unexportable_key.cc 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111
  1. // Copyright (c) 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "crypto/unexportable_key.h"
  5. #include "base/bind.h"
  6. #include "base/check.h"
  7. #include "build/build_config.h"
  8. #if BUILDFLAG(IS_WIN)
  9. #include "base/metrics/histogram_functions.h"
  10. #include "base/metrics/histogram_macros.h"
  11. #include "base/task/task_traits.h"
  12. #include "base/task/thread_pool.h"
  13. #include "base/timer/elapsed_timer.h"
  14. #endif // BUILDFLAG(IS_WIN)
  15. namespace crypto {
  16. namespace {
  17. std::unique_ptr<UnexportableKeyProvider> (*g_mock_provider)() = nullptr;
  18. } // namespace
  19. UnexportableSigningKey::~UnexportableSigningKey() = default;
  20. UnexportableKeyProvider::~UnexportableKeyProvider() = default;
  21. #if BUILDFLAG(IS_WIN)
  22. std::unique_ptr<UnexportableKeyProvider> GetUnexportableKeyProviderWin();
  23. #endif
  24. std::unique_ptr<UnexportableKeyProvider> GetUnexportableKeyProvider() {
  25. if (g_mock_provider) {
  26. return g_mock_provider();
  27. }
  28. #if BUILDFLAG(IS_WIN)
  29. return GetUnexportableKeyProviderWin();
  30. #else
  31. return nullptr;
  32. #endif
  33. }
  34. #if BUILDFLAG(IS_WIN)
  35. void MeasureTPMAvailabilityWin() {
  36. // Measure the fraction of Windows machines that have TPMs, and what the best
  37. // supported algorithm is.
  38. base::ThreadPool::PostTask(
  39. // GetUnexportableKeyProvider can call functions that take the global
  40. // loader lock, so although BEST_EFFORT makes it low priority to start,
  41. // once it starts it must run in a foreground thread to avoid priority
  42. // inversions.
  43. FROM_HERE,
  44. {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
  45. base::ThreadPolicy::MUST_USE_FOREGROUND},
  46. base::BindOnce([]() {
  47. // Note that values here are used in a recorded histogram. Don't change
  48. // the values of existing members.
  49. enum TPMSupport {
  50. kNone = 0,
  51. kRSA = 1,
  52. kECDSA = 2,
  53. kMaxValue = 2,
  54. };
  55. TPMSupport result = TPMSupport::kNone;
  56. std::unique_ptr<UnexportableKeyProvider> provider =
  57. GetUnexportableKeyProvider();
  58. if (provider) {
  59. const SignatureVerifier::SignatureAlgorithm kAllAlgorithms[] = {
  60. SignatureVerifier::SignatureAlgorithm::ECDSA_SHA256,
  61. SignatureVerifier::SignatureAlgorithm::RSA_PKCS1_SHA256,
  62. };
  63. auto algo = provider->SelectAlgorithm(kAllAlgorithms);
  64. if (algo) {
  65. switch (*algo) {
  66. case SignatureVerifier::SignatureAlgorithm::ECDSA_SHA256:
  67. result = TPMSupport::kECDSA;
  68. break;
  69. case SignatureVerifier::SignatureAlgorithm::RSA_PKCS1_SHA256:
  70. result = TPMSupport::kRSA;
  71. break;
  72. case SignatureVerifier::SignatureAlgorithm::RSA_PKCS1_SHA1:
  73. case SignatureVerifier::SignatureAlgorithm::RSA_PSS_SHA256:
  74. // Not supported for this metric.
  75. break;
  76. }
  77. }
  78. }
  79. // This metric was previously named Crypto.TPMSupport but that expired,
  80. // so using a new name to avoid mixing up with old data.
  81. base::UmaHistogramEnumeration("Crypto.TPMSupport2", result);
  82. }));
  83. }
  84. #endif // BUILDFLAG(IS_WIN)
  85. namespace internal {
  86. void SetUnexportableKeyProviderForTesting(
  87. std::unique_ptr<UnexportableKeyProvider> (*func)()) {
  88. if (g_mock_provider) {
  89. // Nesting ScopedMockUnexportableSigningKeyForTesting is not supported.
  90. CHECK(!func);
  91. g_mock_provider = nullptr;
  92. } else {
  93. g_mock_provider = func;
  94. }
  95. }
  96. } // namespace internal
  97. } // namespace crypto