Stop using HMAC for gpu mailboxes

For a long time, we've been using HMAC to sign the mailbox names on the GPU
process. However, we don't actually need the mailbox names to be guaranteed to
be generated by the GPU process, we only need to ensure they're unguessable.

The HMAC signature and verification has several costs:
- the cost to sign the mailbox
- the cost to verify the mailbox
- the initialization cost (e.g. starting NSS in the GPU process)

We can actually save all that cost, by just making the mailbox names
(crypto-)random.

BUG=311259

Review URL: https://codereview.chromium.org/157243002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@249922 0039d316-1c4b-4281-b951-d872f2087c98

14 files changed, 84 insertions, 216 deletions

diff --git a/content/common/gpu/gpu_channel.cc b/content/common/gpu/gpu_channel.cc
index 7ce8d30..6ddebc4 100644
--- a/content/common/gpu/gpu_channel.cc
+++ b/content/common/gpu/gpu_channel.cc
@@ -15,7 +15,6 @@
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
 #include "base/message_loop/message_loop_proxy.h"
-#include "base/rand_util.h"
 #include "base/strings/string_util.h"
 #include "base/timer/timer.h"
 #include "content/common/gpu/devtools_gpu_agent.h"
@@ -24,7 +23,7 @@
 #include "content/common/gpu/media/gpu_video_encode_accelerator.h"
 #include "content/common/gpu/sync_point_manager.h"
 #include "content/public/common/content_switches.h"
-#include "crypto/hmac.h"
+#include "crypto/random.h"
 #include "gpu/command_buffer/common/mailbox.h"
 #include "gpu/command_buffer/service/gpu_scheduler.h"
 #include "gpu/command_buffer/service/image_manager.h"
@@ -75,8 +74,7 @@ const int64 kStopPreemptThresholdMs = kVsyncIntervalMs;
 class GpuChannelMessageFilter : public IPC::ChannelProxy::MessageFilter {
  public:
   // Takes ownership of gpu_channel (see below).
-  GpuChannelMessageFilter(const std::string& private_key,
-                          base::WeakPtr<GpuChannel>* gpu_channel,
+  GpuChannelMessageFilter(base::WeakPtr<GpuChannel>* gpu_channel,
                           scoped_refptr<SyncPointManager> sync_point_manager,
                           scoped_refptr<base::MessageLoopProxy> message_loop)
       : preemption_state_(IDLE),
@@ -85,10 +83,7 @@ class GpuChannelMessageFilter : public IPC::ChannelProxy::MessageFilter {
         sync_point_manager_(sync_point_manager),
         message_loop_(message_loop),
         messages_forwarded_to_channel_(0),
-        a_stub_is_descheduled_(false),
-        hmac_(crypto::HMAC::SHA256) {
-    bool success = hmac_.Init(base::StringPiece(private_key));
-    DCHECK(success);
+        a_stub_is_descheduled_(false) {
   }
 
   virtual void OnFilterAdded(IPC::Channel* channel) OVERRIDE {
@@ -179,18 +174,8 @@ class GpuChannelMessageFilter : public IPC::ChannelProxy::MessageFilter {
 
     result->resize(num);
 
-    for (unsigned i = 0; i < num; ++i) {
-      char name[GL_MAILBOX_SIZE_CHROMIUM];
-      base::RandBytes(name, sizeof(name) / 2);
-
-      bool success = hmac_.Sign(
-          base::StringPiece(name, sizeof(name) / 2),
-          reinterpret_cast<unsigned char*>(name) + sizeof(name) / 2,
-          sizeof(name) / 2);
-      DCHECK(success);
-
-      (*result)[i].SetName(reinterpret_cast<int8*>(name));
-    }
+    for (unsigned i = 0; i < num; ++i)
+      crypto::RandBytes((*result)[i].name, sizeof((*result)[i].name));
   }
 
   void OnGenerateMailboxNamesAsync(unsigned num) {
@@ -423,8 +408,6 @@ class GpuChannelMessageFilter : public IPC::ChannelProxy::MessageFilter {
   base::OneShotTimer<GpuChannelMessageFilter> timer_;
 
   bool a_stub_is_descheduled_;
-
-  crypto::HMAC hmac_;
 };
 
 GpuChannel::GpuChannel(GpuChannelManager* gpu_channel_manager,
@@ -474,7 +457,6 @@ bool GpuChannel::Init(base::MessageLoopProxy* io_message_loop,
       weak_factory_.GetWeakPtr()));
 
   filter_ = new GpuChannelMessageFilter(
-      mailbox_manager_->private_key(),
       weak_ptr,
       gpu_channel_manager_->sync_point_manager(),
       base::MessageLoopProxy::current());
diff --git a/content/common/gpu/gpu_command_buffer_stub.cc b/content/common/gpu/gpu_command_buffer_stub.cc
index ad048c6..13b7b22 100644
--- a/content/common/gpu/gpu_command_buffer_stub.cc
+++ b/content/common/gpu/gpu_command_buffer_stub.cc
@@ -608,11 +608,12 @@ void GpuCommandBufferStub::OnSetGetBuffer(int32 shm_id,
 
 void GpuCommandBufferStub::OnProduceFrontBuffer(const gpu::Mailbox& mailbox) {
   TRACE_EVENT0("gpu", "GpuCommandBufferStub::OnProduceFrontBuffer");
-  if (!decoder_)
+  if (!decoder_) {
     LOG(ERROR) << "Can't produce front buffer before initialization.";
+    return;
+  }
 
-  if (!decoder_->ProduceFrontBuffer(mailbox))
-    LOG(ERROR) << "Failed to produce front buffer.";
+  decoder_->ProduceFrontBuffer(mailbox);
 }
 
 void GpuCommandBufferStub::OnGetState(IPC::Message* reply_message) {
diff --git a/content/common/gpu/texture_image_transport_surface.cc b/content/common/gpu/texture_image_transport_surface.cc
index e1db18a..f13a986 100644
--- a/content/common/gpu/texture_image_transport_surface.cc
+++ b/content/common/gpu/texture_image_transport_surface.cc
@@ -15,15 +15,16 @@
 #include "content/public/common/content_switches.h"
 #include "gpu/command_buffer/service/context_group.h"
 #include "gpu/command_buffer/service/gpu_scheduler.h"
+#include "gpu/command_buffer/service/mailbox_manager.h"
 #include "ui/gl/scoped_binders.h"
 
 using gpu::gles2::ContextGroup;
 using gpu::gles2::GLES2Decoder;
 using gpu::gles2::MailboxManager;
-using gpu::gles2::MailboxName;
 using gpu::gles2::Texture;
 using gpu::gles2::TextureManager;
 using gpu::gles2::TextureRef;
+using gpu::Mailbox;
 
 namespace content {
 namespace {
@@ -218,8 +219,8 @@ bool TextureImageTransportSurface::SwapBuffers() {
   params.size = backbuffer_size();
   params.scale_factor = scale_factor_;
   params.mailbox_name.assign(
-      reinterpret_cast<const char*>(&back_mailbox_name_),
-      sizeof(back_mailbox_name_));
+      reinterpret_cast<const char*>(&back_mailbox_),
+      sizeof(back_mailbox_));
 
   glFlush();
 
@@ -258,8 +259,8 @@ bool TextureImageTransportSurface::PostSubBuffer(
   params.width = width;
   params.height = height;
   params.mailbox_name.assign(
-      reinterpret_cast<const char*>(&back_mailbox_name_),
-      sizeof(back_mailbox_name_));
+      reinterpret_cast<const char*>(&back_mailbox_),
+      sizeof(back_mailbox_));
 
   glFlush();
 
@@ -323,7 +324,7 @@ void TextureImageTransportSurface::BufferPresentedImpl(
   if (!mailbox_name.empty()) {
     DCHECK(mailbox_name.length() == GL_MAILBOX_SIZE_CHROMIUM);
     if (!memcmp(mailbox_name.data(),
-                &back_mailbox_name_,
+                &back_mailbox_,
                 mailbox_name.length())) {
       // The browser has skipped the frame to unblock the GPU process, waiting
       // for one of the right size, and returned the back buffer, so don't swap.
@@ -332,7 +333,7 @@ void TextureImageTransportSurface::BufferPresentedImpl(
   }
   if (swap) {
     std::swap(backbuffer_, frontbuffer_);
-    std::swap(back_mailbox_name_, front_mailbox_name_);
+    std::swap(back_mailbox_, front_mailbox_);
   }
 
   // We're relying on the fact that the parent context is
@@ -362,7 +363,7 @@ void TextureImageTransportSurface::OnResizeViewACK() {
 void TextureImageTransportSurface::ReleaseBackTexture() {
   DCHECK(IsContextValid(helper_.get()));
   backbuffer_ = NULL;
-  back_mailbox_name_ = MailboxName();
+  back_mailbox_ = Mailbox();
   glFlush();
   CHECK_GL_ERROR();
 }
@@ -370,7 +371,7 @@ void TextureImageTransportSurface::ReleaseBackTexture() {
 void TextureImageTransportSurface::ReleaseFrontTexture() {
   DCHECK(IsContextValid(helper_.get()));
   frontbuffer_ = NULL;
-  front_mailbox_name_ = MailboxName();
+  front_mailbox_ = Mailbox();
   glFlush();
   CHECK_GL_ERROR();
   helper_->SendAcceleratedSurfaceRelease();
@@ -391,15 +392,13 @@ void TextureImageTransportSurface::CreateBackTexture() {
   TextureManager* texture_manager =
       decoder->GetContextGroup()->texture_manager();
   if (!backbuffer_.get()) {
-    mailbox_manager_->GenerateMailboxName(&back_mailbox_name_);
+    mailbox_manager_->GenerateMailbox(&back_mailbox_);
     GLuint service_id;
     glGenTextures(1, &service_id);
     backbuffer_ = TextureRef::Create(texture_manager, 0, service_id);
     texture_manager->SetTarget(backbuffer_.get(), GL_TEXTURE_2D);
     Texture* texture = texture_manager->Produce(backbuffer_.get());
-    bool success = mailbox_manager_->ProduceTexture(
-        GL_TEXTURE_2D, back_mailbox_name_, texture);
-    DCHECK(success);
+    mailbox_manager_->ProduceTexture(GL_TEXTURE_2D, back_mailbox_, texture);
   }
 
   {
diff --git a/content/common/gpu/texture_image_transport_surface.h b/content/common/gpu/texture_image_transport_surface.h
index 2162ffe..ab3eb44 100644
--- a/content/common/gpu/texture_image_transport_surface.h
+++ b/content/common/gpu/texture_image_transport_surface.h
@@ -11,7 +11,7 @@
 #include "base/memory/scoped_ptr.h"
 #include "content/common/gpu/gpu_command_buffer_stub.h"
 #include "content/common/gpu/image_transport_surface.h"
-#include "gpu/command_buffer/service/mailbox_manager.h"
+#include "gpu/command_buffer/common/mailbox.h"
 #include "gpu/command_buffer/service/texture_manager.h"
 #include "ui/gl/gl_context.h"
 #include "ui/gl/gl_surface.h"
@@ -86,8 +86,8 @@ class TextureImageTransportSurface
 
   // The mailbox name for the current backbuffer texture. Needs to be unique per
   // GL texture and is invalid while service_id is zero.
-  gpu::gles2::MailboxName back_mailbox_name_;
-  gpu::gles2::MailboxName front_mailbox_name_;
+  gpu::Mailbox back_mailbox_;
+  gpu::Mailbox front_mailbox_;
 
   // The current size of the GLSurface. Used to disambiguate from the current
   // texture size which might be outdated (since we use two buffers).
diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
index 713b337..fdc7de4 100644
--- a/content/gpu/gpu_main.cc
+++ b/content/gpu/gpu_main.cc
@@ -29,7 +29,6 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
-#include "crypto/hmac.h"
 #include "gpu/command_buffer/service/gpu_switches.h"
 #include "gpu/config/gpu_info_collector.h"
 #include "gpu/config/gpu_util.h"
@@ -385,18 +384,6 @@ bool WarmUpSandbox(const CommandLine& command_line) {
     // platforms.
     (void) base::RandUint64();
   }
-  {
-    TRACE_EVENT0("gpu", "Warm up HMAC");
-    // Warm up the crypto subsystem, which needs to done pre-sandbox on all
-    // platforms.
-    crypto::HMAC hmac(crypto::HMAC::SHA256);
-    unsigned char key = '\0';
-    if (!hmac.Init(&key, sizeof(key))) {
-      LOG(ERROR) << "WarmUpSandbox() failed with crypto::HMAC::Init()";
-      return false;
-    }
-  }
-
   return true;
 }
 
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 9cfe466..bc87b96 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -531,7 +531,7 @@ class GLES2DecoderImpl : public GLES2Decoder,
   virtual void Destroy(bool have_context) OVERRIDE;
   virtual void SetSurface(
       const scoped_refptr<gfx::GLSurface>& surface) OVERRIDE;
-  virtual bool ProduceFrontBuffer(const Mailbox& mailbox) OVERRIDE;
+  virtual void ProduceFrontBuffer(const Mailbox& mailbox) OVERRIDE;
   virtual bool ResizeOffscreenFrameBuffer(const gfx::Size& size) OVERRIDE;
   void UpdateParentTextureInfo();
   virtual bool MakeCurrent() OVERRIDE;
@@ -3335,9 +3335,11 @@ void GLES2DecoderImpl::SetSurface(
   RestoreCurrentFramebufferBindings();
 }
 
-bool GLES2DecoderImpl::ProduceFrontBuffer(const Mailbox& mailbox) {
-  if (!offscreen_saved_color_texture_.get())
-    return false;
+void GLES2DecoderImpl::ProduceFrontBuffer(const Mailbox& mailbox) {
+  if (!offscreen_saved_color_texture_.get()) {
+    LOG(ERROR) << "Called ProduceFrontBuffer on a non-offscreen context";
+    return;
+  }
   if (!offscreen_saved_color_texture_info_.get()) {
     GLuint service_id = offscreen_saved_color_texture_->id();
     offscreen_saved_color_texture_info_ = TextureRef::Create(
@@ -3346,10 +3348,8 @@ bool GLES2DecoderImpl::ProduceFrontBuffer(const Mailbox& mailbox) {
                                  GL_TEXTURE_2D);
     UpdateParentTextureInfo();
   }
-  gpu::gles2::MailboxName name;
-  memcpy(name.key, mailbox.name, sizeof(mailbox.name));
-  return mailbox_manager()->ProduceTexture(
-      GL_TEXTURE_2D, name, offscreen_saved_color_texture_info_->texture());
+  mailbox_manager()->ProduceTexture(
+      GL_TEXTURE_2D, mailbox, offscreen_saved_color_texture_info_->texture());
 }
 
 bool GLES2DecoderImpl::ResizeOffscreenFrameBuffer(const gfx::Size& size) {
@@ -10016,15 +10016,10 @@ void GLES2DecoderImpl::DoProduceTextureCHROMIUM(GLenum target,
     return;
   }
 
-  if (!group_->mailbox_manager()->ProduceTexture(
+  group_->mailbox_manager()->ProduceTexture(
       target,
-      *reinterpret_cast<const MailboxName*>(mailbox),
-      produced)) {
-    LOCAL_SET_GL_ERROR(
-        GL_INVALID_OPERATION,
-        "glProduceTextureCHROMIUM", "invalid mailbox name");
-    return;
-  }
+      *reinterpret_cast<const Mailbox*>(mailbox),
+      produced);
 }
 
 void GLES2DecoderImpl::DoConsumeTextureCHROMIUM(GLenum target,
@@ -10051,7 +10046,7 @@ void GLES2DecoderImpl::DoConsumeTextureCHROMIUM(GLenum target,
   Texture* texture =
       group_->mailbox_manager()->ConsumeTexture(
       target,
-      *reinterpret_cast<const MailboxName*>(mailbox));
+      *reinterpret_cast<const Mailbox*>(mailbox));
   if (!texture) {
     LOCAL_SET_GL_ERROR(
         GL_INVALID_OPERATION,
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.h b/gpu/command_buffer/service/gles2_cmd_decoder.h
index 10e63e6..c4372e2 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.h
@@ -117,7 +117,7 @@ class GPU_EXPORT GLES2Decoder : public base::SupportsWeakPtr<GLES2Decoder>,
   // Set the surface associated with the default FBO.
   virtual void SetSurface(const scoped_refptr<gfx::GLSurface>& surface) = 0;
 
-  virtual bool ProduceFrontBuffer(const Mailbox& mailbox) = 0;
+  virtual void ProduceFrontBuffer(const Mailbox& mailbox) = 0;
 
   // Resize an offscreen frame buffer.
   virtual bool ResizeOffscreenFrameBuffer(const gfx::Size& size) = 0;
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_mock.h b/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
index 387e272..3272472 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_mock.h
@@ -42,7 +42,7 @@ class MockGLES2Decoder : public GLES2Decoder {
                     const std::vector<int32>& attribs));
   MOCK_METHOD1(Destroy, void(bool have_context));
   MOCK_METHOD1(SetSurface, void(const scoped_refptr<gfx::GLSurface>& surface));
-  MOCK_METHOD1(ProduceFrontBuffer, bool(const Mailbox& mailbox));
+  MOCK_METHOD1(ProduceFrontBuffer, void(const Mailbox& mailbox));
   MOCK_METHOD1(ResizeOffscreenFrameBuffer, bool(const gfx::Size& size));
   MOCK_METHOD0(MakeCurrent, bool());
   MOCK_METHOD1(GetServiceIdForTesting, uint32(uint32 client_id));
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest.cc b/gpu/command_buffer/service/gles2_cmd_decoder_unittest.cc
index 12f0db8..bcd8aaf 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest.cc
@@ -7067,11 +7067,10 @@ TEST_F(GLES2DecoderTest, BeginEndQueryEXTGetErrorQueryCHROMIUM) {
 }
 
 TEST_F(GLES2DecoderTest, ProduceAndConsumeTextureCHROMIUM) {
-  GLbyte mailbox[GL_MAILBOX_SIZE_CHROMIUM];
-  group().mailbox_manager()->GenerateMailboxName(
-      reinterpret_cast<MailboxName*>(mailbox));
+  Mailbox mailbox;
+  group().mailbox_manager()->GenerateMailbox(&mailbox);
 
-  memcpy(shared_memory_address_, mailbox, sizeof(mailbox));
+  memcpy(shared_memory_address_, mailbox.name, sizeof(mailbox.name));
 
   DoBindTexture(GL_TEXTURE_2D, client_texture_id_, kServiceTextureId);
   DoTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 3, 1, 0, GL_RGBA, GL_UNSIGNED_BYTE,
@@ -7126,7 +7125,7 @@ TEST_F(GLES2DecoderTest, ProduceAndConsumeTextureCHROMIUM) {
       .Times(1)
       .RetiresOnSaturation();
 
-  memcpy(shared_memory_address_, mailbox, sizeof(mailbox));
+  memcpy(shared_memory_address_, mailbox.name, sizeof(mailbox.name));
   ConsumeTextureCHROMIUM consume_cmd;
   consume_cmd.Init(GL_TEXTURE_2D, kSharedMemoryId, kSharedMemoryOffset);
   EXPECT_EQ(error::kNoError, ExecuteCmd(consume_cmd));
diff --git a/gpu/command_buffer/service/gpu_control_service.cc b/gpu/command_buffer/service/gpu_control_service.cc
index 013c06a..9a198e6 100644
--- a/gpu/command_buffer/service/gpu_control_service.cc
+++ b/gpu/command_buffer/service/gpu_control_service.cc
@@ -127,11 +127,8 @@ bool GpuControlService::GenerateMailboxNames(
     unsigned num, std::vector<gpu::Mailbox>* names) {
   DCHECK(names->empty());
   names->resize(num);
-  for (unsigned i = 0; i < num; ++i) {
-    gles2::MailboxName name;
-    mailbox_manager_->GenerateMailboxName(&name);
-    (*names)[i].SetName(name.key);
-  }
+  for (unsigned i = 0; i < num; ++i)
+    mailbox_manager_->GenerateMailbox(&(*names)[i]);
   return true;
 }
 
diff --git a/gpu/command_buffer/service/mailbox_manager.cc b/gpu/command_buffer/service/mailbox_manager.cc
index bb2f726..e2fb86f 100644
--- a/gpu/command_buffer/service/mailbox_manager.cc
+++ b/gpu/command_buffer/service/mailbox_manager.cc
@@ -6,26 +6,14 @@
 
 #include <algorithm>
 
-#include "base/rand_util.h"
-#include "crypto/hmac.h"
+#include "crypto/random.h"
 #include "gpu/command_buffer/service/texture_manager.h"
 
 namespace gpu {
 namespace gles2 {
 
-MailboxName::MailboxName() {
-  std::fill(key, key + sizeof(key), 0);
-  std::fill(signature, signature + sizeof(signature), 0);
-}
-
 MailboxManager::MailboxManager()
-    : hmac_(crypto::HMAC::SHA256),
-      mailbox_to_textures_(std::ptr_fun(&MailboxManager::TargetNameLess)) {
-  base::RandBytes(private_key_, sizeof(private_key_));
-  bool success = hmac_.Init(
-      base::StringPiece(private_key_, sizeof(private_key_)));
-  DCHECK(success);
-  DCHECK(!IsMailboxNameValid(MailboxName()));
+    : mailbox_to_textures_(std::ptr_fun(&MailboxManager::TargetNameLess)) {
 }
 
 MailboxManager::~MailboxManager() {
@@ -33,30 +21,25 @@ MailboxManager::~MailboxManager() {
   DCHECK(textures_to_mailboxes_.empty());
 }
 
-void MailboxManager::GenerateMailboxName(MailboxName* name) {
-  base::RandBytes(name->key, sizeof(name->key));
-  SignMailboxName(name);
+void MailboxManager::GenerateMailbox(Mailbox* mailbox) {
+  crypto::RandBytes(mailbox->name, sizeof(mailbox->name));
 }
 
 Texture* MailboxManager::ConsumeTexture(unsigned target,
-                                        const MailboxName& name) {
+                                        const Mailbox& mailbox) {
   MailboxToTextureMap::iterator it =
-      mailbox_to_textures_.find(TargetName(target, name));
+      mailbox_to_textures_.find(TargetName(target, mailbox));
   if (it == mailbox_to_textures_.end())
     return NULL;
 
-  DCHECK(IsMailboxNameValid(name));
   return it->second->first;
 }
 
-bool MailboxManager::ProduceTexture(unsigned target,
-                                    const MailboxName& name,
+void MailboxManager::ProduceTexture(unsigned target,
+                                    const Mailbox& mailbox,
                                     Texture* texture) {
-  if (!IsMailboxNameValid(name))
-    return false;
-
   texture->SetMailboxManager(this);
-  TargetName target_name(target, name);
+  TargetName target_name(target, mailbox);
   MailboxToTextureMap::iterator it = mailbox_to_textures_.find(target_name);
   if (it != mailbox_to_textures_.end()) {
     TextureToMailboxMap::iterator texture_it = it->second;
@@ -67,8 +50,6 @@ bool MailboxManager::ProduceTexture(unsigned target,
       textures_to_mailboxes_.insert(std::make_pair(texture, target_name));
   mailbox_to_textures_.insert(std::make_pair(target_name, texture_it));
   DCHECK_EQ(mailbox_to_textures_.size(), textures_to_mailboxes_.size());
-
-  return true;
 }
 
 void MailboxManager::TextureDeleted(Texture* texture) {
@@ -84,25 +65,9 @@ void MailboxManager::TextureDeleted(Texture* texture) {
   DCHECK_EQ(mailbox_to_textures_.size(), textures_to_mailboxes_.size());
 }
 
-void MailboxManager::SignMailboxName(MailboxName* name) {
-  bool success = hmac_.Sign(
-      base::StringPiece(reinterpret_cast<char*>(name->key), sizeof(name->key)),
-      reinterpret_cast<unsigned char*>(name->signature),
-      sizeof(name->signature));
-  DCHECK(success);
-}
-
-bool MailboxManager::IsMailboxNameValid(const MailboxName& name) {
-  return hmac_.Verify(
-      base::StringPiece(reinterpret_cast<const char*>(name.key),
-          sizeof(name.key)),
-      base::StringPiece(reinterpret_cast<const char*>(name.signature),
-          sizeof(name.signature)));
-}
-
-MailboxManager::TargetName::TargetName(unsigned target, const MailboxName& name)
+MailboxManager::TargetName::TargetName(unsigned target, const Mailbox& mailbox)
     : target(target),
-      name(name) {
+      mailbox(mailbox) {
 }
 
 bool MailboxManager::TargetNameLess(const MailboxManager::TargetName& lhs,
diff --git a/gpu/command_buffer/service/mailbox_manager.h b/gpu/command_buffer/service/mailbox_manager.h
index c973028..e06ef2d 100644
--- a/gpu/command_buffer/service/mailbox_manager.h
+++ b/gpu/command_buffer/service/mailbox_manager.h
@@ -10,8 +10,8 @@
 
 #include "base/memory/linked_ptr.h"
 #include "base/memory/ref_counted.h"
-#include "crypto/hmac.h"
 #include "gpu/command_buffer/common/constants.h"
+#include "gpu/command_buffer/common/mailbox.h"
 #include "gpu/gpu_export.h"
 
 // From gl2/gl2ext.h.
@@ -27,50 +27,34 @@ namespace gles2 {
 class Texture;
 class TextureManager;
 
-// Identifies a mailbox where a texture definition can be stored for
-// transferring textures between contexts that are not in the same context
-// group. It is a random key signed with a hash of a private key.
-struct GPU_EXPORT MailboxName {
-  MailboxName();
-  GLbyte key[GL_MAILBOX_SIZE_CHROMIUM / 2];
-  GLbyte signature[GL_MAILBOX_SIZE_CHROMIUM / 2];
-};
-
 // Manages resources scoped beyond the context or context group level.
 class GPU_EXPORT MailboxManager : public base::RefCounted<MailboxManager> {
  public:
   MailboxManager();
 
-  // Generate a unique mailbox name signed with the manager's private key.
-  void GenerateMailboxName(MailboxName* name);
+  // Generate a unique unguessable mailbox name.
+  void GenerateMailbox(Mailbox* mailbox);
 
   // Look up the texture definition from the named mailbox.
-  Texture* ConsumeTexture(unsigned target, const MailboxName& name);
+  Texture* ConsumeTexture(unsigned target, const Mailbox& mailbox);
 
   // Put the texture into the named mailbox.
-  bool ProduceTexture(unsigned target,
-                      const MailboxName& name,
+  void ProduceTexture(unsigned target,
+                      const Mailbox& mailbox,
                       Texture* texture);
 
   // Destroy any mailbox that reference the given texture.
   void TextureDeleted(Texture* texture);
 
-  std::string private_key() {
-    return std::string(private_key_, sizeof(private_key_));
-  }
-
  private:
   friend class base::RefCounted<MailboxManager>;
 
   ~MailboxManager();
 
-  void SignMailboxName(MailboxName* name);
-  bool IsMailboxNameValid(const MailboxName& name);
-
   struct TargetName {
-    TargetName(unsigned target, const MailboxName& name);
+    TargetName(unsigned target, const Mailbox& mailbox);
     unsigned target;
-    MailboxName name;
+    Mailbox mailbox;
   };
 
   static bool TargetNameLess(const TargetName& lhs, const TargetName& rhs);
@@ -86,8 +70,6 @@ class GPU_EXPORT MailboxManager : public base::RefCounted<MailboxManager> {
       std::pointer_to_binary_function<
           const TargetName&, const TargetName&, bool> > MailboxToTextureMap;
 
-  char private_key_[GL_MAILBOX_SIZE_CHROMIUM / 2];
-  crypto::HMAC hmac_;
   MailboxToTextureMap mailbox_to_textures_;
   TextureToMailboxMap textures_to_mailboxes_;
 
diff --git a/gpu/command_buffer/service/mailbox_manager_unittest.cc b/gpu/command_buffer/service/mailbox_manager_unittest.cc
index 8864843..9e1ff6b 100644
--- a/gpu/command_buffer/service/mailbox_manager_unittest.cc
+++ b/gpu/command_buffer/service/mailbox_manager_unittest.cc
@@ -34,9 +34,9 @@ class MailboxManagerTest : public testing::Test {
 TEST_F(MailboxManagerTest, Basic) {
   Texture* texture = CreateTexture();
 
-  MailboxName name;
-  manager_->GenerateMailboxName(&name);
-  EXPECT_TRUE(manager_->ProduceTexture(0, name, texture));
+  Mailbox name;
+  manager_->GenerateMailbox(&name);
+  manager_->ProduceTexture(0, name, texture);
   EXPECT_EQ(texture, manager_->ConsumeTexture(0, name));
 
   // We can consume multiple times.
@@ -50,34 +50,24 @@ TEST_F(MailboxManagerTest, Basic) {
   EXPECT_EQ(NULL, manager_->ConsumeTexture(0, name));
 }
 
-// Should fail to produce or consume with an invalid mailbox.
-TEST_F(MailboxManagerTest, InvalidName) {
-  Texture* texture = CreateTexture();
-  MailboxName name;
-  memset(&name, 0, sizeof(name));
-  EXPECT_FALSE(manager_->ProduceTexture(0, name, texture));
-  EXPECT_EQ(NULL, manager_->ConsumeTexture(0, name));
-  DestroyTexture(texture);
-}
-
 // Tests behavior with multiple produce on the same texture.
 TEST_F(MailboxManagerTest, ProduceMultipleMailbox) {
   Texture* texture = CreateTexture();
 
-  MailboxName name1;
-  manager_->GenerateMailboxName(&name1);
+  Mailbox name1;
+  manager_->GenerateMailbox(&name1);
 
-  EXPECT_TRUE(manager_->ProduceTexture(0, name1, texture));
+  manager_->ProduceTexture(0, name1, texture);
   EXPECT_EQ(texture, manager_->ConsumeTexture(0, name1));
 
   // Can produce a second time with the same mailbox.
-  EXPECT_TRUE(manager_->ProduceTexture(0, name1, texture));
+  manager_->ProduceTexture(0, name1, texture);
   EXPECT_EQ(texture, manager_->ConsumeTexture(0, name1));
 
   // Can produce again, with a different mailbox.
-  MailboxName name2;
-  manager_->GenerateMailboxName(&name2);
-  EXPECT_TRUE(manager_->ProduceTexture(0, name2, texture));
+  Mailbox name2;
+  manager_->GenerateMailbox(&name2);
+  manager_->ProduceTexture(0, name2, texture);
 
   // Still available under all mailboxes.
   EXPECT_EQ(texture, manager_->ConsumeTexture(0, name1));
@@ -95,14 +85,14 @@ TEST_F(MailboxManagerTest, ProduceMultipleTexture) {
   Texture* texture1 = CreateTexture();
   Texture* texture2 = CreateTexture();
 
-  MailboxName name;
-  manager_->GenerateMailboxName(&name);
+  Mailbox name;
+  manager_->GenerateMailbox(&name);
 
-  EXPECT_TRUE(manager_->ProduceTexture(0, name, texture1));
+  manager_->ProduceTexture(0, name, texture1);
   EXPECT_EQ(texture1, manager_->ConsumeTexture(0, name));
 
   // Can produce a second time with the same mailbox, but different texture.
-  EXPECT_TRUE(manager_->ProduceTexture(0, name, texture2));
+  manager_->ProduceTexture(0, name, texture2);
   EXPECT_EQ(texture2, manager_->ConsumeTexture(0, name));
 
   // Destroying the texture that's under no mailbox shouldn't have an effect.
@@ -117,19 +107,19 @@ TEST_F(MailboxManagerTest, ProduceMultipleTexture) {
 TEST_F(MailboxManagerTest, ProduceMultipleTextureMailbox) {
   Texture* texture1 = CreateTexture();
   Texture* texture2 = CreateTexture();
-  MailboxName name1;
-  manager_->GenerateMailboxName(&name1);
-  MailboxName name2;
-  manager_->GenerateMailboxName(&name2);
+  Mailbox name1;
+  manager_->GenerateMailbox(&name1);
+  Mailbox name2;
+  manager_->GenerateMailbox(&name2);
 
   // Put texture1 on name1 and name2.
-  EXPECT_TRUE(manager_->ProduceTexture(0, name1, texture1));
-  EXPECT_TRUE(manager_->ProduceTexture(0, name2, texture1));
+  manager_->ProduceTexture(0, name1, texture1);
+  manager_->ProduceTexture(0, name2, texture1);
   EXPECT_EQ(texture1, manager_->ConsumeTexture(0, name1));
   EXPECT_EQ(texture1, manager_->ConsumeTexture(0, name2));
 
   // Put texture2 on name2.
-  EXPECT_TRUE(manager_->ProduceTexture(0, name2, texture2));
+  manager_->ProduceTexture(0, name2, texture2);
   EXPECT_EQ(texture1, manager_->ConsumeTexture(0, name1));
   EXPECT_EQ(texture2, manager_->ConsumeTexture(0, name2));
 
diff --git a/gpu/command_buffer/tests/gl_texture_mailbox_unittest.cc b/gpu/command_buffer/tests/gl_texture_mailbox_unittest.cc
index 561387d..50a3bbc 100644
--- a/gpu/command_buffer/tests/gl_texture_mailbox_unittest.cc
+++ b/gpu/command_buffer/tests/gl_texture_mailbox_unittest.cc
@@ -113,35 +113,6 @@ TEST_F(GLTextureMailboxTest, ProduceAndConsumeTexture) {
   EXPECT_EQ(source_pixel, ReadTexel(tex1, 0, 0));
 }
 
-TEST_F(GLTextureMailboxTest, ProduceTextureValidatesKey) {
-  GLuint tex;
-  glGenTextures(1, &tex);
-
-  glBindTexture(GL_TEXTURE_2D, tex);
-  uint32 source_pixel = 0xFF0000FF;
-  glTexImage2D(GL_TEXTURE_2D,
-               0,
-               GL_RGBA,
-               1, 1,
-               0,
-               GL_RGBA,
-               GL_UNSIGNED_BYTE,
-               &source_pixel);
-
-  GLbyte invalid_mailbox[GL_MAILBOX_SIZE_CHROMIUM];
-  glGenMailboxCHROMIUM(invalid_mailbox);
-  ++invalid_mailbox[GL_MAILBOX_SIZE_CHROMIUM - 1];
-
-  EXPECT_EQ(static_cast<GLenum>(GL_NO_ERROR), glGetError());
-  glProduceTextureCHROMIUM(GL_TEXTURE_2D, invalid_mailbox);
-  EXPECT_EQ(static_cast<GLenum>(GL_INVALID_OPERATION), glGetError());
-
-  // Ensure level 0 is still intact after glProduceTextureCHROMIUM fails.
-  EXPECT_EQ(static_cast<GLenum>(GL_NO_ERROR), glGetError());
-  EXPECT_EQ(source_pixel, ReadTexel(tex, 0, 0));
-  EXPECT_EQ(static_cast<GLenum>(GL_NO_ERROR), glGetError());
-}
-
 TEST_F(GLTextureMailboxTest, ConsumeTextureValidatesKey) {
   GLuint tex;
   glGenTextures(1, &tex);