components/webcrypto/algorithms/hkdf.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <openssl/err.h>
   6 #include <openssl/hkdf.h>
   7
   8 #include "base/logging.h"
   9 #include "base/stl_util.h"
  10 #include "components/webcrypto/algorithm_implementation.h"
  11 #include "components/webcrypto/algorithms/secret_key_util.h"
  12 #include "components/webcrypto/algorithms/util_openssl.h"
  13 #include "components/webcrypto/crypto_data.h"
  14 #include "components/webcrypto/key.h"
  15 #include "components/webcrypto/status.h"
  16 #include "components/webcrypto/webcrypto_util.h"
  17 #include "crypto/openssl_util.h"
  18 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
  19 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
  20
  21 namespace webcrypto {
  22
  23 namespace {
  24
  25 const blink::WebCryptoKeyUsageMask kValidUsages =
  26     blink::WebCryptoKeyUsageDeriveKey | blink::WebCryptoKeyUsageDeriveBits;
  27
  28 class HkdfImplementation : public AlgorithmImplementation {
  29  public:
  30   HkdfImplementation() {}
  31
  32   Status VerifyKeyUsagesBeforeImportKey(
  33       blink::WebCryptoKeyFormat format,
  34       blink::WebCryptoKeyUsageMask usages) const override {
  35     if (format != blink::WebCryptoKeyFormatRaw)
  36       return Status::ErrorUnsupportedImportKeyFormat();
  37     return CheckKeyCreationUsages(kValidUsages, usages, false);
  38   }
  39
  40   Status ImportKeyRaw(const CryptoData& key_data,
  41                       const blink::WebCryptoAlgorithm& algorithm,
  42                       bool extractable,
  43                       blink::WebCryptoKeyUsageMask usages,
  44                       blink::WebCryptoKey* key) const override {
  45     return CreateWebCryptoSecretKey(
  46         key_data, blink::WebCryptoKeyAlgorithm::createWithoutParams(
  47                       blink::WebCryptoAlgorithmIdHkdf),
  48         extractable, usages, key);
  49   }
  50
  51   Status DeriveBits(const blink::WebCryptoAlgorithm& algorithm,
  52                     const blink::WebCryptoKey& base_key,
  53                     bool has_optional_length_bits,
  54                     unsigned int optional_length_bits,
  55                     std::vector<uint8_t>* derived_bytes) const override {
  56     crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
  57     if (!has_optional_length_bits)
  58       return Status::ErrorHkdfDeriveBitsLengthNotSpecified();
  59
  60     const blink::WebCryptoHkdfParams* params = algorithm.hkdfParams();
  61
  62     const EVP_MD* digest_algorithm = GetDigest(params->hash().id());
  63     if (!digest_algorithm)
  64       return Status::ErrorUnsupported();
  65
  66     // Size output to fit length
  67     unsigned int derived_bytes_len = NumBitsToBytes(optional_length_bits);
  68     derived_bytes->resize(derived_bytes_len);
  69
  70     // Algorithm dispatch checks that the algorithm in |base_key| matches
  71     // |algorithm|.
  72     const std::vector<uint8_t>& raw_key = GetSymmetricKeyData(base_key);
  73     if (!HKDF(vector_as_array(derived_bytes), derived_bytes_len,
  74               digest_algorithm, vector_as_array(&raw_key), raw_key.size(),
  75               params->salt().data(), params->salt().size(),
  76               params->info().data(), params->info().size())) {
  77       uint32_t error = ERR_get_error();
  78       if (ERR_GET_LIB(error) == ERR_LIB_HKDF &&
  79           ERR_GET_REASON(error) == HKDF_R_OUTPUT_TOO_LARGE) {
  80         return Status::ErrorHkdfLengthTooLong();
  81       }
  82       return Status::OperationError();
  83     }
  84
  85     TruncateToBitLength(optional_length_bits, derived_bytes);
  86     return Status::Success();
  87   }
  88
  89   Status DeserializeKeyForClone(const blink::WebCryptoKeyAlgorithm& algorithm,
  90                                 blink::WebCryptoKeyType type,
  91                                 bool extractable,
  92                                 blink::WebCryptoKeyUsageMask usages,
  93                                 const CryptoData& key_data,
  94                                 blink::WebCryptoKey* key) const override {
  95     return CreateWebCryptoSecretKey(key_data, algorithm, extractable, usages,
  96                                     key);
  97   }
  98
  99   Status GetKeyLength(const blink::WebCryptoAlgorithm& key_length_algorithm,
 100                       bool* has_length_bits,
 101                       unsigned int* length_bits) const override {
 102     *has_length_bits = false;
 103     return Status::Success();
 104   }
 105 };
 106
 107 }  // namespace
 108
 109 scoped_ptr<AlgorithmImplementation> CreateHkdfImplementation() {
 110   return make_scoped_ptr(new HkdfImplementation);
 111 }
 112
 113 }  // namespace webcrypto