1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
|
// Copyright 2014 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "content/child/webcrypto/webcrypto_util.h"
#include "base/base64.h"
#include "base/logging.h"
#include "base/strings/stringprintf.h"
#include "content/child/webcrypto/status.h"
#include "third_party/WebKit/public/platform/WebCryptoAlgorithm.h"
#include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
#include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
namespace content {
namespace webcrypto {
const uint8* Uint8VectorStart(const std::vector<uint8>& data) {
if (data.empty())
return NULL;
return &data[0];
}
uint8* Uint8VectorStart(std::vector<uint8>* data) {
if (data->empty())
return NULL;
return &(*data)[0];
}
// This function decodes unpadded 'base64url' encoded data, as described in
// RFC4648 (http://www.ietf.org/rfc/rfc4648.txt) Section 5. To do this, first
// change the incoming data to 'base64' encoding by applying the appropriate
// transformation including adding padding if required, and then call a base64
// decoder.
bool Base64DecodeUrlSafe(const std::string& input, std::string* output) {
std::string base64EncodedText(input);
std::replace(base64EncodedText.begin(), base64EncodedText.end(), '-', '+');
std::replace(base64EncodedText.begin(), base64EncodedText.end(), '_', '/');
base64EncodedText.append((4 - base64EncodedText.size() % 4) % 4, '=');
return base::Base64Decode(base64EncodedText, output);
}
// Returns an unpadded 'base64url' encoding of the input data, using the
// inverse of the process above.
std::string Base64EncodeUrlSafe(const base::StringPiece& input) {
std::string output;
base::Base64Encode(input, &output);
std::replace(output.begin(), output.end(), '+', '-');
std::replace(output.begin(), output.end(), '/', '_');
output.erase(std::remove(output.begin(), output.end(), '='), output.end());
return output;
}
std::string Base64EncodeUrlSafe(const std::vector<uint8>& input) {
const base::StringPiece string_piece(
reinterpret_cast<const char*>(Uint8VectorStart(input)), input.size());
return Base64EncodeUrlSafe(string_piece);
}
struct JwkToWebCryptoUsage {
const char* const jwk_key_op;
const blink::WebCryptoKeyUsage webcrypto_usage;
};
const JwkToWebCryptoUsage kJwkWebCryptoUsageMap[] = {
{"encrypt", blink::WebCryptoKeyUsageEncrypt},
{"decrypt", blink::WebCryptoKeyUsageDecrypt},
{"deriveKey", blink::WebCryptoKeyUsageDeriveKey},
// TODO(padolph): Add 'deriveBits' once supported by Blink.
{"sign", blink::WebCryptoKeyUsageSign},
{"unwrapKey", blink::WebCryptoKeyUsageUnwrapKey},
{"verify", blink::WebCryptoKeyUsageVerify},
{"wrapKey", blink::WebCryptoKeyUsageWrapKey}};
// Modifies the input usage_mask by according to the key_op value.
bool JwkKeyOpToWebCryptoUsage(const std::string& key_op,
blink::WebCryptoKeyUsageMask* usage_mask) {
for (size_t i = 0; i < arraysize(kJwkWebCryptoUsageMap); ++i) {
if (kJwkWebCryptoUsageMap[i].jwk_key_op == key_op) {
*usage_mask |= kJwkWebCryptoUsageMap[i].webcrypto_usage;
return true;
}
}
return false;
}
// Composes a Web Crypto usage mask from an array of JWK key_ops values.
Status GetWebCryptoUsagesFromJwkKeyOps(
const base::ListValue* jwk_key_ops_value,
blink::WebCryptoKeyUsageMask* usage_mask) {
*usage_mask = 0;
for (size_t i = 0; i < jwk_key_ops_value->GetSize(); ++i) {
std::string key_op;
if (!jwk_key_ops_value->GetString(i, &key_op)) {
return Status::ErrorJwkPropertyWrongType(
base::StringPrintf("key_ops[%d]", static_cast<int>(i)), "string");
}
if (!JwkKeyOpToWebCryptoUsage(key_op, usage_mask))
return Status::ErrorJwkUnrecognizedKeyop();
}
return Status::Success();
}
// Composes a JWK key_ops List from a Web Crypto usage mask.
// Note: Caller must assume ownership of returned instance.
base::ListValue* CreateJwkKeyOpsFromWebCryptoUsages(
blink::WebCryptoKeyUsageMask usage_mask) {
base::ListValue* jwk_key_ops = new base::ListValue();
for (size_t i = 0; i < arraysize(kJwkWebCryptoUsageMap); ++i) {
if (usage_mask & kJwkWebCryptoUsageMap[i].webcrypto_usage)
jwk_key_ops->AppendString(kJwkWebCryptoUsageMap[i].jwk_key_op);
}
return jwk_key_ops;
}
bool IsHashAlgorithm(blink::WebCryptoAlgorithmId alg_id) {
return alg_id == blink::WebCryptoAlgorithmIdSha1 ||
alg_id == blink::WebCryptoAlgorithmIdSha256 ||
alg_id == blink::WebCryptoAlgorithmIdSha384 ||
alg_id == blink::WebCryptoAlgorithmIdSha512;
}
blink::WebCryptoAlgorithm GetInnerHashAlgorithm(
const blink::WebCryptoAlgorithm& algorithm) {
DCHECK(!algorithm.isNull());
switch (algorithm.paramsType()) {
case blink::WebCryptoAlgorithmParamsTypeHmacImportParams:
return algorithm.hmacImportParams()->hash();
case blink::WebCryptoAlgorithmParamsTypeHmacKeyGenParams:
return algorithm.hmacKeyGenParams()->hash();
case blink::WebCryptoAlgorithmParamsTypeRsaHashedImportParams:
return algorithm.rsaHashedImportParams()->hash();
case blink::WebCryptoAlgorithmParamsTypeRsaHashedKeyGenParams:
return algorithm.rsaHashedKeyGenParams()->hash();
default:
return blink::WebCryptoAlgorithm::createNull();
}
}
blink::WebCryptoAlgorithm CreateAlgorithm(blink::WebCryptoAlgorithmId id) {
return blink::WebCryptoAlgorithm::adoptParamsAndCreate(id, NULL);
}
blink::WebCryptoAlgorithm CreateHmacImportAlgorithm(
blink::WebCryptoAlgorithmId hash_id) {
DCHECK(IsHashAlgorithm(hash_id));
return blink::WebCryptoAlgorithm::adoptParamsAndCreate(
blink::WebCryptoAlgorithmIdHmac,
new blink::WebCryptoHmacImportParams(CreateAlgorithm(hash_id)));
}
blink::WebCryptoAlgorithm CreateRsaHashedImportAlgorithm(
blink::WebCryptoAlgorithmId id,
blink::WebCryptoAlgorithmId hash_id) {
DCHECK(IsHashAlgorithm(hash_id));
DCHECK(id == blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 ||
id == blink::WebCryptoAlgorithmIdRsaOaep);
return blink::WebCryptoAlgorithm::adoptParamsAndCreate(
id, new blink::WebCryptoRsaHashedImportParams(CreateAlgorithm(hash_id)));
}
bool CreateSecretKeyAlgorithm(const blink::WebCryptoAlgorithm& algorithm,
unsigned int keylen_bytes,
blink::WebCryptoKeyAlgorithm* key_algorithm) {
switch (algorithm.id()) {
case blink::WebCryptoAlgorithmIdHmac: {
blink::WebCryptoAlgorithm hash = GetInnerHashAlgorithm(algorithm);
if (hash.isNull())
return false;
if (keylen_bytes > UINT_MAX / 8)
return false;
*key_algorithm =
blink::WebCryptoKeyAlgorithm::createHmac(hash.id(), keylen_bytes * 8);
return true;
}
case blink::WebCryptoAlgorithmIdAesKw:
case blink::WebCryptoAlgorithmIdAesCbc:
case blink::WebCryptoAlgorithmIdAesCtr:
case blink::WebCryptoAlgorithmIdAesGcm:
*key_algorithm = blink::WebCryptoKeyAlgorithm::createAes(
algorithm.id(), keylen_bytes * 8);
return true;
default:
return false;
}
}
} // namespace webcrypto
} // namespace content
|
