chromeos/dbus/easy_unlock_client.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROMEOS_DBUS_EASY_UNLOCK_CLIENT_H_
   6 #define CHROMEOS_DBUS_EASY_UNLOCK_CLIENT_H_
   7
   8 #include <string>
   9
  10 #include "base/basictypes.h"
  11 #include "base/callback.h"
  12 #include "chromeos/chromeos_export.h"
  13 #include "chromeos/dbus/dbus_client.h"
  14
  15 namespace chromeos {
  16
  17 // Client for calling EasyUnlock dbus service. The service provides
  18 // methods used by Easy Unlock for establishing secure communication channel
  19 // over (unsecure) bluetooth with devices registered to unlock ChromeOS.
  20 // Ideally, this would be done in Chrome, but unfortunatelly, the library used
  21 // for wrapping and unwrapping messages sent over the communication channel
  22 // depends on OpenSSL for encryption, which is not currently available in
  23 // Chrome. To work around this, the message processing will be done in ChromeOS,
  24 // where OpenSSL is already supported.
  25 // TODO(tbarzic): Get rid of this client when Chrome switches from NSS to
  26 // OpenSSL (http://crbug.com/338888).
  27 class CHROMEOS_EXPORT EasyUnlockClient : public DBusClient {
  28  public:
  29   virtual ~EasyUnlockClient();
  30
  31   typedef base::Callback<void(const std::string& data)> DataCallback;
  32
  33   // Callback for |GenerateEcP256KeyAgreement|. Carries the generated keys.
  34   typedef base::Callback<void(const std::string& public_key,
  35                               const std::string& private_key)>
  36       KeyPairCallback;
  37
  38   // Generates ECDSA key pair using P256 curve.
  39   // The created keys should only be used with this client.
  40   virtual void GenerateEcP256KeyPair(const KeyPairCallback& callback) = 0;
  41
  42   // Given a private and a public key, creates a symetric secret key using
  43   // EC Diffe-Hellman key exchange. The provided keys come from different
  44   // asymetric key pairs, and are expected to be in the same format as the ones
  45   // returned by |GenerateEcP256KeyAgreement|. Reversing key pairs from which
  46   // private and public key come generates the same secret key.
  47   virtual void PerformECDHKeyAgreement(const std::string& private_key,
  48                                        const std::string& public_key,
  49                                        const DataCallback& callback) = 0;
  50
  51   // Creates signed and, if specified, encrypted message in format used by Easy
  52   // Unlock.
  53   // |payload|: The cleartext message body.
  54   // |key|: The key used to sign, and if needed, encrypt the message. If
  55   //     encryption is required, the key must be symetric.
  56   // |associated_data|: Data associated with the message. The data will not
  57   //     actually be added to the message, but it will be used while
  58   //     signing the message (the receiver will use the same data to
  59   //     authenticate the signature).
  60   // |public_metadata|: Metadata added to the message header.
  61   // |verification_key_id|: The key id added to the message header. Has to be
  62   //     set if the message is signed with private asymetric key. This value
  63   //     is used by the receiver to identify the public key that should be used
  64   //     to verify the signature.
  65   // |encryption_type|: The encryption algorithm to use for encrypting the
  66   //     message. (May be set to none).
  67   // |signature_type|: The algorithm to use to sign the message.
  68   // |callback|: Called with the created message. On failure, the message will
  69   //     be empty.
  70   virtual void CreateSecureMessage(const std::string& payload,
  71                                    const std::string& secret_key,
  72                                    const std::string& associated_data,
  73                                    const std::string& public_metadata,
  74                                    const std::string& verification_key_id,
  75                                    const std::string& encryption_type,
  76                                    const std::string& signature_type,
  77                                    const DataCallback& callback) = 0;
  78
  79   // Authenticates and, if specified, decrypts a secure message.
  80   // |message|: The message to unwrap. It is in the same format as the message
  81   //     returned by |CreateSecureMessage|.
  82   // |key|: The key used to authenticate message signature and, if needed,
  83   //     decrypt the message. If the message is encrypted, only symetric key
  84   //     can be used.
  85   // |associated_data|: Data associated with the message. Message
  86   //     authentication will succeed only if the message was created with the
  87   //     associated data.
  88   // |encryption_type|: The encryption algorithm to use for decrypting the
  89   //     message. (May be set to none).
  90   // |signature_type|: The algorithm to use to verify the message signature.
  91   // |callback|: Called with the cleartext message header and body in a signle
  92   //     protobuf. If the message could not be authenticated or decrypted, it
  93   //     will be called with an empty string.
  94   virtual void UnwrapSecureMessage(const std::string& message,
  95                                    const std::string& secret_key,
  96                                    const std::string& associated_data,
  97                                    const std::string& encryption_type,
  98                                    const std::string& signature_type,
  99                                    const DataCallback& callback) = 0;
 100
 101   // Factory function, creates a new instance and returns ownership.
 102   // For normal usage, access the singleton via DBusThreadManager::Get().
 103   static EasyUnlockClient* Create();
 104
 105  protected:
 106   // Create() should be used instead.
 107   EasyUnlockClient();
 108
 109  private:
 110   DISALLOW_COPY_AND_ASSIGN(EasyUnlockClient);
 111 };
 112
 113 }  // namespace chromeos
 114
 115 #endif  // CHROMEOS_DBUS_EASY_UNLOCK_CLIENT_H_