ecdh.cc 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129
  1. // Copyright 2014 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stddef.h>
  5. #include <stdint.h>
  6. #include <memory>
  7. #include "base/containers/span.h"
  8. #include "components/webcrypto/algorithm_implementation.h"
  9. #include "components/webcrypto/algorithms/ec.h"
  10. #include "components/webcrypto/algorithms/util.h"
  11. #include "components/webcrypto/blink_key_handle.h"
  12. #include "components/webcrypto/generate_key_result.h"
  13. #include "components/webcrypto/status.h"
  14. #include "crypto/openssl_util.h"
  15. #include "crypto/secure_util.h"
  16. #include "third_party/blink/public/platform/web_crypto_algorithm_params.h"
  17. #include "third_party/blink/public/platform/web_crypto_key.h"
  18. #include "third_party/blink/public/platform/web_crypto_key_algorithm.h"
  19. #include "third_party/boringssl/src/include/openssl/ec.h"
  20. #include "third_party/boringssl/src/include/openssl/ecdh.h"
  21. #include "third_party/boringssl/src/include/openssl/evp.h"
  22. namespace webcrypto {
  23. namespace {
  24. // TODO(eroman): Support the "raw" format for ECDH key import + export, as
  25. // specified by WebCrypto spec.
  26. // TODO(eroman): Allow id-ecDH in SPKI and PKCS#8 import
  27. // (http://crbug.com/389400)
  28. class EcdhImplementation : public EcAlgorithm {
  29. public:
  30. EcdhImplementation()
  31. : EcAlgorithm(0,
  32. blink::kWebCryptoKeyUsageDeriveKey |
  33. blink::kWebCryptoKeyUsageDeriveBits) {}
  34. const char* GetJwkAlgorithm(
  35. const blink::WebCryptoNamedCurve curve) const override {
  36. // JWK import for ECDH does not enforce any required value for "alg".
  37. return "";
  38. }
  39. Status DeriveBits(const blink::WebCryptoAlgorithm& algorithm,
  40. const blink::WebCryptoKey& base_key,
  41. bool has_optional_length_bits,
  42. unsigned int optional_length_bits,
  43. std::vector<uint8_t>* derived_bytes) const override {
  44. if (base_key.GetType() != blink::kWebCryptoKeyTypePrivate)
  45. return Status::ErrorUnexpectedKeyType();
  46. // Verify the "publicKey" parameter. The only guarantee from Blink is that
  47. // it is a valid WebCryptoKey, but it could be any type.
  48. const blink::WebCryptoKey& public_key =
  49. algorithm.EcdhKeyDeriveParams()->PublicKey();
  50. if (public_key.GetType() != blink::kWebCryptoKeyTypePublic)
  51. return Status::ErrorEcdhPublicKeyWrongType();
  52. // Make sure it is an EC key.
  53. if (!public_key.Algorithm().EcParams())
  54. return Status::ErrorEcdhPublicKeyWrongType();
  55. // TODO(eroman): This is not described by the spec:
  56. // https://www.w3.org/Bugs/Public/show_bug.cgi?id=27404
  57. if (public_key.Algorithm().Id() != blink::kWebCryptoAlgorithmIdEcdh)
  58. return Status::ErrorEcdhPublicKeyWrongAlgorithm();
  59. // The public and private keys come from different key pairs, however their
  60. // curves must match.
  61. if (public_key.Algorithm().EcParams()->NamedCurve() !=
  62. base_key.Algorithm().EcParams()->NamedCurve()) {
  63. return Status::ErrorEcdhCurveMismatch();
  64. }
  65. EC_KEY* public_key_ec = EVP_PKEY_get0_EC_KEY(GetEVP_PKEY(public_key));
  66. const EC_POINT* public_key_point = EC_KEY_get0_public_key(public_key_ec);
  67. EC_KEY* private_key_ec = EVP_PKEY_get0_EC_KEY(GetEVP_PKEY(base_key));
  68. // The size of the shared secret is the field size in bytes (rounded up).
  69. // Note that, if rounding was required, the most significant bits of the
  70. // secret are zero. So for P-521, the maximum length is 528 bits, not 521.
  71. int field_size_bytes =
  72. NumBitsToBytes(EC_GROUP_get_degree(EC_KEY_get0_group(private_key_ec)));
  73. // If a desired key length was not specified, default to the field size
  74. // (rounded up to nearest byte).
  75. unsigned int length_bits =
  76. has_optional_length_bits ? optional_length_bits : field_size_bytes * 8;
  77. // Short-circuit when deriving an empty key.
  78. // TODO(eroman): ECDH_compute_key() is not happy when given a NULL output.
  79. // http://crbug.com/464194.
  80. if (length_bits == 0) {
  81. derived_bytes->clear();
  82. return Status::Success();
  83. }
  84. if (length_bits > static_cast<unsigned int>(field_size_bytes * 8))
  85. return Status::ErrorEcdhLengthTooBig(field_size_bytes * 8);
  86. // Resize to target length in bytes (BoringSSL can operate on a shorter
  87. // buffer than field_size_bytes).
  88. derived_bytes->resize(NumBitsToBytes(length_bits));
  89. int result = ECDH_compute_key(derived_bytes->data(), derived_bytes->size(),
  90. public_key_point, private_key_ec, nullptr);
  91. if (result < 0 || static_cast<size_t>(result) != derived_bytes->size())
  92. return Status::OperationError();
  93. TruncateToBitLength(length_bits, derived_bytes);
  94. return Status::Success();
  95. }
  96. };
  97. } // namespace
  98. std::unique_ptr<AlgorithmImplementation> CreateEcdhImplementation() {
  99. return std::make_unique<EcdhImplementation>();
  100. }
  101. } // namespace webcrypto