cryptographer_impl.h 4.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_SYNC_NIGORI_CRYPTOGRAPHER_IMPL_H_
  5. #define COMPONENTS_SYNC_NIGORI_CRYPTOGRAPHER_IMPL_H_
  6. #include <memory>
  7. #include <string>
  8. #include "components/sync/engine/nigori/cryptographer.h"
  9. #include "components/sync/engine/nigori/key_derivation_params.h"
  10. #include "components/sync/engine/nigori/nigori.h"
  11. #include "components/sync/nigori/nigori_key_bag.h"
  12. #include "components/sync/protocol/nigori_local_data.pb.h"
  13. namespace sync_pb {
  14. class CryptographerData;
  15. } // namespace sync_pb
  16. namespace syncer {
  17. // This class manages the Nigori objects used to encrypt and decrypt sensitive
  18. // sync data (eg. passwords). Each Nigori object knows how to handle data
  19. // protected with a particular encryption key.
  20. //
  21. // The implementation consists of a keybag representing all known keys and
  22. // optionally the notion of a default encryption key which, if it exists, is
  23. // present in the keybag.
  24. class CryptographerImpl : public Cryptographer {
  25. public:
  26. // Factory methods.
  27. static std::unique_ptr<CryptographerImpl> CreateEmpty();
  28. static std::unique_ptr<CryptographerImpl> FromSingleKeyForTesting(
  29. const std::string& passphrase,
  30. const KeyDerivationParams& derivation_params =
  31. KeyDerivationParams::CreateForPbkdf2());
  32. // Returns null in case of error (e.g. default key not present in keybag).
  33. static std::unique_ptr<CryptographerImpl> FromProto(
  34. const sync_pb::CryptographerData& proto);
  35. CryptographerImpl& operator=(const CryptographerImpl&) = delete;
  36. ~CryptographerImpl() override;
  37. // Serialization.
  38. sync_pb::CryptographerData ToProto() const;
  39. // Creates and registers a new key after deriving Nigori keys. Returns the
  40. // name of the key, or an empty string in case of error. Note that emplacing
  41. // an already-known key is not considered an error (just a no-op).
  42. //
  43. // Does NOT set or change the default encryption key.
  44. std::string EmplaceKey(const std::string& passphrase,
  45. const KeyDerivationParams& derivation_params);
  46. // Adds all keys from |key_bag| that weren't previously known.
  47. //
  48. // Does NOT set or change the default encryption key.
  49. void EmplaceKeysFrom(const NigoriKeyBag& key_bag);
  50. // Sets or changes the default encryption key, which causes CanEncrypt() to
  51. // return true. |key_name| must not be empty and must represent a known key.
  52. void SelectDefaultEncryptionKey(const std::string& key_name);
  53. // Adds all keys in |other| that weren't previously known, and selects the
  54. // same default key. |other| must have selected a default key.
  55. void EmplaceKeysAndSelectDefaultKeyFrom(const CryptographerImpl& other);
  56. // Clears the default encryption key, which causes CanEncrypt() to return
  57. // false.
  58. void ClearDefaultEncryptionKey();
  59. // Reverts the cryptographer to an empty one, i.e. what would be returned by
  60. // CreateEmpty(). The default key is also cleared.
  61. // The set of known encryption keys shouldn't decrease in general, since this
  62. // may lead to data becoming undecryptable. This method can be called a) if
  63. // sync is disabled, or b) if sync finds an error that can be solved by
  64. // resetting the encryption state.
  65. void ClearAllKeys();
  66. // Determines whether |key_name| represents a known key.
  67. bool HasKey(const std::string& key_name) const;
  68. // Returns a proto representation of the default encryption key. |*this| must
  69. // have a default encryption key set, as reflected by CanEncrypt().
  70. sync_pb::NigoriKey ExportDefaultKey() const;
  71. std::unique_ptr<CryptographerImpl> Clone() const;
  72. size_t KeyBagSizeForTesting() const;
  73. // Cryptographer overrides.
  74. bool CanEncrypt() const override;
  75. bool CanDecrypt(const sync_pb::EncryptedData& encrypted) const override;
  76. std::string GetDefaultEncryptionKeyName() const override;
  77. bool EncryptString(const std::string& decrypted,
  78. sync_pb::EncryptedData* encrypted) const override;
  79. bool DecryptToString(const sync_pb::EncryptedData& encrypted,
  80. std::string* decrypted) const override;
  81. private:
  82. CryptographerImpl(NigoriKeyBag key_bag,
  83. std::string default_encryption_key_name);
  84. // The actual keys we know about.
  85. NigoriKeyBag key_bag_;
  86. // The key name associated with the default encryption key. If non-empty, it
  87. // must correspond to a key within |key_bag_|. May be empty even if |key_bag_|
  88. // is not.
  89. std::string default_encryption_key_name_;
  90. };
  91. } // namespace syncer
  92. #endif // COMPONENTS_SYNC_NIGORI_CRYPTOGRAPHER_IMPL_H_