content/child/webcrypto/test/rsa_ssa_unittest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/logging.h"
   6 #include "base/stl_util.h"
   7 #include "content/child/webcrypto/algorithm_dispatch.h"
   8 #include "content/child/webcrypto/crypto_data.h"
   9 #include "content/child/webcrypto/status.h"
  10 #include "content/child/webcrypto/test/test_helpers.h"
  11 #include "content/child/webcrypto/webcrypto_util.h"
  12 #include "testing/gtest/include/gtest/gtest.h"
  13 #include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
  14 #include "third_party/WebKit/public/platform/WebCryptoKey.h"
  15 #include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
  16
  17 namespace content {
  18
  19 namespace webcrypto {
  20
  21 namespace {
  22
  23 // Helper for ImportJwkRsaFailures. Restores the JWK JSON
  24 // dictionary to a good state
  25 void RestoreJwkRsaDictionary(base::DictionaryValue* dict) {
  26   dict->Clear();
  27   dict->SetString("kty", "RSA");
  28   dict->SetString("alg", "RS256");
  29   dict->SetString("use", "sig");
  30   dict->SetBoolean("ext", false);
  31   dict->SetString(
  32       "n",
  33       "qLOyhK-OtQs4cDSoYPFGxJGfMYdjzWxVmMiuSBGh4KvEx-CwgtaTpef87Wdc9GaFEncsDLxk"
  34       "p0LGxjD1M8jMcvYq6DPEC_JYQumEu3i9v5fAEH1VvbZi9cTg-rmEXLUUjvc5LdOq_5OuHmtm"
  35       "e7PUJHYW1PW6ENTP0ibeiNOfFvs");
  36   dict->SetString("e", "AQAB");
  37 }
  38
  39 TEST(WebCryptoRsaSsaTest, ImportExportSpki) {
  40   // Passing case: Import a valid RSA key in SPKI format.
  41   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
  42   ASSERT_EQ(Status::Success(),
  43             ImportKey(blink::WebCryptoKeyFormatSpki,
  44                       CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
  45                       CreateRsaHashedImportAlgorithm(
  46                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
  47                           blink::WebCryptoAlgorithmIdSha256),
  48                       true,
  49                       blink::WebCryptoKeyUsageVerify,
  50                       &key));
  51   EXPECT_TRUE(key.handle());
  52   EXPECT_EQ(blink::WebCryptoKeyTypePublic, key.type());
  53   EXPECT_TRUE(key.extractable());
  54   EXPECT_EQ(blink::WebCryptoKeyUsageVerify, key.usages());
  55   EXPECT_EQ(kModulusLengthBits,
  56             key.algorithm().rsaHashedParams()->modulusLengthBits());
  57   EXPECT_BYTES_EQ_HEX(
  58       "010001",
  59       CryptoData(key.algorithm().rsaHashedParams()->publicExponent()));
  60
  61   // Failing case: Empty SPKI data
  62   EXPECT_EQ(
  63       Status::ErrorImportEmptyKeyData(),
  64       ImportKey(blink::WebCryptoKeyFormatSpki,
  65                 CryptoData(std::vector<uint8_t>()),
  66                 CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5),
  67                 true,
  68                 blink::WebCryptoKeyUsageVerify,
  69                 &key));
  70
  71   // Failing case: Bad DER encoding.
  72   EXPECT_EQ(
  73       Status::DataError(),
  74       ImportKey(blink::WebCryptoKeyFormatSpki,
  75                 CryptoData(HexStringToBytes("618333c4cb")),
  76                 CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5),
  77                 true,
  78                 blink::WebCryptoKeyUsageVerify,
  79                 &key));
  80
  81   // Failing case: Import RSA key but provide an inconsistent input algorithm.
  82   EXPECT_EQ(Status::ErrorUnsupportedImportKeyFormat(),
  83             ImportKey(blink::WebCryptoKeyFormatSpki,
  84                       CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
  85                       CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc),
  86                       true,
  87                       blink::WebCryptoKeyUsageEncrypt,
  88                       &key));
  89
  90   // Passing case: Export a previously imported RSA public key in SPKI format
  91   // and compare to original data.
  92   std::vector<uint8_t> output;
  93   ASSERT_EQ(Status::Success(),
  94             ExportKey(blink::WebCryptoKeyFormatSpki, key, &output));
  95   EXPECT_BYTES_EQ_HEX(kPublicKeySpkiDerHex, output);
  96
  97   // Failing case: Try to export a previously imported RSA public key in raw
  98   // format (not allowed for a public key).
  99   EXPECT_EQ(Status::ErrorUnsupportedExportKeyFormat(),
 100             ExportKey(blink::WebCryptoKeyFormatRaw, key, &output));
 101
 102   // Failing case: Try to export a non-extractable key
 103   ASSERT_EQ(Status::Success(),
 104             ImportKey(blink::WebCryptoKeyFormatSpki,
 105                       CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
 106                       CreateRsaHashedImportAlgorithm(
 107                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 108                           blink::WebCryptoAlgorithmIdSha256),
 109                       false,
 110                       blink::WebCryptoKeyUsageVerify,
 111                       &key));
 112   EXPECT_TRUE(key.handle());
 113   EXPECT_FALSE(key.extractable());
 114   EXPECT_EQ(Status::ErrorKeyNotExtractable(),
 115             ExportKey(blink::WebCryptoKeyFormatSpki, key, &output));
 116
 117   // TODO(eroman): Failing test: Import a SPKI with an unrecognized hash OID
 118   // TODO(eroman): Failing test: Import a SPKI with invalid algorithm params
 119   // TODO(eroman): Failing test: Import a SPKI with inconsistent parameters
 120   // (e.g. SHA-1 in OID, SHA-256 in params)
 121   // TODO(eroman): Failing test: Import a SPKI for RSA-SSA, but with params
 122   // as OAEP/PSS
 123 }
 124
 125 TEST(WebCryptoRsaSsaTest, ImportExportPkcs8) {
 126   if (!SupportsRsaPrivateKeyImport())
 127     return;
 128
 129   // Passing case: Import a valid RSA key in PKCS#8 format.
 130   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
 131   ASSERT_EQ(Status::Success(),
 132             ImportKey(blink::WebCryptoKeyFormatPkcs8,
 133                       CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)),
 134                       CreateRsaHashedImportAlgorithm(
 135                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 136                           blink::WebCryptoAlgorithmIdSha1),
 137                       true,
 138                       blink::WebCryptoKeyUsageSign,
 139                       &key));
 140   EXPECT_TRUE(key.handle());
 141   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, key.type());
 142   EXPECT_TRUE(key.extractable());
 143   EXPECT_EQ(blink::WebCryptoKeyUsageSign, key.usages());
 144   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
 145             key.algorithm().rsaHashedParams()->hash().id());
 146   EXPECT_EQ(kModulusLengthBits,
 147             key.algorithm().rsaHashedParams()->modulusLengthBits());
 148   EXPECT_BYTES_EQ_HEX(
 149       "010001",
 150       CryptoData(key.algorithm().rsaHashedParams()->publicExponent()));
 151
 152   std::vector<uint8_t> exported_key;
 153   ASSERT_EQ(Status::Success(),
 154             ExportKey(blink::WebCryptoKeyFormatPkcs8, key, &exported_key));
 155   EXPECT_BYTES_EQ_HEX(kPrivateKeyPkcs8DerHex, exported_key);
 156
 157   // Failing case: Empty PKCS#8 data
 158   EXPECT_EQ(Status::ErrorImportEmptyKeyData(),
 159             ImportKey(blink::WebCryptoKeyFormatPkcs8,
 160                       CryptoData(std::vector<uint8_t>()),
 161                       CreateRsaHashedImportAlgorithm(
 162                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 163                           blink::WebCryptoAlgorithmIdSha1),
 164                       true,
 165                       blink::WebCryptoKeyUsageSign,
 166                       &key));
 167
 168   // Failing case: Bad DER encoding.
 169   EXPECT_EQ(
 170       Status::DataError(),
 171       ImportKey(blink::WebCryptoKeyFormatPkcs8,
 172                 CryptoData(HexStringToBytes("618333c4cb")),
 173                 CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5),
 174                 true,
 175                 blink::WebCryptoKeyUsageSign,
 176                 &key));
 177
 178   // Failing case: Import RSA key but provide an inconsistent input algorithm
 179   // and usage. Several issues here:
 180   //   * AES-CBC doesn't support PKCS8 key format
 181   //   * AES-CBC doesn't support "sign" usage
 182   EXPECT_EQ(Status::ErrorUnsupportedImportKeyFormat(),
 183             ImportKey(blink::WebCryptoKeyFormatPkcs8,
 184                       CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)),
 185                       CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc),
 186                       true,
 187                       blink::WebCryptoKeyUsageSign,
 188                       &key));
 189 }
 190
 191 // Tests importing of PKCS8 data that does not define a valid RSA key.
 192 TEST(WebCryptoRsaSsaTest, ImportInvalidPkcs8) {
 193   if (!SupportsRsaPrivateKeyImport())
 194     return;
 195
 196   // kPrivateKeyPkcs8DerHex defines an RSA private key in PKCS8 format, whose
 197   // parameters appear at the following offsets:
 198   //
 199   //   n: (offset=36, len=129)
 200   //   e: (offset=167, len=3)
 201   //   d: (offset=173, len=128)
 202   //   p: (offset=303, len=65)
 203   //   q: (offset=370, len=65)
 204   //   dp: (offset=437, len=64)
 205   //   dq; (offset=503, len=64)
 206   //   qi: (offset=569, len=64)
 207
 208   // Do several tests, each of which invert a single byte within the input.
 209   const unsigned int kOffsetsToCorrupt[] = {
 210       50,   // inside n
 211       168,  // inside e
 212       175,  // inside d
 213       333,  // inside p
 214       373,  // inside q
 215       450,  // inside dp
 216       550,  // inside dq
 217       600,  // inside qi
 218   };
 219
 220   for (size_t test_index = 0; test_index < arraysize(kOffsetsToCorrupt);
 221        ++test_index) {
 222     SCOPED_TRACE(test_index);
 223
 224     unsigned int i = kOffsetsToCorrupt[test_index];
 225     std::vector<uint8_t> corrupted_data =
 226         HexStringToBytes(kPrivateKeyPkcs8DerHex);
 227     corrupted_data[i] = ~corrupted_data[i];
 228
 229     blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
 230     EXPECT_EQ(Status::DataError(),
 231               ImportKey(blink::WebCryptoKeyFormatPkcs8,
 232                         CryptoData(corrupted_data),
 233                         CreateRsaHashedImportAlgorithm(
 234                             blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 235                             blink::WebCryptoAlgorithmIdSha1),
 236                         true,
 237                         blink::WebCryptoKeyUsageSign,
 238                         &key));
 239   }
 240 }
 241
 242 // Tests JWK import and export by doing a roundtrip key conversion and ensuring
 243 // it was lossless:
 244 //
 245 //   PKCS8 --> JWK --> PKCS8
 246 TEST(WebCryptoRsaSsaTest, ImportRsaPrivateKeyJwkToPkcs8RoundTrip) {
 247   if (!SupportsRsaPrivateKeyImport())
 248     return;
 249
 250   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
 251   ASSERT_EQ(Status::Success(),
 252             ImportKey(blink::WebCryptoKeyFormatPkcs8,
 253                       CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)),
 254                       CreateRsaHashedImportAlgorithm(
 255                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 256                           blink::WebCryptoAlgorithmIdSha1),
 257                       true,
 258                       blink::WebCryptoKeyUsageSign,
 259                       &key));
 260
 261   std::vector<uint8_t> exported_key_jwk;
 262   ASSERT_EQ(Status::Success(),
 263             ExportKey(blink::WebCryptoKeyFormatJwk, key, &exported_key_jwk));
 264
 265   // All of the optional parameters (p, q, dp, dq, qi) should be present in the
 266   // output.
 267   const char* expected_jwk =
 268       "{\"alg\":\"RS1\",\"d\":\"M6UEKpCyfU9UUcqbu9C0R3GhAa-IQ0Cu-YhfKku-"
 269       "kuiUpySsPFaMj5eFOtB8AmbIxqPKCSnx6PESMYhEKfxNmuVf7olqEM5wfD7X5zTkRyejlXRQ"
 270       "GlMmgxCcKrrKuig8MbS9L1PD7jfjUs7jT55QO9gMBiKtecbc7og1R8ajsyU\",\"dp\":"
 271       "\"KPoTk4ZVvh-"
 272       "KFZy6ylpy6hkMMAieGc0nSlVvNsT24Z9VSzTAd3kEJ7vdjdPt4kSDKPOF2Bsw6OQ7L_-"
 273       "gJ4YZeQ\",\"dq\":\"Gos485j6cSBJiY1_t57gp3ZoeRKZzfoJ78DlB6yyHtdDAe9b_Ui-"
 274       "RV6utuFnglWCdYCo5OjhQVHRUQqCo_LnKQ\",\"e\":\"AQAB\",\"ext\":true,\"key_"
 275       "ops\":[\"sign\"],\"kty\":\"RSA\",\"n\":"
 276       "\"pW5KDnAQF1iaUYfcfqhB0Vby7A42rVKkTf6x5h962ZHYxRBW_-2xYrTA8oOhKoijlN_"
 277       "1JqtykcuzB86r_OCx39XNlQgJbVsri2311nHvY3fAkhyyPCcKcOJZjm_4nRnxBazC0_"
 278       "DLNfKSgOE4a29kxO8i4eHyDQzoz_siSb2aITc\",\"p\":\"5-"
 279       "iUJyCod1Fyc6NWBT6iobwMlKpy1VxuhilrLfyWeUjApyy8zKfqyzVwbgmh31WhU1vZs8w0Fg"
 280       "s7bc0-2o5kQw\",\"q\":\"tp3KHPfU1-yB51uQ_MqHSrzeEj_"
 281       "ScAGAqpBHm25I3o1n7ST58Z2FuidYdPVCzSDccj5pYzZKH5QlRSsmmmeZ_Q\",\"qi\":"
 282       "\"JxVqukEm0kqB86Uoy_sn9WiG-"
 283       "ECp9uhuF6RLlP6TGVhLjiL93h5aLjvYqluo2FhBlOshkKz4MrhH8To9JKefTQ\"}";
 284
 285   ASSERT_EQ(CryptoData(std::string(expected_jwk)),
 286             CryptoData(exported_key_jwk));
 287
 288   ASSERT_EQ(Status::Success(),
 289             ImportKey(blink::WebCryptoKeyFormatJwk,
 290                       CryptoData(exported_key_jwk),
 291                       CreateRsaHashedImportAlgorithm(
 292                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 293                           blink::WebCryptoAlgorithmIdSha1),
 294                       true,
 295                       blink::WebCryptoKeyUsageSign,
 296                       &key));
 297
 298   std::vector<uint8_t> exported_key_pkcs8;
 299   ASSERT_EQ(
 300       Status::Success(),
 301       ExportKey(blink::WebCryptoKeyFormatPkcs8, key, &exported_key_pkcs8));
 302
 303   ASSERT_EQ(CryptoData(HexStringToBytes(kPrivateKeyPkcs8DerHex)),
 304             CryptoData(exported_key_pkcs8));
 305 }
 306
 307 // Tests importing multiple RSA private keys from JWK, and then exporting to
 308 // PKCS8.
 309 //
 310 // This is a regression test for http://crbug.com/378315, for which importing
 311 // a sequence of keys from JWK could yield the wrong key. The first key would
 312 // be imported correctly, however every key after that would actually import
 313 // the first key.
 314 TEST(WebCryptoRsaSsaTest, ImportMultipleRSAPrivateKeysJwk) {
 315   if (!SupportsRsaPrivateKeyImport())
 316     return;
 317
 318   scoped_ptr<base::ListValue> key_list;
 319   ASSERT_TRUE(ReadJsonTestFileToList("rsa_private_keys.json", &key_list));
 320
 321   // For this test to be meaningful the keys MUST be kept alive before importing
 322   // new keys.
 323   std::vector<blink::WebCryptoKey> live_keys;
 324
 325   for (size_t key_index = 0; key_index < key_list->GetSize(); ++key_index) {
 326     SCOPED_TRACE(key_index);
 327
 328     base::DictionaryValue* key_values;
 329     ASSERT_TRUE(key_list->GetDictionary(key_index, &key_values));
 330
 331     // Get the JWK representation of the key.
 332     base::DictionaryValue* key_jwk;
 333     ASSERT_TRUE(key_values->GetDictionary("jwk", &key_jwk));
 334
 335     // Get the PKCS8 representation of the key.
 336     std::string pkcs8_hex_string;
 337     ASSERT_TRUE(key_values->GetString("pkcs8", &pkcs8_hex_string));
 338     std::vector<uint8_t> pkcs8_bytes = HexStringToBytes(pkcs8_hex_string);
 339
 340     // Get the modulus length for the key.
 341     int modulus_length_bits = 0;
 342     ASSERT_TRUE(key_values->GetInteger("modulusLength", &modulus_length_bits));
 343
 344     blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
 345
 346     // Import the key from JWK.
 347     ASSERT_EQ(
 348         Status::Success(),
 349         ImportKeyJwkFromDict(*key_jwk,
 350                              CreateRsaHashedImportAlgorithm(
 351                                  blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 352                                  blink::WebCryptoAlgorithmIdSha256),
 353                              true,
 354                              blink::WebCryptoKeyUsageSign,
 355                              &private_key));
 356
 357     live_keys.push_back(private_key);
 358
 359     EXPECT_EQ(
 360         modulus_length_bits,
 361         static_cast<int>(
 362             private_key.algorithm().rsaHashedParams()->modulusLengthBits()));
 363
 364     // Export to PKCS8 and verify that it matches expectation.
 365     std::vector<uint8_t> exported_key_pkcs8;
 366     ASSERT_EQ(
 367         Status::Success(),
 368         ExportKey(
 369             blink::WebCryptoKeyFormatPkcs8, private_key, &exported_key_pkcs8));
 370
 371     EXPECT_BYTES_EQ(pkcs8_bytes, exported_key_pkcs8);
 372   }
 373 }
 374
 375 // Import an RSA private key using JWK. Next import a JWK containing the same
 376 // modulus, but mismatched parameters for the rest. It should NOT be possible
 377 // that the second import retrieves the first key. See http://crbug.com/378315
 378 // for how that could happen.
 379 TEST(WebCryptoRsaSsaTest, ImportJwkExistingModulusAndInvalid) {
 380   if (!SupportsRsaPrivateKeyImport())
 381     return;
 382
 383   scoped_ptr<base::ListValue> key_list;
 384   ASSERT_TRUE(ReadJsonTestFileToList("rsa_private_keys.json", &key_list));
 385
 386   // Import a 1024-bit private key.
 387   base::DictionaryValue* key1_props;
 388   ASSERT_TRUE(key_list->GetDictionary(1, &key1_props));
 389   base::DictionaryValue* key1_jwk;
 390   ASSERT_TRUE(key1_props->GetDictionary("jwk", &key1_jwk));
 391
 392   blink::WebCryptoKey key1 = blink::WebCryptoKey::createNull();
 393   ASSERT_EQ(Status::Success(),
 394             ImportKeyJwkFromDict(*key1_jwk,
 395                                  CreateRsaHashedImportAlgorithm(
 396                                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 397                                      blink::WebCryptoAlgorithmIdSha256),
 398                                  true,
 399                                  blink::WebCryptoKeyUsageSign,
 400                                  &key1));
 401
 402   ASSERT_EQ(1024u, key1.algorithm().rsaHashedParams()->modulusLengthBits());
 403
 404   // Construct a JWK using the modulus of key1, but all the other fields from
 405   // another key (also a 1024-bit private key).
 406   base::DictionaryValue* key2_props;
 407   ASSERT_TRUE(key_list->GetDictionary(5, &key2_props));
 408   base::DictionaryValue* key2_jwk;
 409   ASSERT_TRUE(key2_props->GetDictionary("jwk", &key2_jwk));
 410   std::string modulus;
 411   key1_jwk->GetString("n", &modulus);
 412   key2_jwk->SetString("n", modulus);
 413
 414   // This should fail, as the n,e,d parameters are not consistent. It MUST NOT
 415   // somehow return the key created earlier.
 416   blink::WebCryptoKey key2 = blink::WebCryptoKey::createNull();
 417   ASSERT_EQ(Status::OperationError(),
 418             ImportKeyJwkFromDict(*key2_jwk,
 419                                  CreateRsaHashedImportAlgorithm(
 420                                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 421                                      blink::WebCryptoAlgorithmIdSha256),
 422                                  true,
 423                                  blink::WebCryptoKeyUsageSign,
 424                                  &key2));
 425 }
 426
 427 // Import a JWK RSA private key with some optional parameters missing (q, dp,
 428 // dq, qi).
 429 //
 430 // The only optional parameter included is "p".
 431 //
 432 // This fails because JWA says that producers must include either ALL optional
 433 // parameters or NONE.
 434 TEST(WebCryptoRsaSsaTest, ImportRsaPrivateKeyJwkMissingOptionalParams) {
 435   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
 436
 437   base::DictionaryValue dict;
 438   dict.SetString("kty", "RSA");
 439   dict.SetString("alg", "RS1");
 440
 441   dict.SetString(
 442       "n",
 443       "pW5KDnAQF1iaUYfcfqhB0Vby7A42rVKkTf6x5h962ZHYxRBW_-2xYrTA8oOhKoijlN_"
 444       "1JqtykcuzB86r_OCx39XNlQgJbVsri2311nHvY3fAkhyyPCcKcOJZjm_4nRnxBazC0_"
 445       "DLNfKSgOE4a29kxO8i4eHyDQzoz_siSb2aITc");
 446   dict.SetString("e", "AQAB");
 447   dict.SetString(
 448       "d",
 449       "M6UEKpCyfU9UUcqbu9C0R3GhAa-IQ0Cu-YhfKku-"
 450       "kuiUpySsPFaMj5eFOtB8AmbIxqPKCSnx6PESMYhEKfxNmuVf7olqEM5wfD7X5zTkRyejlXRQ"
 451       "GlMmgxCcKrrKuig8MbS9L1PD7jfjUs7jT55QO9gMBiKtecbc7og1R8ajsyU");
 452
 453   dict.SetString("p",
 454                  "5-"
 455                  "iUJyCod1Fyc6NWBT6iobwMlKpy1VxuhilrLfyWeUjApyy8zKfqyzVwbgmh31W"
 456                  "hU1vZs8w0Fgs7bc0-2o5kQw");
 457
 458   ASSERT_EQ(Status::ErrorJwkPropertyMissing("q"),
 459             ImportKeyJwkFromDict(dict,
 460                                  CreateRsaHashedImportAlgorithm(
 461                                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 462                                      blink::WebCryptoAlgorithmIdSha1),
 463                                  true,
 464                                  blink::WebCryptoKeyUsageSign,
 465                                  &key));
 466 }
 467
 468 // Import a JWK RSA private key, without any of the optional parameters.
 469 //
 470 // According to JWA, such keys are valid, but applications SHOULD
 471 // include all the parameters when sending, and recipients MAY
 472 // accept them, but are not required to. Chromium's WebCrypto does
 473 // not allow such degenerate keys.
 474 TEST(WebCryptoRsaSsaTest, ImportRsaPrivateKeyJwkIncorrectOptionalEmpty) {
 475   if (!SupportsRsaPrivateKeyImport())
 476     return;
 477
 478   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
 479
 480   base::DictionaryValue dict;
 481   dict.SetString("kty", "RSA");
 482   dict.SetString("alg", "RS1");
 483
 484   dict.SetString(
 485       "n",
 486       "pW5KDnAQF1iaUYfcfqhB0Vby7A42rVKkTf6x5h962ZHYxRBW_-2xYrTA8oOhKoijlN_"
 487       "1JqtykcuzB86r_OCx39XNlQgJbVsri2311nHvY3fAkhyyPCcKcOJZjm_4nRnxBazC0_"
 488       "DLNfKSgOE4a29kxO8i4eHyDQzoz_siSb2aITc");
 489   dict.SetString("e", "AQAB");
 490   dict.SetString(
 491       "d",
 492       "M6UEKpCyfU9UUcqbu9C0R3GhAa-IQ0Cu-YhfKku-"
 493       "kuiUpySsPFaMj5eFOtB8AmbIxqPKCSnx6PESMYhEKfxNmuVf7olqEM5wfD7X5zTkRyejlXRQ"
 494       "GlMmgxCcKrrKuig8MbS9L1PD7jfjUs7jT55QO9gMBiKtecbc7og1R8ajsyU");
 495
 496   ASSERT_EQ(Status::ErrorJwkPropertyMissing("p"),
 497             ImportKeyJwkFromDict(dict,
 498                                  CreateRsaHashedImportAlgorithm(
 499                                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 500                                      blink::WebCryptoAlgorithmIdSha1),
 501                                  true,
 502                                  blink::WebCryptoKeyUsageSign,
 503                                  &key));
 504 }
 505
 506 // Tries importing a public RSA key whose exponent contains leading zeros.
 507 TEST(WebCryptoRsaSsaTest, ImportJwkRsaNonMinimalExponent) {
 508   base::DictionaryValue dict;
 509
 510   dict.SetString("kty", "RSA");
 511   dict.SetString("e", "AAEAAQ");  // 00 01 00 01
 512   dict.SetString(
 513       "n",
 514       "qLOyhK-OtQs4cDSoYPFGxJGfMYdjzWxVmMiuSBGh4KvEx-CwgtaTpef87Wdc9GaFEncsDLxk"
 515       "p0LGxjD1M8jMcvYq6DPEC_JYQumEu3i9v5fAEH1VvbZi9cTg-rmEXLUUjvc5LdOq_5OuHmtm"
 516       "e7PUJHYW1PW6ENTP0ibeiNOfFvs");
 517
 518   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
 519
 520   EXPECT_EQ(Status::ErrorJwkBigIntegerHasLeadingZero("e"),
 521             ImportKeyJwkFromDict(dict,
 522                                  CreateRsaHashedImportAlgorithm(
 523                                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 524                                      blink::WebCryptoAlgorithmIdSha256),
 525                                  false,
 526                                  blink::WebCryptoKeyUsageVerify,
 527                                  &key));
 528 }
 529
 530 TEST(WebCryptoRsaSsaTest, GenerateKeyPairRsa) {
 531   // Note: using unrealistic short key lengths here to avoid bogging down tests.
 532
 533   // Successful WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 key generation (sha256)
 534   const unsigned int modulus_length = 256;
 535   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
 536   blink::WebCryptoAlgorithm algorithm =
 537       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 538                                      blink::WebCryptoAlgorithmIdSha256,
 539                                      modulus_length,
 540                                      public_exponent);
 541   bool extractable = true;
 542   const blink::WebCryptoKeyUsageMask usage_mask = 0;
 543   blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
 544   blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
 545
 546   EXPECT_EQ(Status::Success(),
 547             GenerateKeyPair(
 548                 algorithm, extractable, usage_mask, &public_key, &private_key));
 549   EXPECT_FALSE(public_key.isNull());
 550   EXPECT_FALSE(private_key.isNull());
 551   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
 552   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
 553   EXPECT_EQ(modulus_length,
 554             public_key.algorithm().rsaHashedParams()->modulusLengthBits());
 555   EXPECT_EQ(modulus_length,
 556             private_key.algorithm().rsaHashedParams()->modulusLengthBits());
 557   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
 558             public_key.algorithm().rsaHashedParams()->hash().id());
 559   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
 560             private_key.algorithm().rsaHashedParams()->hash().id());
 561   EXPECT_TRUE(public_key.extractable());
 562   EXPECT_EQ(extractable, private_key.extractable());
 563   EXPECT_EQ(usage_mask, public_key.usages());
 564   EXPECT_EQ(usage_mask, private_key.usages());
 565
 566   // Try exporting the generated key pair, and then re-importing to verify that
 567   // the exported data was valid.
 568   std::vector<uint8_t> public_key_spki;
 569   EXPECT_EQ(
 570       Status::Success(),
 571       ExportKey(blink::WebCryptoKeyFormatSpki, public_key, &public_key_spki));
 572
 573   if (SupportsRsaPrivateKeyImport()) {
 574     public_key = blink::WebCryptoKey::createNull();
 575     EXPECT_EQ(Status::Success(),
 576               ImportKey(blink::WebCryptoKeyFormatSpki,
 577                         CryptoData(public_key_spki),
 578                         CreateRsaHashedImportAlgorithm(
 579                             blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 580                             blink::WebCryptoAlgorithmIdSha256),
 581                         true,
 582                         usage_mask,
 583                         &public_key));
 584     EXPECT_EQ(modulus_length,
 585               public_key.algorithm().rsaHashedParams()->modulusLengthBits());
 586
 587     std::vector<uint8_t> private_key_pkcs8;
 588     EXPECT_EQ(
 589         Status::Success(),
 590         ExportKey(
 591             blink::WebCryptoKeyFormatPkcs8, private_key, &private_key_pkcs8));
 592     private_key = blink::WebCryptoKey::createNull();
 593     EXPECT_EQ(Status::Success(),
 594               ImportKey(blink::WebCryptoKeyFormatPkcs8,
 595                         CryptoData(private_key_pkcs8),
 596                         CreateRsaHashedImportAlgorithm(
 597                             blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 598                             blink::WebCryptoAlgorithmIdSha256),
 599                         true,
 600                         usage_mask,
 601                         &private_key));
 602     EXPECT_EQ(modulus_length,
 603               private_key.algorithm().rsaHashedParams()->modulusLengthBits());
 604   }
 605
 606   // Fail with bad modulus.
 607   algorithm =
 608       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 609                                      blink::WebCryptoAlgorithmIdSha256,
 610                                      0,
 611                                      public_exponent);
 612   EXPECT_EQ(Status::ErrorGenerateRsaUnsupportedModulus(),
 613             GenerateKeyPair(
 614                 algorithm, extractable, usage_mask, &public_key, &private_key));
 615
 616   // Fail with bad exponent: larger than unsigned long.
 617   unsigned int exponent_length = sizeof(unsigned long) + 1;  // NOLINT
 618   const std::vector<uint8_t> long_exponent(exponent_length, 0x01);
 619   algorithm =
 620       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 621                                      blink::WebCryptoAlgorithmIdSha256,
 622                                      modulus_length,
 623                                      long_exponent);
 624   EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
 625             GenerateKeyPair(
 626                 algorithm, extractable, usage_mask, &public_key, &private_key));
 627
 628   // Fail with bad exponent: empty.
 629   const std::vector<uint8_t> empty_exponent;
 630   algorithm =
 631       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 632                                      blink::WebCryptoAlgorithmIdSha256,
 633                                      modulus_length,
 634                                      empty_exponent);
 635   EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
 636             GenerateKeyPair(
 637                 algorithm, extractable, usage_mask, &public_key, &private_key));
 638
 639   // Fail with bad exponent: all zeros.
 640   std::vector<uint8_t> exponent_with_leading_zeros(15, 0x00);
 641   algorithm =
 642       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 643                                      blink::WebCryptoAlgorithmIdSha256,
 644                                      modulus_length,
 645                                      exponent_with_leading_zeros);
 646   EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
 647             GenerateKeyPair(
 648                 algorithm, extractable, usage_mask, &public_key, &private_key));
 649
 650   // Key generation success using exponent with leading zeros.
 651   exponent_with_leading_zeros.insert(exponent_with_leading_zeros.end(),
 652                                      public_exponent.begin(),
 653                                      public_exponent.end());
 654   algorithm =
 655       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 656                                      blink::WebCryptoAlgorithmIdSha256,
 657                                      modulus_length,
 658                                      exponent_with_leading_zeros);
 659   EXPECT_EQ(Status::Success(),
 660             GenerateKeyPair(
 661                 algorithm, extractable, usage_mask, &public_key, &private_key));
 662   EXPECT_FALSE(public_key.isNull());
 663   EXPECT_FALSE(private_key.isNull());
 664   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
 665   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
 666   EXPECT_TRUE(public_key.extractable());
 667   EXPECT_EQ(extractable, private_key.extractable());
 668   EXPECT_EQ(usage_mask, public_key.usages());
 669   EXPECT_EQ(usage_mask, private_key.usages());
 670
 671   // Successful WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 key generation (sha1)
 672   algorithm =
 673       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 674                                      blink::WebCryptoAlgorithmIdSha1,
 675                                      modulus_length,
 676                                      public_exponent);
 677   EXPECT_EQ(
 678       Status::Success(),
 679       GenerateKeyPair(algorithm, false, usage_mask, &public_key, &private_key));
 680   EXPECT_FALSE(public_key.isNull());
 681   EXPECT_FALSE(private_key.isNull());
 682   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
 683   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
 684   EXPECT_EQ(modulus_length,
 685             public_key.algorithm().rsaHashedParams()->modulusLengthBits());
 686   EXPECT_EQ(modulus_length,
 687             private_key.algorithm().rsaHashedParams()->modulusLengthBits());
 688   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
 689             public_key.algorithm().rsaHashedParams()->hash().id());
 690   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
 691             private_key.algorithm().rsaHashedParams()->hash().id());
 692   // Even though "extractable" was set to false, the public key remains
 693   // extractable.
 694   EXPECT_TRUE(public_key.extractable());
 695   EXPECT_FALSE(private_key.extractable());
 696   EXPECT_EQ(usage_mask, public_key.usages());
 697   EXPECT_EQ(usage_mask, private_key.usages());
 698
 699   // Exporting a private key as SPKI format doesn't make sense. However this
 700   // will first fail because the key is not extractable.
 701   std::vector<uint8_t> output;
 702   EXPECT_EQ(Status::ErrorKeyNotExtractable(),
 703             ExportKey(blink::WebCryptoKeyFormatSpki, private_key, &output));
 704
 705   // Re-generate an extractable private_key and try to export it as SPKI format.
 706   // This should fail since spki is for public keys.
 707   EXPECT_EQ(
 708       Status::Success(),
 709       GenerateKeyPair(algorithm, true, usage_mask, &public_key, &private_key));
 710   EXPECT_EQ(Status::ErrorUnexpectedKeyType(),
 711             ExportKey(blink::WebCryptoKeyFormatSpki, private_key, &output));
 712 }
 713
 714 TEST(WebCryptoRsaSsaTest, GenerateKeyPairRsaBadModulusLength) {
 715   const unsigned int kBadModulusBits[] = {
 716       0,
 717       248,         // Too small.
 718       257,         // Not a multiple of 8.
 719       1023,        // Not a multiple of 8.
 720       0xFFFFFFFF,  // Too big.
 721       16384 + 8,   // 16384 is the maxmimum length that NSS succeeds for.
 722   };
 723
 724   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
 725
 726   for (size_t i = 0; i < arraysize(kBadModulusBits); ++i) {
 727     const unsigned int modulus_length_bits = kBadModulusBits[i];
 728     blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
 729         blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 730         blink::WebCryptoAlgorithmIdSha256,
 731         modulus_length_bits,
 732         public_exponent);
 733     bool extractable = true;
 734     const blink::WebCryptoKeyUsageMask usage_mask = 0;
 735     blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
 736     blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
 737
 738     EXPECT_EQ(
 739         Status::ErrorGenerateRsaUnsupportedModulus(),
 740         GenerateKeyPair(
 741             algorithm, extractable, usage_mask, &public_key, &private_key));
 742   }
 743 }
 744
 745 // Try generating RSA key pairs using unsupported public exponents. Only
 746 // exponents of 3 and 65537 are supported. While both OpenSSL and NSS can
 747 // support other values, OpenSSL hangs when given invalid exponents, so use a
 748 // whitelist to validate the parameters.
 749 TEST(WebCryptoRsaSsaTest, GenerateKeyPairRsaBadExponent) {
 750   const unsigned int modulus_length = 1024;
 751
 752   const char* const kPublicExponents[] = {
 753       "11",  // 17 - This is a valid public exponent, but currently disallowed.
 754       "00",     "01", "02",
 755       "010000",  // 65536
 756   };
 757
 758   for (size_t i = 0; i < arraysize(kPublicExponents); ++i) {
 759     SCOPED_TRACE(i);
 760     blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
 761         blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 762         blink::WebCryptoAlgorithmIdSha256,
 763         modulus_length,
 764         HexStringToBytes(kPublicExponents[i]));
 765
 766     blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
 767     blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
 768
 769     EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
 770               GenerateKeyPair(algorithm, true, 0, &public_key, &private_key));
 771   }
 772 }
 773
 774 TEST(WebCryptoRsaSsaTest, SignVerifyFailures) {
 775   if (!SupportsRsaPrivateKeyImport())
 776     return;
 777
 778   // Import a key pair.
 779   blink::WebCryptoAlgorithm import_algorithm =
 780       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 781                                      blink::WebCryptoAlgorithmIdSha1);
 782   blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
 783   blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
 784   ASSERT_NO_FATAL_FAILURE(
 785       ImportRsaKeyPair(HexStringToBytes(kPublicKeySpkiDerHex),
 786                        HexStringToBytes(kPrivateKeyPkcs8DerHex),
 787                        import_algorithm,
 788                        false,
 789                        blink::WebCryptoKeyUsageVerify,
 790                        blink::WebCryptoKeyUsageSign,
 791                        &public_key,
 792                        &private_key));
 793
 794   blink::WebCryptoAlgorithm algorithm =
 795       CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5);
 796
 797   std::vector<uint8_t> signature;
 798   bool signature_match;
 799
 800   // Compute a signature.
 801   const std::vector<uint8_t> data = HexStringToBytes("010203040506070809");
 802   ASSERT_EQ(Status::Success(),
 803             Sign(algorithm, private_key, CryptoData(data), &signature));
 804
 805   // Ensure truncated signature does not verify by passing one less byte.
 806   EXPECT_EQ(
 807       Status::Success(),
 808       Verify(algorithm,
 809              public_key,
 810              CryptoData(vector_as_array(&signature), signature.size() - 1),
 811              CryptoData(data),
 812              &signature_match));
 813   EXPECT_FALSE(signature_match);
 814
 815   // Ensure truncated signature does not verify by passing no bytes.
 816   EXPECT_EQ(Status::Success(),
 817             Verify(algorithm,
 818                    public_key,
 819                    CryptoData(),
 820                    CryptoData(data),
 821                    &signature_match));
 822   EXPECT_FALSE(signature_match);
 823
 824   // Ensure corrupted signature does not verify.
 825   std::vector<uint8_t> corrupt_sig = signature;
 826   corrupt_sig[corrupt_sig.size() / 2] ^= 0x1;
 827   EXPECT_EQ(Status::Success(),
 828             Verify(algorithm,
 829                    public_key,
 830                    CryptoData(corrupt_sig),
 831                    CryptoData(data),
 832                    &signature_match));
 833   EXPECT_FALSE(signature_match);
 834
 835   // Ensure signatures that are greater than the modulus size fail.
 836   const unsigned int long_message_size_bytes = 1024;
 837   DCHECK_GT(long_message_size_bytes, kModulusLengthBits / 8);
 838   const unsigned char kLongSignature[long_message_size_bytes] = {0};
 839   EXPECT_EQ(Status::Success(),
 840             Verify(algorithm,
 841                    public_key,
 842                    CryptoData(kLongSignature, sizeof(kLongSignature)),
 843                    CryptoData(data),
 844                    &signature_match));
 845   EXPECT_FALSE(signature_match);
 846
 847   // Ensure that signing and verifying with an incompatible algorithm fails.
 848   algorithm = CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaOaep);
 849
 850   EXPECT_EQ(Status::ErrorUnexpected(),
 851             Sign(algorithm, private_key, CryptoData(data), &signature));
 852   EXPECT_EQ(Status::ErrorUnexpected(),
 853             Verify(algorithm,
 854                    public_key,
 855                    CryptoData(signature),
 856                    CryptoData(data),
 857                    &signature_match));
 858
 859   // Some crypto libraries (NSS) can automatically select the RSA SSA inner hash
 860   // based solely on the contents of the input signature data. In the Web Crypto
 861   // implementation, the inner hash should be specified uniquely by the key
 862   // algorithm parameter. To validate this behavior, call Verify with a computed
 863   // signature that used one hash type (SHA-1), but pass in a key with a
 864   // different inner hash type (SHA-256). If the hash type is determined by the
 865   // signature itself (undesired), the verify will pass, while if the hash type
 866   // is specified by the key algorithm (desired), the verify will fail.
 867
 868   // Compute a signature using SHA-1 as the inner hash.
 869   EXPECT_EQ(Status::Success(),
 870             Sign(CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5),
 871                  private_key,
 872                  CryptoData(data),
 873                  &signature));
 874
 875   blink::WebCryptoKey public_key_256 = blink::WebCryptoKey::createNull();
 876   EXPECT_EQ(Status::Success(),
 877             ImportKey(blink::WebCryptoKeyFormatSpki,
 878                       CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
 879                       CreateRsaHashedImportAlgorithm(
 880                           blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 881                           blink::WebCryptoAlgorithmIdSha256),
 882                       true,
 883                       blink::WebCryptoKeyUsageVerify,
 884                       &public_key_256));
 885
 886   // Now verify using an algorithm whose inner hash is SHA-256, not SHA-1. The
 887   // signature should not verify.
 888   // NOTE: public_key was produced by generateKey, and so its associated
 889   // algorithm has WebCryptoRsaKeyGenParams and not WebCryptoRsaSsaParams. Thus
 890   // it has no inner hash to conflict with the input algorithm.
 891   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
 892             private_key.algorithm().rsaHashedParams()->hash().id());
 893   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
 894             public_key_256.algorithm().rsaHashedParams()->hash().id());
 895
 896   bool is_match;
 897   EXPECT_EQ(Status::Success(),
 898             Verify(CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5),
 899                    public_key_256,
 900                    CryptoData(signature),
 901                    CryptoData(data),
 902                    &is_match));
 903   EXPECT_FALSE(is_match);
 904 }
 905
 906 TEST(WebCryptoRsaSsaTest, SignVerifyKnownAnswer) {
 907   if (!SupportsRsaPrivateKeyImport())
 908     return;
 909
 910   scoped_ptr<base::ListValue> tests;
 911   ASSERT_TRUE(ReadJsonTestFileToList("pkcs1v15_sign.json", &tests));
 912
 913   // Import the key pair.
 914   blink::WebCryptoAlgorithm import_algorithm =
 915       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 916                                      blink::WebCryptoAlgorithmIdSha1);
 917   blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
 918   blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
 919   ASSERT_NO_FATAL_FAILURE(
 920       ImportRsaKeyPair(HexStringToBytes(kPublicKeySpkiDerHex),
 921                        HexStringToBytes(kPrivateKeyPkcs8DerHex),
 922                        import_algorithm,
 923                        false,
 924                        blink::WebCryptoKeyUsageVerify,
 925                        blink::WebCryptoKeyUsageSign,
 926                        &public_key,
 927                        &private_key));
 928
 929   blink::WebCryptoAlgorithm algorithm =
 930       CreateAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5);
 931
 932   // Validate the signatures are computed and verified as expected.
 933   std::vector<uint8_t> signature;
 934   for (size_t test_index = 0; test_index < tests->GetSize(); ++test_index) {
 935     SCOPED_TRACE(test_index);
 936
 937     base::DictionaryValue* test;
 938     ASSERT_TRUE(tests->GetDictionary(test_index, &test));
 939
 940     std::vector<uint8_t> test_message =
 941         GetBytesFromHexString(test, "message_hex");
 942     std::vector<uint8_t> test_signature =
 943         GetBytesFromHexString(test, "signature_hex");
 944
 945     signature.clear();
 946     ASSERT_EQ(
 947         Status::Success(),
 948         Sign(algorithm, private_key, CryptoData(test_message), &signature));
 949     EXPECT_BYTES_EQ(test_signature, signature);
 950
 951     bool is_match = false;
 952     ASSERT_EQ(Status::Success(),
 953               Verify(algorithm,
 954                      public_key,
 955                      CryptoData(test_signature),
 956                      CryptoData(test_message),
 957                      &is_match));
 958     EXPECT_TRUE(is_match);
 959   }
 960 }
 961
 962 // Try importing an RSA-SSA public key with unsupported key usages using SPKI
 963 // format. RSA-SSA public keys only support the 'verify' usage.
 964 TEST(WebCryptoRsaSsaTest, ImportRsaSsaPublicKeyBadUsage_SPKI) {
 965   const blink::WebCryptoAlgorithm algorithm =
 966       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 967                                      blink::WebCryptoAlgorithmIdSha256);
 968
 969   blink::WebCryptoKeyUsageMask bad_usages[] = {
 970       blink::WebCryptoKeyUsageSign,
 971       blink::WebCryptoKeyUsageSign | blink::WebCryptoKeyUsageVerify,
 972       blink::WebCryptoKeyUsageEncrypt,
 973       blink::WebCryptoKeyUsageEncrypt | blink::WebCryptoKeyUsageDecrypt,
 974   };
 975
 976   for (size_t i = 0; i < arraysize(bad_usages); ++i) {
 977     SCOPED_TRACE(i);
 978
 979     blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
 980     ASSERT_EQ(Status::ErrorCreateKeyBadUsages(),
 981               ImportKey(blink::WebCryptoKeyFormatSpki,
 982                         CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
 983                         algorithm,
 984                         false,
 985                         bad_usages[i],
 986                         &public_key));
 987   }
 988 }
 989
 990 // Try importing an RSA-SSA public key with unsupported key usages using JWK
 991 // format. RSA-SSA public keys only support the 'verify' usage.
 992 TEST(WebCryptoRsaSsaTest, ImportRsaSsaPublicKeyBadUsage_JWK) {
 993   const blink::WebCryptoAlgorithm algorithm =
 994       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
 995                                      blink::WebCryptoAlgorithmIdSha256);
 996
 997   blink::WebCryptoKeyUsageMask bad_usages[] = {
 998       blink::WebCryptoKeyUsageSign,
 999       blink::WebCryptoKeyUsageSign | blink::WebCryptoKeyUsageVerify,
1000       blink::WebCryptoKeyUsageEncrypt,
1001       blink::WebCryptoKeyUsageEncrypt | blink::WebCryptoKeyUsageDecrypt,
1002   };
1003
1004   base::DictionaryValue dict;
1005   RestoreJwkRsaDictionary(&dict);
1006   dict.Remove("use", NULL);
1007   dict.SetString("alg", "RS256");
1008
1009   for (size_t i = 0; i < arraysize(bad_usages); ++i) {
1010     SCOPED_TRACE(i);
1011
1012     blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
1013     ASSERT_EQ(Status::ErrorCreateKeyBadUsages(),
1014               ImportKeyJwkFromDict(
1015                   dict, algorithm, false, bad_usages[i], &public_key));
1016   }
1017 }
1018
1019 // Generate an RSA-SSA key pair with invalid usages. RSA-SSA supports:
1020 //   'sign', 'verify'
1021 TEST(WebCryptoRsaSsaTest, GenerateKeyBadUsages) {
1022   blink::WebCryptoKeyUsageMask bad_usages[] = {
1023       blink::WebCryptoKeyUsageDecrypt,
1024       blink::WebCryptoKeyUsageVerify | blink::WebCryptoKeyUsageDecrypt,
1025       blink::WebCryptoKeyUsageWrapKey,
1026   };
1027
1028   const unsigned int modulus_length = 256;
1029   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
1030
1031   for (size_t i = 0; i < arraysize(bad_usages); ++i) {
1032     SCOPED_TRACE(i);
1033
1034     blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
1035     blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
1036
1037     ASSERT_EQ(Status::ErrorCreateKeyBadUsages(),
1038               GenerateKeyPair(CreateRsaHashedKeyGenAlgorithm(
1039                                   blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
1040                                   blink::WebCryptoAlgorithmIdSha256,
1041                                   modulus_length,
1042                                   public_exponent),
1043                               true,
1044                               bad_usages[i],
1045                               &public_key,
1046                               &private_key));
1047   }
1048 }
1049
1050 // Generate an RSA-SSA key pair. The public and private keys should select the
1051 // key usages which are applicable, and not have the exact same usages as was
1052 // specified to GenerateKey
1053 TEST(WebCryptoRsaSsaTest, GenerateKeyPairIntersectUsages) {
1054   const unsigned int modulus_length = 256;
1055   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
1056
1057   blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
1058   blink::WebCryptoKey private_key = blink::WebCryptoKey::createNull();
1059
1060   ASSERT_EQ(Status::Success(),
1061             GenerateKeyPair(
1062                 CreateRsaHashedKeyGenAlgorithm(
1063                     blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
1064                     blink::WebCryptoAlgorithmIdSha256,
1065                     modulus_length,
1066                     public_exponent),
1067                 true,
1068                 blink::WebCryptoKeyUsageSign | blink::WebCryptoKeyUsageVerify,
1069                 &public_key,
1070                 &private_key));
1071
1072   EXPECT_EQ(blink::WebCryptoKeyUsageVerify, public_key.usages());
1073   EXPECT_EQ(blink::WebCryptoKeyUsageSign, private_key.usages());
1074
1075   // Try again but this time without the Verify usages.
1076   ASSERT_EQ(Status::Success(),
1077             GenerateKeyPair(CreateRsaHashedKeyGenAlgorithm(
1078                                 blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
1079                                 blink::WebCryptoAlgorithmIdSha256,
1080                                 modulus_length,
1081                                 public_exponent),
1082                             true,
1083                             blink::WebCryptoKeyUsageSign,
1084                             &public_key,
1085                             &private_key));
1086
1087   EXPECT_EQ(0, public_key.usages());
1088   EXPECT_EQ(blink::WebCryptoKeyUsageSign, private_key.usages());
1089 }
1090
1091 TEST(WebCryptoRsaSsaTest, ImportExportJwkRsaPublicKey) {
1092   struct TestCase {
1093     const blink::WebCryptoAlgorithmId hash;
1094     const blink::WebCryptoKeyUsageMask usage;
1095     const char* const jwk_alg;
1096   };
1097   const TestCase kTests[] = {
1098       {blink::WebCryptoAlgorithmIdSha1, blink::WebCryptoKeyUsageVerify, "RS1"},
1099       {blink::WebCryptoAlgorithmIdSha256, blink::WebCryptoKeyUsageVerify,
1100        "RS256"},
1101       {blink::WebCryptoAlgorithmIdSha384, blink::WebCryptoKeyUsageVerify,
1102        "RS384"},
1103       {blink::WebCryptoAlgorithmIdSha512, blink::WebCryptoKeyUsageVerify,
1104        "RS512"}};
1105
1106   for (size_t test_index = 0; test_index < ARRAYSIZE_UNSAFE(kTests);
1107        ++test_index) {
1108     SCOPED_TRACE(test_index);
1109     const TestCase& test = kTests[test_index];
1110
1111     const blink::WebCryptoAlgorithm import_algorithm =
1112         CreateRsaHashedImportAlgorithm(
1113             blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5, test.hash);
1114
1115     // Import the spki to create a public key
1116     blink::WebCryptoKey public_key = blink::WebCryptoKey::createNull();
1117     ASSERT_EQ(Status::Success(),
1118               ImportKey(blink::WebCryptoKeyFormatSpki,
1119                         CryptoData(HexStringToBytes(kPublicKeySpkiDerHex)),
1120                         import_algorithm,
1121                         true,
1122                         test.usage,
1123                         &public_key));
1124
1125     // Export the public key as JWK and verify its contents
1126     std::vector<uint8_t> jwk;
1127     ASSERT_EQ(Status::Success(),
1128               ExportKey(blink::WebCryptoKeyFormatJwk, public_key, &jwk));
1129     EXPECT_TRUE(VerifyPublicJwk(jwk,
1130                                 test.jwk_alg,
1131                                 kPublicKeyModulusHex,
1132                                 kPublicKeyExponentHex,
1133                                 test.usage));
1134
1135     // Import the JWK back in to create a new key
1136     blink::WebCryptoKey public_key2 = blink::WebCryptoKey::createNull();
1137     ASSERT_EQ(Status::Success(),
1138               ImportKey(blink::WebCryptoKeyFormatJwk,
1139                         CryptoData(jwk),
1140                         import_algorithm,
1141                         true,
1142                         test.usage,
1143                         &public_key2));
1144     ASSERT_TRUE(public_key2.handle());
1145     EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key2.type());
1146     EXPECT_TRUE(public_key2.extractable());
1147     EXPECT_EQ(import_algorithm.id(), public_key2.algorithm().id());
1148
1149     // Export the new key as spki and compare to the original.
1150     std::vector<uint8_t> spki;
1151     ASSERT_EQ(Status::Success(),
1152               ExportKey(blink::WebCryptoKeyFormatSpki, public_key2, &spki));
1153     EXPECT_BYTES_EQ_HEX(kPublicKeySpkiDerHex, CryptoData(spki));
1154   }
1155 }
1156
1157 TEST(WebCryptoRsaSsaTest, ImportJwkRsaFailures) {
1158   base::DictionaryValue dict;
1159   RestoreJwkRsaDictionary(&dict);
1160   blink::WebCryptoAlgorithm algorithm =
1161       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
1162                                      blink::WebCryptoAlgorithmIdSha256);
1163   blink::WebCryptoKeyUsageMask usage_mask = blink::WebCryptoKeyUsageVerify;
1164   blink::WebCryptoKey key = blink::WebCryptoKey::createNull();
1165
1166   // An RSA public key JWK _must_ have an "n" (modulus) and an "e" (exponent)
1167   // entry, while an RSA private key must have those plus at least a "d"
1168   // (private exponent) entry.
1169   // See http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-18,
1170   // section 6.3.
1171
1172   // Baseline pass.
1173   EXPECT_EQ(Status::Success(),
1174             ImportKeyJwkFromDict(dict, algorithm, false, usage_mask, &key));
1175   EXPECT_EQ(algorithm.id(), key.algorithm().id());
1176   EXPECT_FALSE(key.extractable());
1177   EXPECT_EQ(blink::WebCryptoKeyUsageVerify, key.usages());
1178   EXPECT_EQ(blink::WebCryptoKeyTypePublic, key.type());
1179
1180   // The following are specific failure cases for when kty = "RSA".
1181
1182   // Fail if either "n" or "e" is not present or malformed.
1183   const std::string kKtyParmName[] = {"n", "e"};
1184   for (size_t idx = 0; idx < ARRAYSIZE_UNSAFE(kKtyParmName); ++idx) {
1185     // Fail on missing parameter.
1186     dict.Remove(kKtyParmName[idx], NULL);
1187     EXPECT_NE(Status::Success(),
1188               ImportKeyJwkFromDict(dict, algorithm, false, usage_mask, &key));
1189     RestoreJwkRsaDictionary(&dict);
1190
1191     // Fail on bad b64 parameter encoding.
1192     dict.SetString(kKtyParmName[idx], "Qk3f0DsytU8lfza2au #$% Htaw2xpop9yTuH0");
1193     EXPECT_NE(Status::Success(),
1194               ImportKeyJwkFromDict(dict, algorithm, false, usage_mask, &key));
1195     RestoreJwkRsaDictionary(&dict);
1196
1197     // Fail on empty parameter.
1198     dict.SetString(kKtyParmName[idx], "");
1199     EXPECT_EQ(Status::ErrorJwkEmptyBigInteger(kKtyParmName[idx]),
1200               ImportKeyJwkFromDict(dict, algorithm, false, usage_mask, &key));
1201     RestoreJwkRsaDictionary(&dict);
1202   }
1203 }
1204
1205 }  // namespace
1206
1207 }  // namespace webcrypto
1208
1209 }  // namespace content