_usage_mask & all_public_key_usages;
    550   *private_key_usages = combined_usage_mask & all_private_key_usages;
    551 
    552   return Status::Success();
    553 }
    554 
    555 // Converts a (big-endian) WebCrypto BigInteger, with or without leading zeros,
    556 // to unsigned long.
    557 bool BigIntegerToLong(const uint8* data,
    558                       unsigned int data_size,
    559                       unsigned long* result) {
    560   // TODO(padolph): Is it correct to say that empty data is an error, or does it
    561   // mean value 0? See https://www.w3.org/Bugs/Public/show_bug.cgi?id=23655
    562   if (data_size == 0)
    563     return false;
    564 
    565   *result = 0;
    566   for (size_t i = 0; i < data_size; ++i) {
    567     size_t reverse_i = data_size - i - 1;
    568 
    569     if (reverse_i >= sizeof(unsigned long) && data[i])
    570       return false;  // Too large for a long.
    571 
    572     *result |= data[i] << 8 * reverse_i;
    573   }
    574   return true;
    575 }
    576 
    577 
    578 }  // namespace
    579 
    580 void Init() { platform::Init(); }
    581 
    582 Status Encrypt(const blink::WebCryptoAlgorithm& algorithm,
    583                const blink::WebCryptoKey& key,
    584                const CryptoData& data,
    585                std::vector<uint8>* buffer) {
    586   if (!KeyUsageAllows(key, blink::WebCryptoKeyUsageEncrypt))
    587     return Status::ErrorUnexpected();
    588   return EncryptDontCheckUsage(algorithm, key, data, buffer);
    589 }
    590 
    591 Status Decrypt(const blink::WebCryptoAlgorithm& algorithm,
    592                const blink::WebCryptoKey& key,
    593                const CryptoData& data,
    594                std::vector<uint8>* buffer) {
    595   if (!KeyUsageAllows(key, blink::WebCryptoKeyUsageDecrypt))
    596     return Status::ErrorUnexpected();
    597   return DecryptDontCheckKeyUsage(algorithm, key, data, buffer);
    598 }
    599 
    600 Status Digest(const blink::WebCryptoAlgorithm& algorithm,
    601               const CryptoData& data,
    602               std::vector<uint8>* buffer) {
    603   switch (algorithm.id()) {
    604     case blink::WebCryptoAlgorithmIdSha1:
    605     case blink::WebCryptoAlgorithmIdSha256:
    606     case blink::WebCryptoAlgorithmIdSha384:
    607     case blink::WebCryptoAlgorithmIdSha512:
    608       return platform::DigestSha(algorithm.id(), data, buffer);
    609     default:
    610       return Status::ErrorUnsupported();
    611   }
    612 }
    613 
    614 scoped_ptr<blink::WebCryptoDigestor> CreateDigestor(
    615     blink::WebCryptoAlgorithmId algorithm) {
    616   return platform::CreateDigestor(algorithm);
    617 }
    618 
    619 Status GenerateSecretKey(const blink::WebCryptoAlgorithm& algorithm,
    620                          bool extractable,
    621                          blink::WebCryptoKeyUsageMask usage_mask,
    622                          blink::WebCryptoKey* key) {
    623   Status status =
    624       CheckKeyUsages(algorithm.id(), blink::WebCryptoKeyTypeSecret, usage_mask);
    625   if (status.IsError())
    626     return status;
    627 
    628   unsigned int keylen_bytes = 0;
    629 
    630   // Get the secret key length in bytes from generation parameters.
    631   // This resolves any defaults.
    632   switch (algorithm.id()) {
    633     case blink::WebCryptoAlgorithmIdAesCbc:
    634     case blink::WebCryptoAlgorithmIdAesGcm:
    635     case blink::WebCryptoAlgorithmIdAesKw: {
    636       if (!IsValidAesKeyLengthBits(algorithm.aesKeyGenParams()->lengthBits())) {
    637         return algorithm.aesKeyGenParams()->lengthBits() == 192
    638                    ? Status::ErrorAes192BitUnsupported()
    639                    : Status::ErrorGenerateKeyLength();
    640       }
    641       keylen_bytes = algorithm.aesKeyGenParams()->lengthBits() / 8;
    642       break;
    643     }
    644     case blink::WebCryptoAlgorithmIdHmac: {
    645       const blink::WebCryptoHmacKeyGenParams* params =
    646           algorithm.hmacKeyGenParams();
    647       DCHECK(params);
    648       if (params->hasLengthBits()) {
    649         if (params->optionalLengthBits() % 8)
    650           return Status::ErrorGenerateKeyLength();
    651         keylen_bytes = params->optionalLengthBits() / 8;
    652       } else {
    653         keylen_bytes = ShaBlockSizeBytes(params->hash().id());
    654         if (keylen_bytes == 0)
    655           return Status::ErrorUnsupported();
    656       }
    657       break;
    658     }
    659 
    660     default:
    661       return Status::ErrorUnsupported();
    662   }
    663 
    664   // TODO(eroman): Is this correct? HMAC can import zero-length keys, so should
    665   //               probably be able to allowed to generate them too.
    666   if (keylen_bytes == 0)
    667     return Status::ErrorGenerateKeyLength();
    668 
    669   return platform::GenerateSecretKey(
    670       algorithm, extractable, usage_mask, keylen_bytes, key);
    671 }
    672 
    673 Status GenerateKeyPair(const blink::WebCryptoAlgorithm& algorithm,
    674                        bool extractable,
    675                        blink::WebCryptoKeyUsageMask combined_usage_mask,
    676                        blink::WebCryptoKey* public_key,
    677                        blink::WebCryptoKey* private_key) {
    678   blink::WebCryptoKeyUsageMask public_key_usage_mask = 0;
    679   blink::WebCryptoKeyUsageMask private_key_usage_mask = 0;
    680 
    681   Status status = CheckKeyUsagesForGenerateKeyPair(algorithm.id(),
    682                                                    combined_usage_mask,
    683                                                    &public_key_usage_mask,
    684                                                    &private_key_usage_mask);
    685   if (status.IsError())
    686     return status;
    687 
    688   // TODO(padolph): Handle other asymmetric algorithm key generation.
    689   switch (algorithm.paramsType()) {
    690     case blink::WebCryptoAlgorithmParamsTypeRsaHashedKeyGenParams: {
    691       const blink::WebCryptoRsaHashedKeyGenParams* params =
    692           algorithm.rsaHashedKeyGenParams();
    693 
    694       if (!params->modulusLengthBits())
    695         return Status::ErrorGenerateRsaZeroModulus();
    696 
    697       unsigned long public_exponent = 0;
    698       if (!BigIntegerToLong(params->publicExponent().data(),
    699                             params->publicExponent().size(),
    700                             &public_exponent) ||
    701           (public_exponent != 3 && public_exponent != 65537)) {
    702         return Status::ErrorGenerateKeyPublicExponent();
    703       }
    704 
    705       return platform::GenerateRsaKeyPair(algorithm,
    706                                           extractable,
    707                                           public_key_usage_mask,
    708                                           private_key_usage_mask,
    709                                           params->modulusLengthBits(),
    710                                           public_exponent,
    711                                           public_key,
    712                                           private_key);
    713     }
    714     default:
    715       return Status::ErrorUnsupported();
    716   }
    717 }
    718 
    719 // Note that this function may be called from the target Blink thread.
    720 Status ImportKey(blink::WebCryptoKeyFormat format,
    721                  const CryptoData& key_data,
    722                  const blink::WebCryptoAlgorithm& algorithm,
    723                  bool extractable,
    724                  blink::WebCryptoKeyUsageMask usage_mask,
    725                  blink::WebCryptoKey* key) {
    726   // This is "best effort" because it is incomplete for JWK (for which the key
    727   // type is not yet known). ImportKeyJwk() does extra checks on key usage once
    728   // the key type has been determined.
    729   Status status =
    730       BestEffortCheckKeyUsagesForImport(algorithm.id(), format, usage_mask);
    731   if (status.IsError())
    732     return status;
    733 
    734   switch (format) {
    735     case blink::WebCryptoKeyFormatRaw:
    736       return ImportKeyRaw(key_data, algorithm, extractable, usage_mask, key);
    737     case blink::WebCryptoKeyFormatSpki:
    738       return platform::ImportKeySpki(
    739           algorithm, key_data, extractable, usage_mask, key);
    740     case blink::WebCryptoKeyFormatPkcs8:
    741       return platform::ImportKeyPkcs8(
    742           algorithm, key_data, extractable, usage_mask, key);
    743     case blink::WebCryptoKeyFormatJwk:
    744       return ImportKeyJwk(key_data, algorithm, extractable, usage_mask, key);
    745     default:
    746       return Status::ErrorUnsupported();
    747   }
    748 }
    749 
    750 // TODO(eroman): Move this to anonymous namespace.
    751 Status ExportKeyDontCheckExtractability(blink::WebCryptoKeyFormat format,
    752                                         const blink::WebCryptoKey& key,
    753                                         std::vector<uint8>* buffer) {
    754   switch (format) {
    755     case blink::WebCryptoKeyFormatRaw: {
    756       platform::SymKey* sym_key;
    757       Status status = ToPlatformSymKey(key, &sym_key);
    758       if (status.IsError())
    759         return status;
    760       return platform::ExportKeyRaw(sym_key, buffer);
    761     }
    762     case blink::WebCryptoKeyFormatSpki: {
    763       platform::PublicKey* public_key;
    764       Status status = ToPlatformPublicKey(key, &public_key);
    765       if (status.IsError())
    766         return status;
    767       return platform::ExportKeySpki(public_key, buffer);
    768     }
    769     case blink::WebCryptoKeyFormatPkcs8: {
    770       platform::PrivateKey* private_key;
    771       Status status = ToPlatformPrivateKey(key, &private_key);
    772       if (status.IsError())
    773         return status;
    774       return platform::ExportKeyPkcs8(private_key, key.algorithm(), buffer);
    775     }
    776     case blink::WebCryptoKeyFormatJwk:
    777       return ExportKeyJwk(key, buffer);
    778     default:
    779       return Status::ErrorUnsupported();
    780   }
    781 }
    782 
    783 Status ExportKey(blink::WebCryptoKeyFormat format,
    784                  const blink::WebCryptoKey& key,
    785                  std::vector<uint8>* buffer) {
    786   if (!key.extractable())
    787     return Status::ErrorKeyNotExtractable();
    788   return ExportKeyDontCheckExtractability(format, key, buffer);
    789 }
    790 
    791 Status Sign(const blink::WebCryptoAlgorithm& algorithm,
    792             const blink::WebCryptoKey& key,
    793             const CryptoData& data,
    794             std::vector<uint8>* buffer) {
    795   if (!KeyUsageAllows(key, blink::WebCryptoKeyUsageSign))
    796     return Status::ErrorUnexpected();
    797   if (algorithm.id() != key.algorithm().id())
    798     return Status::ErrorUnexpected();
    799 
    800   switch (algorithm.id()) {
    801     case blink::WebCryptoAlgorithmIdHmac:
    802       return SignHmac(algorithm, key, data, buffer);
    803     case blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5:
    804       return SignRsaSsaPkcs1v1_5(algorithm, key, data, buffer);
    805     default:
    806       return Status::ErrorUnsupported();
    807   }
    808 }
    809 
    810 Status VerifySignature(const blink::WebCryptoAlgorithm& algorithm,
    811                        const blink::WebCryptoKey& key,
    812                        const CryptoData& signature,
    813                        const CryptoData& data,
    814                        bool* signature_match) {
    815   if (!KeyUsageAllows(key, blink::WebCryptoKeyUsageVerify))
    816     return Status::ErrorUnexpected();
    817   if (algorithm.id() != key.algorithm().id())
    818     return Status::ErrorUnexpected();
    819 
    820   if (!signature.byte_length()) {
    821     // None of the algorithms generate valid zero-length signatures so this
    822     // will necessarily fail verification. Early return to protect
    823     // implementations from dealing with a NULL signature pointer.
    824     *signature_match = false;
    825     return Status::Success();
    826   }
    827 
    828   switch (algorithm.id()) {
    829     case blink::WebCryptoAlgorithmIdHmac:
    830       return VerifyHmac(algorithm, key, signature, data, signature_match);
    831     case blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5:
    832       return VerifyRsaSsaPkcs1v1_5(
    833           algorithm, key, signature, data, signature_match);
    834     default:
    835       return Status::ErrorUnsupported();
    836   }
    837 }
    838 
    839 Status WrapKey(blink::WebCryptoKeyFormat format,
    840                const blink::WebCryptoKey& key_to_wrap,
    841                const blink::WebCryptoKey& wrapping_key,
    842                const blink::WebCryptoAlgorithm& wrapping_algorithm,
    843                std::vector<uint8>* buffer) {
    844   if (!KeyUsageAllows(wrapping_key, blink::WebCryptoKeyUsageWrapKey))
    845     return Status::ErrorUnexpected();
    846   if (wrapping_algorithm.id() != wrapping_key.algorithm().id())
    847     return Status::ErrorUnexpected();
    848 
    849   return WrapKeyExportAndEncrypt(
    850       format, key_to_wrap, wrapping_key, wrapping_algorithm, buffer);
    851 }
    852 
    853 Status UnwrapKey(blink::WebCryptoKeyFormat format,
    854                  const CryptoData& wrapped_key_data,
    855                  const blink::WebCryptoKey& wrapping_key,
    856                  const blink::WebCryptoAlgorithm& wrapping_algorithm,
    857                  const blink::WebCryptoAlgorithm& algorithm,
    858                  bool extractable,
    859                  blink::WebCryptoKeyUsageMask usage_mask,
    860                  blink::WebCryptoKey* key) {
    861   if (!KeyUsageAllows(wrapping_key, blink::WebCryptoKeyUsageUnwrapKey))
    862     return Status::ErrorUnexpected();
    863   if (wrapping_algorithm.id() != wrapping_key.algorithm().id())
    864     return Status::ErrorUnexpected();
    865 
    866   // Fail-fast if the key usages don't make sense. This avoids decrypting the
    867   // key only to then have import fail. It is "best effort" because when
    868   // unwrapping JWK for asymmetric algorithms the key type isn't known yet.
    869   Status status =
    870       BestEffortCheckKeyUsagesForImport(algorithm.id(), format, usage_mask);
    871   if (status.IsError())
    872     return status;
    873 
    874   return UnwrapKeyDecryptAndImport(format,
    875                                    wrapped_key_data,
    876                                    wrapping_key,
    877                                    wrapping_algorithm,
    878                                    algorithm,
    879                                    extractable,
    880                                    usage_mask,
    881                                    key);
    882 }
    883 
    884 // Note that this function is called from the target Blink thread.
    885 bool SerializeKeyForClone(const blink::WebCryptoKey& key,
    886                           blink::WebVector<uint8>* key_data) {
    887   return static_cast<webcrypto::platform::Key*>(key.handle())
    888       ->ThreadSafeSerializeForClone(key_data);
    889 }
    890 
    891 // Note that this function is called from the target Blink thread.
    892 bool DeserializeKeyForClone(const blink::WebCryptoKeyAlgorithm& algorithm,
    893                             blink::WebCryptoKeyType type,
    894                             bool extractable,
    895                             blink::WebCryptoKeyUsageMask usage_mask,
    896                             const CryptoData& key_data,
    897                             blink::WebCryptoKey* key) {
    898   // TODO(eroman): This should not call into the platform crypto layer.
    899   // Otherwise it runs the risk of stalling while the NSS/OpenSSL global locks
    900   // are held.
    901   //
    902   // An alternate approach is to defer the key import until the key is used.
    903   // However this means that any deserialization errors would have to be
    904   // surfaced as WebCrypto errors, leading to slightly different behaviors. For
    905   // instance you could clone a key which fails to be deserialized.
    906   Status status = ImportKey(GetCloneFormatForKeyType(type),
    907                             key_data,
    908                             KeyAlgorithmToImportAlgorithm(algorithm),
    909                             extractable,
    910                             usage_mask,
    911                             key);
    912   if (status.IsError())
    913     return false;
    914   return ValidateDeserializedKey(*key, algorithm, type);
    915 }
    916 
    917 Status ToPlatformSymKey(const blink::WebCryptoKey& key,
    918                         platform::SymKey** out) {
    919   *out = static_cast<platform::Key*>(key.handle())->AsSymKey();
    920   if (!*out)
    921     return Status::ErrorUnexpectedKeyType();
    922   return Status::Success();
    923 }
    924 
    925 Status ToPlatformPublicKey(const blink::WebCryptoKey& key,
    926                            platform::PublicKey** out) {
    927   *out = static_cast<platform::Key*>(key.handle())->AsPublicKey();
    928   if (!*out)
    929     return Status::ErrorUnexpectedKeyType();
    930   return Status::Success();
    931 }
    932 
    933 Status ToPlatformPrivateKey(const blink::WebCryptoKey& key,
    934                             platform::PrivateKey** out) {
    935   *out = static_cast<platform::Key*>(key.handle())->AsPrivateKey();
    936   if (!*out)
    937     return Status::ErrorUnexpectedKeyType();
    938   return Status::Success();
    939 }
    940 
    941 // Returns Status::Success() if |usages| is a valid set of key usages for
    942 // |algorithm| and |key_type|. Otherwise returns an error.
    943 Status CheckKeyUsages(blink::WebCryptoAlgorithmId algorithm,
    944                       blink::WebCryptoKeyType key_type,
    945                       blink::WebCryptoKeyUsageMask usages) {
    946   if (!ContainsKeyUsages(GetValidKeyUsagesForKeyType(algorithm, key_type),
    947                          usages))
    948     return Status::ErrorCreateKeyBadUsages();
    949 
    950   return Status::Success();
    951 }
    952 
    953 }  // namespace webcrypto
    954 
    955 }  // namespace content
    956