1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include <secerr.h>
6
7#include "base/numerics/safe_math.h"
8#include "content/child/webcrypto/crypto_data.h"
9#include "content/child/webcrypto/nss/aes_key_nss.h"
10#include "content/child/webcrypto/nss/key_nss.h"
11#include "content/child/webcrypto/nss/sym_key_nss.h"
12#include "content/child/webcrypto/nss/util_nss.h"
13#include "content/child/webcrypto/status.h"
14#include "content/child/webcrypto/webcrypto_util.h"
15#include "crypto/scoped_nss_types.h"
16#include "third_party/WebKit/public/platform/WebCryptoAlgorithmParams.h"
17#include "third_party/WebKit/public/platform/WebCryptoKeyAlgorithm.h"
18
19namespace content {
20
21namespace webcrypto {
22
23namespace {
24
25// The Default IV for AES-KW. See http://www.ietf.org/rfc/rfc3394.txt
26// Section 2.2.3.1.
27const unsigned char kAesIv[] = {0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6};
28
29// The result of unwrapping is a SymKey rather than a buffer. This is a
30// consequence of how NSS exposes AES-KW. Subsequent code can extract the value
31// of the sym key to interpret it as key bytes in another format.
32Status DoUnwrapSymKeyAesKw(const CryptoData& wrapped_key_data,
33                           PK11SymKey* wrapping_key,
34                           CK_MECHANISM_TYPE mechanism,
35                           CK_FLAGS flags,
36                           crypto::ScopedPK11SymKey* unwrapped_key) {
37  DCHECK_GE(wrapped_key_data.byte_length(), 24u);
38  DCHECK_EQ(wrapped_key_data.byte_length() % 8, 0u);
39
40  SECItem iv_item = MakeSECItemForBuffer(CryptoData(kAesIv, sizeof(kAesIv)));
41  crypto::ScopedSECItem param_item(
42      PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item));
43  if (!param_item)
44    return Status::ErrorUnexpected();
45
46  SECItem cipher_text = MakeSECItemForBuffer(wrapped_key_data);
47
48  // The plaintext length is always 64 bits less than the data size.
49  const unsigned int plaintext_length = wrapped_key_data.byte_length() - 8;
50
51#if defined(USE_NSS)
52  // Part of workaround for
53  // https://bugzilla.mozilla.org/show_bug.cgi?id=981170. See the explanation
54  // later in this function.
55  PORT_SetError(0);
56#endif
57
58  crypto::ScopedPK11SymKey new_key(
59      PK11_UnwrapSymKeyWithFlags(wrapping_key,
60                                 CKM_NSS_AES_KEY_WRAP,
61                                 param_item.get(),
62                                 &cipher_text,
63                                 mechanism,
64                                 CKA_FLAGS_ONLY,
65                                 plaintext_length,
66                                 flags));
67
68  // TODO(padolph): Use NSS PORT_GetError() and friends to report a more
69  // accurate error, providing if doesn't leak any information to web pages
70  // about other web crypto users, key details, etc.
71  if (!new_key)
72    return Status::OperationError();
73
74#if defined(USE_NSS)
75  // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=981170
76  // which was fixed in NSS 3.16.0.
77  // If unwrap fails, NSS nevertheless returns a valid-looking PK11SymKey,
78  // with a reasonable length but with key data pointing to uninitialized
79  // memory.
80  // To understand this workaround see the fix for 981170:
81  // https://hg.mozilla.org/projects/nss/rev/753bb69e543c
82  if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA)
83    return Status::OperationError();
84#endif
85
86  *unwrapped_key = new_key.Pass();
87  return Status::Success();
88}
89
90Status WrapSymKeyAesKw(PK11SymKey* key,
91                       PK11SymKey* wrapping_key,
92                       std::vector<uint8_t>* buffer) {
93  // The data size must be at least 16 bytes and a multiple of 8 bytes.
94  // RFC 3394 does not specify a maximum allowed data length, but since only
95  // keys are being wrapped in this application (which are small), a reasonable
96  // max limit is whatever will fit into an unsigned. For the max size test,
97  // note that AES Key Wrap always adds 8 bytes to the input data size.
98  const unsigned int input_length = PK11_GetKeyLength(key);
99  DCHECK_GE(input_length, 16u);
100  DCHECK((input_length % 8) == 0);
101
102  SECItem iv_item = MakeSECItemForBuffer(CryptoData(kAesIv, sizeof(kAesIv)));
103  crypto::ScopedSECItem param_item(
104      PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item));
105  if (!param_item)
106    return Status::ErrorUnexpected();
107
108  base::CheckedNumeric<unsigned int> output_length = input_length;
109  output_length += 8;
110  if (!output_length.IsValid())
111    return Status::ErrorDataTooLarge();
112
113  buffer->resize(output_length.ValueOrDie());
114  SECItem wrapped_key_item = MakeSECItemForBuffer(CryptoData(*buffer));
115
116  if (SECSuccess != PK11_WrapSymKey(CKM_NSS_AES_KEY_WRAP,
117                                    param_item.get(),
118                                    wrapping_key,
119                                    key,
120                                    &wrapped_key_item)) {
121    return Status::OperationError();
122  }
123  if (output_length.ValueOrDie() != wrapped_key_item.len)
124    return Status::ErrorUnexpected();
125
126  return Status::Success();
127}
128
129class AesKwCryptoAlgorithmNss : public AesAlgorithm {
130 public:
131  AesKwCryptoAlgorithmNss()
132      : AesAlgorithm(
133            CKM_NSS_AES_KEY_WRAP,
134            CKF_WRAP | CKF_WRAP,
135            blink::WebCryptoKeyUsageWrapKey | blink::WebCryptoKeyUsageUnwrapKey,
136            "KW") {}
137
138  virtual Status Encrypt(const blink::WebCryptoAlgorithm& algorithm,
139                         const blink::WebCryptoKey& wrapping_key,
140                         const CryptoData& data,
141                         std::vector<uint8_t>* buffer) const OVERRIDE {
142    if (data.byte_length() < 16)
143      return Status::ErrorDataTooSmall();
144    if (data.byte_length() % 8)
145      return Status::ErrorInvalidAesKwDataLength();
146
147    // Due to limitations in the NSS API for the AES-KW algorithm, |data| must
148    // be temporarily viewed as a symmetric key to be wrapped (encrypted).
149    SECItem data_item = MakeSECItemForBuffer(data);
150    crypto::ScopedPK11Slot slot(PK11_GetInternalSlot());
151    crypto::ScopedPK11SymKey data_as_sym_key(
152        PK11_ImportSymKey(slot.get(),
153                          CKK_GENERIC_SECRET,
154                          PK11_OriginUnwrap,
155                          CKA_SIGN,
156                          &data_item,
157                          NULL));
158    if (!data_as_sym_key)
159      return Status::OperationError();
160
161    return WrapSymKeyAesKw(
162        data_as_sym_key.get(), SymKeyNss::Cast(wrapping_key)->key(), buffer);
163  }
164
165  virtual Status Decrypt(const blink::WebCryptoAlgorithm& algorithm,
166                         const blink::WebCryptoKey& wrapping_key,
167                         const CryptoData& data,
168                         std::vector<uint8_t>* buffer) const OVERRIDE {
169    if (data.byte_length() < 24)
170      return Status::ErrorDataTooSmall();
171    if (data.byte_length() % 8)
172      return Status::ErrorInvalidAesKwDataLength();
173
174    // Due to limitations in the NSS API for the AES-KW algorithm, |data| must
175    // be temporarily viewed as a symmetric key to be unwrapped (decrypted).
176    crypto::ScopedPK11SymKey decrypted;
177    Status status = DoUnwrapSymKeyAesKw(data,
178                                        SymKeyNss::Cast(wrapping_key)->key(),
179                                        CKK_GENERIC_SECRET,
180                                        0,
181                                        &decrypted);
182    if (status.IsError())
183      return status;
184
185    // Once the decrypt is complete, extract the resultant raw bytes from NSS
186    // and return them to the caller.
187    if (PK11_ExtractKeyValue(decrypted.get()) != SECSuccess)
188      return Status::OperationError();
189    const SECItem* const key_data = PK11_GetKeyData(decrypted.get());
190    if (!key_data)
191      return Status::OperationError();
192    buffer->assign(key_data->data, key_data->data + key_data->len);
193
194    return Status::Success();
195  }
196};
197
198}  // namespace
199
200AlgorithmImplementation* CreatePlatformAesKwImplementation() {
201  return new AesKwCryptoAlgorithmNss;
202}
203
204}  // namespace webcrypto
205
206}  // namespace content
207