1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "crypto/symmetric_key.h" 6 7#include <nss.h> 8#include <pk11pub.h> 9 10#include "base/logging.h" 11#include "crypto/nss_util.h" 12 13namespace crypto { 14 15SymmetricKey::~SymmetricKey() {} 16 17// static 18SymmetricKey* SymmetricKey::GenerateRandomKey(Algorithm algorithm, 19 size_t key_size_in_bits) { 20 DCHECK_EQ(AES, algorithm); 21 22 EnsureNSSInit(); 23 if (key_size_in_bits == 0) 24 return NULL; 25 26 ScopedPK11Slot slot(PK11_GetInternalSlot()); 27 if (!slot.get()) 28 return NULL; 29 30 PK11SymKey* sym_key = PK11_KeyGen(slot.get(), CKM_AES_KEY_GEN, NULL, 31 key_size_in_bits / 8, NULL); 32 if (!sym_key) 33 return NULL; 34 35 return new SymmetricKey(sym_key); 36} 37 38// static 39SymmetricKey* SymmetricKey::DeriveKeyFromPassword(Algorithm algorithm, 40 const std::string& password, 41 const std::string& salt, 42 size_t iterations, 43 size_t key_size_in_bits) { 44 EnsureNSSInit(); 45 if (salt.empty() || iterations == 0 || key_size_in_bits == 0) 46 return NULL; 47 48 SECItem password_item; 49 password_item.type = siBuffer; 50 password_item.data = reinterpret_cast<unsigned char*>( 51 const_cast<char *>(password.data())); 52 password_item.len = password.size(); 53 54 SECItem salt_item; 55 salt_item.type = siBuffer; 56 salt_item.data = reinterpret_cast<unsigned char*>( 57 const_cast<char *>(salt.data())); 58 salt_item.len = salt.size(); 59 60 SECOidTag cipher_algorithm = 61 algorithm == AES ? SEC_OID_AES_256_CBC : SEC_OID_HMAC_SHA1; 62 ScopedSECAlgorithmID alg_id(PK11_CreatePBEV2AlgorithmID(SEC_OID_PKCS5_PBKDF2, 63 cipher_algorithm, 64 SEC_OID_HMAC_SHA1, 65 key_size_in_bits / 8, 66 iterations, 67 &salt_item)); 68 if (!alg_id.get()) 69 return NULL; 70 71 ScopedPK11Slot slot(PK11_GetInternalSlot()); 72 if (!slot.get()) 73 return NULL; 74 75 PK11SymKey* sym_key = PK11_PBEKeyGen(slot.get(), alg_id.get(), &password_item, 76 PR_FALSE, NULL); 77 if (!sym_key) 78 return NULL; 79 80 return new SymmetricKey(sym_key); 81} 82 83// static 84SymmetricKey* SymmetricKey::Import(Algorithm algorithm, 85 const std::string& raw_key) { 86 EnsureNSSInit(); 87 CK_MECHANISM_TYPE cipher = 88 algorithm == AES ? CKM_AES_CBC : CKM_SHA_1_HMAC; 89 90 SECItem key_item; 91 key_item.type = siBuffer; 92 key_item.data = reinterpret_cast<unsigned char*>( 93 const_cast<char *>(raw_key.data())); 94 key_item.len = raw_key.size(); 95 96 ScopedPK11Slot slot(PK11_GetInternalSlot()); 97 if (!slot.get()) 98 return NULL; 99 100 // The exact value of the |origin| argument doesn't matter to NSS as long as 101 // it's not PK11_OriginFortezzaHack, so we pass PK11_OriginUnwrap as a 102 // placeholder. 103 PK11SymKey* sym_key = PK11_ImportSymKey(slot.get(), cipher, PK11_OriginUnwrap, 104 CKA_ENCRYPT, &key_item, NULL); 105 if (!sym_key) 106 return NULL; 107 108 return new SymmetricKey(sym_key); 109} 110 111bool SymmetricKey::GetRawKey(std::string* raw_key) { 112 SECStatus rv = PK11_ExtractKeyValue(key_.get()); 113 if (SECSuccess != rv) 114 return false; 115 116 SECItem* key_item = PK11_GetKeyData(key_.get()); 117 if (!key_item) 118 return false; 119 120 raw_key->assign(reinterpret_cast<char*>(key_item->data), key_item->len); 121 return true; 122} 123 124#if defined(OS_CHROMEOS) 125// static 126SymmetricKey* SymmetricKey::CreateFromKey(PK11SymKey* key) { 127 return new SymmetricKey(key); 128} 129#endif 130 131SymmetricKey::SymmetricKey(PK11SymKey* key) : key_(key) { 132 DCHECK(key); 133} 134 135} // namespace crypto 136