net/quic/crypto/p256_key_exchange_nss.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/quic/crypto/p256_key_exchange.h"
   6
   7 #include "base/logging.h"
   8 #include "base/sys_byteorder.h"
   9
  10 using base::StringPiece;
  11 using std::string;
  12 using std::vector;
  13
  14 namespace net {
  15
  16 namespace {
  17
  18 // Password used by |NewPrivateKey| to encrypt exported EC private keys.
  19 // This is not used to provide any security, but to workaround NSS being
  20 // unwilling to export unencrypted EC keys. Note that SPDY and ChannelID
  21 // use the same approach.
  22 const char kExportPassword[] = "";
  23
  24 // Convert StringPiece to vector of uint8.
  25 static vector<uint8> StringPieceToVector(StringPiece piece) {
  26   return vector<uint8>(piece.data(), piece.data() + piece.length());
  27 }
  28
  29 }  // namespace
  30
  31 P256KeyExchange::P256KeyExchange(crypto::ECPrivateKey* key_pair,
  32                                  const uint8* public_key)
  33     : key_pair_(key_pair) {
  34   memcpy(public_key_, public_key, sizeof(public_key_));
  35 }
  36
  37 P256KeyExchange::~P256KeyExchange() {
  38 }
  39
  40 // static
  41 P256KeyExchange* P256KeyExchange::New(StringPiece key) {
  42   if (key.size() < 2) {
  43     DVLOG(1) << "Key pair is too small.";
  44     return NULL;
  45   }
  46
  47   const uint8* data = reinterpret_cast<const uint8*>(key.data());
  48   size_t size = static_cast<size_t>(data[0]) |
  49                 (static_cast<size_t>(data[1]) << 8);
  50   key.remove_prefix(2);
  51   if (key.size() < size) {
  52     DVLOG(1) << "Key pair does not contain key material.";
  53     return NULL;
  54   }
  55
  56   StringPiece private_piece(key.data(), size);
  57   key.remove_prefix(size);
  58   if (key.empty()) {
  59     DVLOG(1) << "Key pair does not contain public key.";
  60     return NULL;
  61   }
  62
  63   StringPiece public_piece(key);
  64
  65   scoped_ptr<crypto::ECPrivateKey> key_pair(
  66       crypto::ECPrivateKey::CreateFromEncryptedPrivateKeyInfo(
  67           kExportPassword,
  68           // TODO(thaidn): fix this interface to avoid copying secrets.
  69           StringPieceToVector(private_piece),
  70           StringPieceToVector(public_piece)));
  71
  72   if (!key_pair.get()) {
  73     DVLOG(1) << "Can't decrypt private key.";
  74     return NULL;
  75   }
  76
  77   // Perform some sanity checks on the public key.
  78   SECKEYPublicKey* public_key = key_pair->public_key();
  79   if (public_key->keyType != ecKey ||
  80       public_key->u.ec.publicValue.len != kUncompressedP256PointBytes ||
  81       !public_key->u.ec.publicValue.data ||
  82       public_key->u.ec.publicValue.data[0] != kUncompressedECPointForm) {
  83     DVLOG(1) << "Key is invalid.";
  84     return NULL;
  85   }
  86
  87   // Ensure that the key is using the correct curve, i.e., NIST P-256.
  88   const SECOidData* oid_data = SECOID_FindOIDByTag(SEC_OID_SECG_EC_SECP256R1);
  89   if (!oid_data) {
  90     DVLOG(1) << "Can't get P-256's OID.";
  91     return NULL;
  92   }
  93
  94   if (public_key->u.ec.DEREncodedParams.len != oid_data->oid.len + 2 ||
  95       !public_key->u.ec.DEREncodedParams.data ||
  96       public_key->u.ec.DEREncodedParams.data[0] != SEC_ASN1_OBJECT_ID ||
  97       public_key->u.ec.DEREncodedParams.data[1] != oid_data->oid.len ||
  98       memcmp(public_key->u.ec.DEREncodedParams.data + 2,
  99              oid_data->oid.data, oid_data->oid.len) != 0) {
 100     DVLOG(1) << "Key is invalid.";
 101   }
 102
 103   return new P256KeyExchange(key_pair.release(),
 104                              public_key->u.ec.publicValue.data);
 105 }
 106
 107 // static
 108 string P256KeyExchange::NewPrivateKey() {
 109   scoped_ptr<crypto::ECPrivateKey> key_pair(crypto::ECPrivateKey::Create());
 110
 111   if (!key_pair.get()) {
 112     DVLOG(1) << "Can't generate new key pair.";
 113     return string();
 114   }
 115
 116   vector<uint8> private_key;
 117   if (!key_pair->ExportEncryptedPrivateKey(kExportPassword,
 118                                            1 /* iteration */,
 119                                            &private_key)) {
 120     DVLOG(1) << "Can't export private key.";
 121     return string();
 122   }
 123
 124   // NSS lacks the ability to import an ECC private key without
 125   // also importing the public key, so it is necessary to also
 126   // store the public key.
 127   vector<uint8> public_key;
 128   if (!key_pair->ExportPublicKey(&public_key)) {
 129     DVLOG(1) << "Can't export public key.";
 130     return string();
 131   }
 132
 133   // TODO(thaidn): determine how large encrypted private key can be
 134   uint16 private_key_size = private_key.size();
 135   const size_t result_size = sizeof(private_key_size) +
 136                              private_key_size +
 137                              public_key.size();
 138   vector<char> result(result_size);
 139   char* resultp = &result[0];
 140   // Export the key string.
 141   // The first two bytes are the private key's size in little endian.
 142   private_key_size = base::ByteSwapToLE16(private_key_size);
 143   memcpy(resultp, &private_key_size, sizeof(private_key_size));
 144   resultp += sizeof(private_key_size);
 145   memcpy(resultp, &private_key[0], private_key.size());
 146   resultp += private_key.size();
 147   memcpy(resultp, &public_key[0], public_key.size());
 148
 149   return string(&result[0], result_size);
 150 }
 151
 152 KeyExchange* P256KeyExchange::NewKeyPair(QuicRandom* /*rand*/) const {
 153   // TODO(agl): avoid the serialisation/deserialisation in this function.
 154   const string private_value = NewPrivateKey();
 155   return P256KeyExchange::New(private_value);
 156 }
 157
 158 bool P256KeyExchange::CalculateSharedKey(const StringPiece& peer_public_value,
 159                                          string* out_result) const {
 160   if (peer_public_value.size() != kUncompressedP256PointBytes ||
 161       peer_public_value[0] != kUncompressedECPointForm) {
 162     DVLOG(1) << "Peer public value is invalid.";
 163     return false;
 164   }
 165
 166   DCHECK(key_pair_.get());
 167   DCHECK(key_pair_->public_key());
 168
 169   SECKEYPublicKey peer_public_key;
 170   memset(&peer_public_key, 0, sizeof(peer_public_key));
 171
 172   peer_public_key.keyType = ecKey;
 173   // Both sides of a ECDH key exchange need to use the same EC params.
 174   peer_public_key.u.ec.DEREncodedParams.len =
 175       key_pair_->public_key()->u.ec.DEREncodedParams.len;
 176   peer_public_key.u.ec.DEREncodedParams.data =
 177       key_pair_->public_key()->u.ec.DEREncodedParams.data;
 178
 179   peer_public_key.u.ec.publicValue.type = siBuffer;
 180   peer_public_key.u.ec.publicValue.data =
 181       reinterpret_cast<uint8*>(const_cast<char*>(peer_public_value.data()));
 182   peer_public_key.u.ec.publicValue.len = peer_public_value.size();
 183
 184   // The NSS function performing ECDH key exchange is PK11_PubDeriveWithKDF.
 185   // As this function is used for SSL/TLS's ECDH key exchanges it has many
 186   // arguments, most of which are not required in QUIC.
 187   // Key derivation function CKD_NULL is used because the return value of
 188   // |CalculateSharedKey| is the actual ECDH shared key, not any derived keys
 189   // from it.
 190   crypto::ScopedPK11SymKey premaster_secret(
 191       PK11_PubDeriveWithKDF(
 192           key_pair_->key(),
 193           &peer_public_key,
 194           PR_FALSE,
 195           NULL,
 196           NULL,
 197           CKM_ECDH1_DERIVE, /* mechanism */
 198           CKM_GENERIC_SECRET_KEY_GEN, /* target */
 199           CKA_DERIVE,
 200           0,
 201           CKD_NULL, /* kdf */
 202           NULL,
 203           NULL));
 204
 205   if (!premaster_secret.get()) {
 206     DVLOG(1) << "Can't derive ECDH shared key.";
 207     return false;
 208   }
 209
 210   if (PK11_ExtractKeyValue(premaster_secret.get()) != SECSuccess) {
 211     DVLOG(1) << "Can't extract raw ECDH shared key.";
 212     return false;
 213   }
 214
 215   SECItem* key_data = PK11_GetKeyData(premaster_secret.get());
 216   if (!key_data || !key_data->data || key_data->len != kP256FieldBytes) {
 217     DVLOG(1) << "ECDH shared key is invalid.";
 218     return false;
 219   }
 220
 221   out_result->assign(reinterpret_cast<char*>(key_data->data), key_data->len);
 222   return true;
 223 }
 224
 225 StringPiece P256KeyExchange::public_value() const {
 226   return StringPiece(reinterpret_cast<const char*>(public_key_),
 227                      sizeof(public_key_));
 228 }
 229
 230 QuicTag P256KeyExchange::tag() const { return kP256; }
 231
 232 }  // namespace net
 233