components/webcrypto/nss/aes_kw_nss.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <secerr.h>
   6
   7 #include "base/numerics/safe_math.h"
   8 #include "components/webcrypto/crypto_data.h"
   9 #include "components/webcrypto/nss/aes_algorithm_nss.h"
  10 #include "components/webcrypto/nss/key_nss.h"
  11 #include "components/webcrypto/nss/sym_key_nss.h"
  12 #include "components/webcrypto/nss/util_nss.h"
  13 #include "components/webcrypto/status.h"
  14 #include "components/webcrypto/webcrypto_util.h"
  15 #include "crypto/scoped_nss_types.h"
  16 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
  17 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
  18
  19 namespace webcrypto {
  20
  21 namespace {
  22
  23 // The Default IV for AES-KW. See http://www.ietf.org/rfc/rfc3394.txt
  24 // Section 2.2.3.1.
  25 const unsigned char kAesIv[] = {0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6};
  26
  27 // The result of unwrapping is a SymKey rather than a buffer. This is a
  28 // consequence of how NSS exposes AES-KW. Subsequent code can extract the value
  29 // of the sym key to interpret it as key bytes in another format.
  30 Status DoUnwrapSymKeyAesKw(const CryptoData& wrapped_key_data,
  31                            PK11SymKey* wrapping_key,
  32                            CK_MECHANISM_TYPE mechanism,
  33                            CK_FLAGS flags,
  34                            crypto::ScopedPK11SymKey* unwrapped_key) {
  35   DCHECK_GE(wrapped_key_data.byte_length(), 24u);
  36   DCHECK_EQ(wrapped_key_data.byte_length() % 8, 0u);
  37
  38   SECItem iv_item = MakeSECItemForBuffer(CryptoData(kAesIv, sizeof(kAesIv)));
  39   crypto::ScopedSECItem param_item(
  40       PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item));
  41   if (!param_item)
  42     return Status::ErrorUnexpected();
  43
  44   SECItem cipher_text = MakeSECItemForBuffer(wrapped_key_data);
  45
  46   // The plaintext length is always 64 bits less than the data size.
  47   const unsigned int plaintext_length = wrapped_key_data.byte_length() - 8;
  48
  49 #if defined(USE_NSS_CERTS)
  50   // Part of workaround for
  51   // https://bugzilla.mozilla.org/show_bug.cgi?id=981170. See the explanation
  52   // later in this function.
  53   PORT_SetError(0);
  54 #endif
  55
  56   crypto::ScopedPK11SymKey new_key(PK11_UnwrapSymKeyWithFlags(
  57       wrapping_key, CKM_NSS_AES_KEY_WRAP, param_item.get(), &cipher_text,
  58       mechanism, CKA_FLAGS_ONLY, plaintext_length, flags));
  59
  60   // TODO(padolph): Use NSS PORT_GetError() and friends to report a more
  61   // accurate error, providing if doesn't leak any information to web pages
  62   // about other web crypto users, key details, etc.
  63   if (!new_key)
  64     return Status::OperationError();
  65
  66 #if defined(USE_NSS_CERTS)
  67   // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=981170
  68   // which was fixed in NSS 3.16.0.
  69   // If unwrap fails, NSS nevertheless returns a valid-looking PK11SymKey,
  70   // with a reasonable length but with key data pointing to uninitialized
  71   // memory.
  72   // To understand this workaround see the fix for 981170:
  73   // https://hg.mozilla.org/projects/nss/rev/753bb69e543c
  74   if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA)
  75     return Status::OperationError();
  76 #endif
  77
  78   *unwrapped_key = new_key.Pass();
  79   return Status::Success();
  80 }
  81
  82 Status WrapSymKeyAesKw(PK11SymKey* key,
  83                        PK11SymKey* wrapping_key,
  84                        std::vector<uint8_t>* buffer) {
  85   // The data size must be at least 16 bytes and a multiple of 8 bytes.
  86   // RFC 3394 does not specify a maximum allowed data length, but since only
  87   // keys are being wrapped in this application (which are small), a reasonable
  88   // max limit is whatever will fit into an unsigned. For the max size test,
  89   // note that AES Key Wrap always adds 8 bytes to the input data size.
  90   const unsigned int input_length = PK11_GetKeyLength(key);
  91   DCHECK_GE(input_length, 16u);
  92   DCHECK((input_length % 8) == 0);
  93
  94   SECItem iv_item = MakeSECItemForBuffer(CryptoData(kAesIv, sizeof(kAesIv)));
  95   crypto::ScopedSECItem param_item(
  96       PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item));
  97   if (!param_item)
  98     return Status::ErrorUnexpected();
  99
 100   base::CheckedNumeric<unsigned int> output_length = input_length;
 101   output_length += 8;
 102   if (!output_length.IsValid())
 103     return Status::ErrorDataTooLarge();
 104
 105   buffer->resize(output_length.ValueOrDie());
 106   SECItem wrapped_key_item = MakeSECItemForBuffer(CryptoData(*buffer));
 107
 108   if (SECSuccess != PK11_WrapSymKey(CKM_NSS_AES_KEY_WRAP, param_item.get(),
 109                                     wrapping_key, key, &wrapped_key_item)) {
 110     return Status::OperationError();
 111   }
 112   if (output_length.ValueOrDie() != wrapped_key_item.len)
 113     return Status::ErrorUnexpected();
 114
 115   return Status::Success();
 116 }
 117
 118 class AesKwCryptoAlgorithmNss : public AesAlgorithm {
 119  public:
 120   AesKwCryptoAlgorithmNss()
 121       : AesAlgorithm(
 122             CKM_NSS_AES_KEY_WRAP,
 123             blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey,
 124             "KW") {}
 125
 126   Status Encrypt(const blink::WebCryptoAlgorithm& algorithm,
 127                  const blink::WebCryptoKey& wrapping_key,
 128                  const CryptoData& data,
 129                  std::vector<uint8_t>* buffer) const override {
 130     if (data.byte_length() < 16)
 131       return Status::ErrorDataTooSmall();
 132     if (data.byte_length() % 8)
 133       return Status::ErrorInvalidAesKwDataLength();
 134
 135     // Due to limitations in the NSS API for the AES-KW algorithm, |data| must
 136     // be temporarily viewed as a symmetric key to be wrapped (encrypted).
 137     SECItem data_item = MakeSECItemForBuffer(data);
 138     crypto::ScopedPK11Slot slot(PK11_GetInternalSlot());
 139     crypto::ScopedPK11SymKey data_as_sym_key(
 140         PK11_ImportSymKey(slot.get(), CKK_GENERIC_SECRET, PK11_OriginUnwrap,
 141                           CKA_SIGN, &data_item, NULL));
 142     if (!data_as_sym_key)
 143       return Status::OperationError();
 144
 145     return WrapSymKeyAesKw(data_as_sym_key.get(),
 146                            SymKeyNss::Cast(wrapping_key)->key(), buffer);
 147   }
 148
 149   Status Decrypt(const blink::WebCryptoAlgorithm& algorithm,
 150                  const blink::WebCryptoKey& wrapping_key,
 151                  const CryptoData& data,
 152                  std::vector<uint8_t>* buffer) const override {
 153     if (data.byte_length() < 24)
 154       return Status::ErrorDataTooSmall();
 155     if (data.byte_length() % 8)
 156       return Status::ErrorInvalidAesKwDataLength();
 157
 158     // Due to limitations in the NSS API for the AES-KW algorithm, |data| must
 159     // be temporarily viewed as a symmetric key to be unwrapped (decrypted).
 160     crypto::ScopedPK11SymKey decrypted;
 161     Status status =
 162         DoUnwrapSymKeyAesKw(data, SymKeyNss::Cast(wrapping_key)->key(),
 163                             CKK_GENERIC_SECRET, 0, &decrypted);
 164     if (status.IsError())
 165       return status;
 166
 167     // Once the decrypt is complete, extract the resultant raw bytes from NSS
 168     // and return them to the caller.
 169     if (PK11_ExtractKeyValue(decrypted.get()) != SECSuccess)
 170       return Status::OperationError();
 171     const SECItem* const key_data = PK11_GetKeyData(decrypted.get());
 172     if (!key_data)
 173       return Status::OperationError();
 174     buffer->assign(key_data->data, key_data->data + key_data->len);
 175
 176     return Status::Success();
 177   }
 178 };
 179
 180 }  // namespace
 181
 182 AlgorithmImplementation* CreatePlatformAesKwImplementation() {
 183   return new AesKwCryptoAlgorithmNss;
 184 }
 185
 186 }  // namespace webcrypto