crypto: change ECSignatureCreator defaults to match SPDY.

crypto/ec_signature_creator_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/ec_signature_creator.h"
 
 #include <string>
 #include <vector>
 
+#if !defined(USE_OPENSSL)
+#include <cryptohi.h>
+#include <secerr.h>
+#endif
+
 #include "base/memory/scoped_ptr.h"
 #include "crypto/ec_private_key.h"
 #include "crypto/signature_verifier.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if defined(USE_OPENSSL)
 // Once ECSignatureCreator is implemented for OpenSSL, remove this #if block.
 // TODO(rch): When that happens, also add some exported keys from each to
 // test interop between NSS and OpenSSL.
 TEST(ECSignatureCreatorTest, OpenSSLStub) {
@@ skipping 26 matching lines @@
 
   std::string data("Hello, World!");
   std::vector<uint8> signature;
   ASSERT_TRUE(signer->Sign(reinterpret_cast<const uint8*>(data.c_str()),
                            data.size(),
                            &signature));
 
   std::vector<uint8> public_key_info;
   ASSERT_TRUE(key_original->ExportPublicKey(&public_key_info));
 
-  // This is the algorithm ID for SHA-1 with EC encryption.
-  const uint8 kECDSAWithSHA1AlgorithmID[] = {
-    0x30, 0x0b,
-      0x06, 0x07,
-        0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x01,
+  // This is the algorithm ID for SHA-256 with EC encryption.
+  const uint8 kECDSAWithSHA256AlgorithmID[] = {
+    0x30, 0x0c,
+      0x06, 0x08,
+        0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02,
       0x05, 0x00
   };
+
+  // SignatureVerifier expects the signatures to be DER encoded.

[Ryan Sleevi, 2012/09/12 17:55:22]

Shouldn't we also be fixing this to match?

[agl, 2012/09/12 18:51:48]

The SignatureVerifier is used elsewhere too, and it takes a generic "signature"
(RSA, ECDSA etc). I think it's more reasonable to use ASN.1 at a generic
interface.

+  SECItem der_signature;
+  SECItem sig;
+  sig.type = siBuffer;
+  sig.len = signature.size();
+  sig.data = signature.data();
+  SECStatus rv = DSAU_EncodeDerSigWithLen(&der_signature, &sig, sig.len);
+  ASSERT_EQ(SECSuccess, rv);
+
   crypto::SignatureVerifier verifier;
   ASSERT_TRUE(verifier.VerifyInit(
-      kECDSAWithSHA1AlgorithmID, sizeof(kECDSAWithSHA1AlgorithmID),
-      &signature.front(), signature.size(),
+      kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID),
+      der_signature.data, der_signature.len,
       &public_key_info.front(), public_key_info.size()));
 
+  SECITEM_FreeItem(&der_signature,
+                   PR_FALSE /* don't free der_signature itself */);
+
   verifier.VerifyUpdate(reinterpret_cast<const uint8*>(data.c_str()),
                         data.size());
   ASSERT_TRUE(verifier.VerifyFinal());
 }
 #endif  // !defined(USE_OPENSSL)