Don't preload rarely seen large images
[chromium-blink-merge.git] / components / webcrypto / nss / aes_kw_nss.cc
blob77afb1fc53b92f242e95deda880d0bef8ac4c04e
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include <secerr.h>
7 #include "base/numerics/safe_math.h"
8 #include "components/webcrypto/crypto_data.h"
9 #include "components/webcrypto/nss/aes_algorithm_nss.h"
10 #include "components/webcrypto/nss/key_nss.h"
11 #include "components/webcrypto/nss/sym_key_nss.h"
12 #include "components/webcrypto/nss/util_nss.h"
13 #include "components/webcrypto/status.h"
14 #include "components/webcrypto/webcrypto_util.h"
15 #include "crypto/scoped_nss_types.h"
16 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
17 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
19 namespace webcrypto {
21 namespace {
23 // The Default IV for AES-KW. See http://www.ietf.org/rfc/rfc3394.txt
24 // Section 2.2.3.1.
25 const unsigned char kAesIv[] = {0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6};
27 // The result of unwrapping is a SymKey rather than a buffer. This is a
28 // consequence of how NSS exposes AES-KW. Subsequent code can extract the value
29 // of the sym key to interpret it as key bytes in another format.
30 Status DoUnwrapSymKeyAesKw(const CryptoData& wrapped_key_data,
31 PK11SymKey* wrapping_key,
32 CK_MECHANISM_TYPE mechanism,
33 CK_FLAGS flags,
34 crypto::ScopedPK11SymKey* unwrapped_key) {
35 DCHECK_GE(wrapped_key_data.byte_length(), 24u);
36 DCHECK_EQ(wrapped_key_data.byte_length() % 8, 0u);
38 SECItem iv_item = MakeSECItemForBuffer(CryptoData(kAesIv, sizeof(kAesIv)));
39 crypto::ScopedSECItem param_item(
40 PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item));
41 if (!param_item)
42 return Status::ErrorUnexpected();
44 SECItem cipher_text = MakeSECItemForBuffer(wrapped_key_data);
46 // The plaintext length is always 64 bits less than the data size.
47 const unsigned int plaintext_length = wrapped_key_data.byte_length() - 8;
49 #if defined(USE_NSS_CERTS)
50 // Part of workaround for
51 // https://bugzilla.mozilla.org/show_bug.cgi?id=981170. See the explanation
52 // later in this function.
53 PORT_SetError(0);
54 #endif
56 crypto::ScopedPK11SymKey new_key(PK11_UnwrapSymKeyWithFlags(
57 wrapping_key, CKM_NSS_AES_KEY_WRAP, param_item.get(), &cipher_text,
58 mechanism, CKA_FLAGS_ONLY, plaintext_length, flags));
60 // TODO(padolph): Use NSS PORT_GetError() and friends to report a more
61 // accurate error, providing if doesn't leak any information to web pages
62 // about other web crypto users, key details, etc.
63 if (!new_key)
64 return Status::OperationError();
66 #if defined(USE_NSS_CERTS)
67 // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=981170
68 // which was fixed in NSS 3.16.0.
69 // If unwrap fails, NSS nevertheless returns a valid-looking PK11SymKey,
70 // with a reasonable length but with key data pointing to uninitialized
71 // memory.
72 // To understand this workaround see the fix for 981170:
73 // https://hg.mozilla.org/projects/nss/rev/753bb69e543c
74 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA)
75 return Status::OperationError();
76 #endif
78 *unwrapped_key = new_key.Pass();
79 return Status::Success();
82 Status WrapSymKeyAesKw(PK11SymKey* key,
83 PK11SymKey* wrapping_key,
84 std::vector<uint8_t>* buffer) {
85 // The data size must be at least 16 bytes and a multiple of 8 bytes.
86 // RFC 3394 does not specify a maximum allowed data length, but since only
87 // keys are being wrapped in this application (which are small), a reasonable
88 // max limit is whatever will fit into an unsigned. For the max size test,
89 // note that AES Key Wrap always adds 8 bytes to the input data size.
90 const unsigned int input_length = PK11_GetKeyLength(key);
91 DCHECK_GE(input_length, 16u);
92 DCHECK((input_length % 8) == 0);
94 SECItem iv_item = MakeSECItemForBuffer(CryptoData(kAesIv, sizeof(kAesIv)));
95 crypto::ScopedSECItem param_item(
96 PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item));
97 if (!param_item)
98 return Status::ErrorUnexpected();
100 base::CheckedNumeric<unsigned int> output_length = input_length;
101 output_length += 8;
102 if (!output_length.IsValid())
103 return Status::ErrorDataTooLarge();
105 buffer->resize(output_length.ValueOrDie());
106 SECItem wrapped_key_item = MakeSECItemForBuffer(CryptoData(*buffer));
108 if (SECSuccess != PK11_WrapSymKey(CKM_NSS_AES_KEY_WRAP, param_item.get(),
109 wrapping_key, key, &wrapped_key_item)) {
110 return Status::OperationError();
112 if (output_length.ValueOrDie() != wrapped_key_item.len)
113 return Status::ErrorUnexpected();
115 return Status::Success();
118 class AesKwCryptoAlgorithmNss : public AesAlgorithm {
119 public:
120 AesKwCryptoAlgorithmNss()
121 : AesAlgorithm(
122 CKM_NSS_AES_KEY_WRAP,
123 blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey,
124 "KW") {}
126 Status Encrypt(const blink::WebCryptoAlgorithm& algorithm,
127 const blink::WebCryptoKey& wrapping_key,
128 const CryptoData& data,
129 std::vector<uint8_t>* buffer) const override {
130 if (data.byte_length() < 16)
131 return Status::ErrorDataTooSmall();
132 if (data.byte_length() % 8)
133 return Status::ErrorInvalidAesKwDataLength();
135 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must
136 // be temporarily viewed as a symmetric key to be wrapped (encrypted).
137 SECItem data_item = MakeSECItemForBuffer(data);
138 crypto::ScopedPK11Slot slot(PK11_GetInternalSlot());
139 crypto::ScopedPK11SymKey data_as_sym_key(
140 PK11_ImportSymKey(slot.get(), CKK_GENERIC_SECRET, PK11_OriginUnwrap,
141 CKA_SIGN, &data_item, NULL));
142 if (!data_as_sym_key)
143 return Status::OperationError();
145 return WrapSymKeyAesKw(data_as_sym_key.get(),
146 SymKeyNss::Cast(wrapping_key)->key(), buffer);
149 Status Decrypt(const blink::WebCryptoAlgorithm& algorithm,
150 const blink::WebCryptoKey& wrapping_key,
151 const CryptoData& data,
152 std::vector<uint8_t>* buffer) const override {
153 if (data.byte_length() < 24)
154 return Status::ErrorDataTooSmall();
155 if (data.byte_length() % 8)
156 return Status::ErrorInvalidAesKwDataLength();
158 // Due to limitations in the NSS API for the AES-KW algorithm, |data| must
159 // be temporarily viewed as a symmetric key to be unwrapped (decrypted).
160 crypto::ScopedPK11SymKey decrypted;
161 Status status =
162 DoUnwrapSymKeyAesKw(data, SymKeyNss::Cast(wrapping_key)->key(),
163 CKK_GENERIC_SECRET, 0, &decrypted);
164 if (status.IsError())
165 return status;
167 // Once the decrypt is complete, extract the resultant raw bytes from NSS
168 // and return them to the caller.
169 if (PK11_ExtractKeyValue(decrypted.get()) != SECSuccess)
170 return Status::OperationError();
171 const SECItem* const key_data = PK11_GetKeyData(decrypted.get());
172 if (!key_data)
173 return Status::OperationError();
174 buffer->assign(key_data->data, key_data->data + key_data->len);
176 return Status::Success();
180 } // namespace
182 AlgorithmImplementation* CreatePlatformAesKwImplementation() {
183 return new AesKwCryptoAlgorithmNss;
186 } // namespace webcrypto