ct_log_verifier.h 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_CT_LOG_VERIFIER_H_
  5. #define NET_CERT_CT_LOG_VERIFIER_H_
  6. #include <string>
  7. #include "base/gtest_prod_util.h"
  8. #include "base/memory/raw_ptr.h"
  9. #include "base/memory/ref_counted.h"
  10. #include "base/strings/string_piece.h"
  11. #include "net/base/net_export.h"
  12. #include "net/cert/signed_certificate_timestamp.h"
  13. #include "third_party/boringssl/src/include/openssl/base.h"
  14. namespace net {
  15. namespace ct {
  16. struct MerkleAuditProof;
  17. struct MerkleConsistencyProof;
  18. struct SignedTreeHead;
  19. } // namespace ct
  20. // Class for verifying signatures of a single Certificate Transparency
  21. // log, whose identity is provided during construction.
  22. // Currently can verify Signed Certificate Timestamp (SCT) and Signed
  23. // Tree Head (STH) signatures.
  24. // Immutable: Does not hold any state beyond the log information it was
  25. // initialized with.
  26. class NET_EXPORT CTLogVerifier
  27. : public base::RefCountedThreadSafe<CTLogVerifier> {
  28. public:
  29. // Creates a new CTLogVerifier that will verify SignedCertificateTimestamps
  30. // using |public_key|, which is a DER-encoded SubjectPublicKeyInfo.
  31. // If |public_key| refers to an unsupported public key, returns NULL.
  32. // |description| is a textual description of the log.
  33. static scoped_refptr<const CTLogVerifier> Create(
  34. const base::StringPiece& public_key,
  35. std::string description);
  36. // Returns the log's key ID (RFC6962, Section 3.2)
  37. const std::string& key_id() const { return key_id_; }
  38. // Returns the log's human-readable description.
  39. const std::string& description() const { return description_; }
  40. // Verifies that |sct| is valid for |entry| and was signed by this log.
  41. bool Verify(const ct::SignedEntryData& entry,
  42. const ct::SignedCertificateTimestamp& sct) const;
  43. // Verifies that |signed_tree_head| is a valid Signed Tree Head (RFC 6962,
  44. // Section 3.5) for this log.
  45. bool VerifySignedTreeHead(const ct::SignedTreeHead& signed_tree_head) const;
  46. // Verifies that |proof| is a valid consistency proof (RFC 6962, Section
  47. // 2.1.2) for this log, and which proves that |old_tree_hash| has
  48. // been fully incorporated into the Merkle tree represented by
  49. // |new_tree_hash|.
  50. bool VerifyConsistencyProof(const ct::MerkleConsistencyProof& proof,
  51. const std::string& old_tree_hash,
  52. const std::string& new_tree_hash) const;
  53. // Verifies that |proof| is a valid audit proof (RFC 6962, Section 2.1.1) for
  54. // this log, and which proves that the certificate represented by |leaf_hash|
  55. // has been incorporated into the Merkle tree represented by |root_hash|.
  56. // Returns true if verification succeeds, false otherwise.
  57. bool VerifyAuditProof(const ct::MerkleAuditProof& proof,
  58. const std::string& root_hash,
  59. const std::string& leaf_hash) const;
  60. private:
  61. FRIEND_TEST_ALL_PREFIXES(CTLogVerifierTest, VerifySignature);
  62. friend class base::RefCountedThreadSafe<CTLogVerifier>;
  63. explicit CTLogVerifier(std::string description);
  64. ~CTLogVerifier();
  65. // Performs crypto-library specific initialization.
  66. bool Init(const base::StringPiece& public_key);
  67. // Performs the underlying verification using the selected public key. Note
  68. // that |signature| contains the raw signature data (eg: without any
  69. // DigitallySigned struct encoding).
  70. bool VerifySignature(const base::StringPiece& data_to_sign,
  71. const base::StringPiece& signature) const;
  72. // Returns true if the signature and hash algorithms in |signature|
  73. // match those of the log
  74. bool SignatureParametersMatch(const ct::DigitallySigned& signature) const;
  75. std::string key_id_;
  76. std::string description_;
  77. ct::DigitallySigned::HashAlgorithm hash_algorithm_ =
  78. ct::DigitallySigned::HASH_ALGO_NONE;
  79. ct::DigitallySigned::SignatureAlgorithm signature_algorithm_ =
  80. ct::DigitallySigned::SIG_ALGO_ANONYMOUS;
  81. raw_ptr<EVP_PKEY> public_key_ = nullptr;
  82. };
  83. } // namespace net
  84. #endif // NET_CERT_CT_LOG_VERIFIER_H_