crypto: change ECSignatureCreator defaults to match SPDY.

crypto/ec_signature_creator_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/ec_signature_creator_impl.h"
 
 #include <cryptohi.h>
 #include <pk11pub.h>
 #include <secerr.h>
 #include <sechash.h>
@@ skipping 32 matching lines @@
   // Compute signature of hash.
   int signature_len = PK11_SignatureLen(key);
   std::vector<uint8> signature_data(signature_len);
   SECItem sig = {siBuffer, &signature_data[0],
                  static_cast<unsigned int>(signature_len)};
   rv = PK11_Sign(key, &sig, &hash);
   if (rv != SECSuccess)
     return rv;
 
   // DER encode the signature.
   return DSAU_EncodeDerSigWithLen(result, &sig, sig.len);

[wtc, 2012/09/12 22:06:27]

To be future-proof, we should store sig.len in a member
variable for use by DecodeSignature(). This avoids the
constant kP256ScalarBytes.

[agl, 2012/09/13 20:17:59]

Done.

 }
 
 }  // namespace
 
 ECSignatureCreatorImpl::ECSignatureCreatorImpl(ECPrivateKey* key)
     : key_(key) {
   EnsureNSSInit();
 }
 
 ECSignatureCreatorImpl::~ECSignatureCreatorImpl() {}
 
 bool ECSignatureCreatorImpl::Sign(const uint8* data,
                                   int data_len,
                                   std::vector<uint8>* signature) {
   // Data to be signed
   SECItem secret;
   secret.type = siBuffer;
   secret.len = data_len;
   secret.data = const_cast<unsigned char*>(data);
 
   // SECItem to receive the output buffer.
   SECItem result;
   result.type = siBuffer;
   result.len = 0;
   result.data = NULL;
 
   // Sign the secret data and save it to |result|.
   SECStatus rv =
-      SignData(&result, &secret, key_->key(), HASH_AlgSHA1);
+      SignData(&result, &secret, key_->key(), HASH_AlgSHA256);
   if (rv != SECSuccess) {
     DLOG(ERROR) << "DerSignData: " << PORT_GetError();
     return false;
   }
 
   // Copy the signed data into the output vector.
   signature->assign(result.data, result.data + result.len);
   SECITEM_FreeItem(&result, PR_FALSE /* only free |result.data| */);
   return true;
 }
 
+bool ECSignatureCreatorImpl::DecodeSignature(const std::vector<uint8>& der_sig,
+                                             std::string* out_raw_sig) {
+  SECItem der_sig_item;
+  der_sig_item.type = siBuffer;
+  der_sig_item.len = der_sig.size();
+  der_sig_item.data = const_cast<uint8*>(der_sig.data());
+
+  static const int kP256ScalarBytes = 32;
+  SECItem* raw_sig = DSAU_DecodeDerSigToLen(&der_sig_item, 2*kP256ScalarBytes);
+  if (!raw_sig)
+    return false;
+  out_raw_sig->assign(reinterpret_cast<char*>(raw_sig->data), raw_sig->len);
+  SECITEM_FreeItem(raw_sig, PR_TRUE /* free SECItem structure itself. */);
+  return true;
+}
+
 }  // namespace crypto