os_crypt_posix.cc 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158
  1. // Copyright 2014 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "components/os_crypt/os_crypt.h"
  5. #include <stddef.h>
  6. #include <memory>
  7. #include "base/check.h"
  8. #include "base/strings/string_util.h"
  9. #include "base/strings/utf_string_conversions.h"
  10. #include "crypto/encryptor.h"
  11. #include "crypto/symmetric_key.h"
  12. namespace {
  13. // Salt for Symmetric key derivation.
  14. constexpr char kSalt[] = "saltysalt";
  15. // Key size required for 128 bit AES.
  16. constexpr size_t kDerivedKeySizeInBits = 128;
  17. // Constant for Symmetric key derivation.
  18. constexpr size_t kEncryptionIterations = 1;
  19. // Size of initialization vector for AES 128-bit.
  20. constexpr size_t kIVBlockSizeAES128 = 16;
  21. // Prefix for cypher text returned by obfuscation version. We prefix the
  22. // cyphertext with this string so that future data migration can detect
  23. // this and migrate to full encryption without data loss.
  24. constexpr char kObfuscationPrefix[] = "v10";
  25. // Generates a newly allocated SymmetricKey object based a hard-coded password.
  26. // Ownership of the key is passed to the caller. Returns NULL key if a key
  27. // generation error occurs.
  28. crypto::SymmetricKey* GetEncryptionKey() {
  29. // We currently "obfuscate" by encrypting and decrypting with hard-coded
  30. // password. We need to improve this password situation by moving a secure
  31. // password into a system-level key store.
  32. // http://crbug.com/25404 and http://crbug.com/49115
  33. const std::string password = "peanuts";
  34. const std::string salt(kSalt);
  35. // Create an encryption key from our password and salt.
  36. std::unique_ptr<crypto::SymmetricKey> encryption_key(
  37. crypto::SymmetricKey::DeriveKeyFromPasswordUsingPbkdf2(
  38. crypto::SymmetricKey::AES, password, salt, kEncryptionIterations,
  39. kDerivedKeySizeInBits));
  40. DCHECK(encryption_key.get());
  41. return encryption_key.release();
  42. }
  43. } // namespace
  44. bool OSCrypt::EncryptString16(const std::u16string& plaintext,
  45. std::string* ciphertext) {
  46. return EncryptString(base::UTF16ToUTF8(plaintext), ciphertext);
  47. }
  48. bool OSCrypt::DecryptString16(const std::string& ciphertext,
  49. std::u16string* plaintext) {
  50. std::string utf8;
  51. if (!DecryptString(ciphertext, &utf8))
  52. return false;
  53. *plaintext = base::UTF8ToUTF16(utf8);
  54. return true;
  55. }
  56. bool OSCrypt::EncryptString(const std::string& plaintext,
  57. std::string* ciphertext) {
  58. // This currently "obfuscates" by encrypting with hard-coded password.
  59. // We need to improve this password situation by moving a secure password
  60. // into a system-level key store.
  61. // http://crbug.com/25404 and http://crbug.com/49115
  62. if (plaintext.empty()) {
  63. *ciphertext = std::string();
  64. return true;
  65. }
  66. std::unique_ptr<crypto::SymmetricKey> encryption_key(GetEncryptionKey());
  67. if (!encryption_key.get())
  68. return false;
  69. const std::string iv(kIVBlockSizeAES128, ' ');
  70. crypto::Encryptor encryptor;
  71. if (!encryptor.Init(encryption_key.get(), crypto::Encryptor::CBC, iv))
  72. return false;
  73. if (!encryptor.Encrypt(plaintext, ciphertext))
  74. return false;
  75. // Prefix the cypher text with version information.
  76. ciphertext->insert(0, kObfuscationPrefix);
  77. return true;
  78. }
  79. bool OSCrypt::DecryptString(const std::string& ciphertext,
  80. std::string* plaintext) {
  81. // This currently "obfuscates" by encrypting with hard-coded password.
  82. // We need to improve this password situation by moving a secure password
  83. // into a system-level key store.
  84. // http://crbug.com/25404 and http://crbug.com/49115
  85. if (ciphertext.empty()) {
  86. *plaintext = std::string();
  87. return true;
  88. }
  89. // Check that the incoming cyphertext was indeed encrypted with the expected
  90. // version. If the prefix is not found then we'll assume we're dealing with
  91. // old data saved as clear text and we'll return it directly.
  92. // Credit card numbers are current legacy data, so false match with prefix
  93. // won't happen.
  94. if (!base::StartsWith(ciphertext, kObfuscationPrefix,
  95. base::CompareCase::SENSITIVE)) {
  96. *plaintext = ciphertext;
  97. return true;
  98. }
  99. // Strip off the versioning prefix before decrypting.
  100. const std::string raw_ciphertext =
  101. ciphertext.substr(strlen(kObfuscationPrefix));
  102. std::unique_ptr<crypto::SymmetricKey> encryption_key(GetEncryptionKey());
  103. if (!encryption_key.get())
  104. return false;
  105. const std::string iv(kIVBlockSizeAES128, ' ');
  106. crypto::Encryptor encryptor;
  107. if (!encryptor.Init(encryption_key.get(), crypto::Encryptor::CBC, iv))
  108. return false;
  109. if (!encryptor.Decrypt(raw_ciphertext, plaintext))
  110. return false;
  111. return true;
  112. }
  113. // static
  114. bool OSCrypt::IsEncryptionAvailable() {
  115. return false;
  116. }
  117. // static
  118. void OSCrypt::SetRawEncryptionKey(const std::string& raw_key) {
  119. DCHECK(raw_key.empty());
  120. }
  121. // static
  122. std::string OSCrypt::GetRawEncryptionKey() {
  123. return "";
  124. }