Add device-level token entryption to CertLibrary.

chrome/browser/chromeos/cros/cert_library.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/cert_library.h"
 
 #include <algorithm>
 
 #include "base/chromeos/chromeos_version.h"
 #include "base/command_line.h"
@@ skipping 29 matching lines @@
 namespace {
 
 // Root CA certificates that are built into Chrome use this token name.
 const char kRootCertificateTokenName[] = "Builtin Object Token";
 
 // Delay between certificate requests while waiting for TPM/PKCS#11 init.
 const int kRequestDelayMs = 500;
 
 const size_t kKeySize = 16;
 
-// Decrypts (AES) hex encoded encrypted token given |key| and |salt|.
-std::string DecryptTokenWithKey(
-    crypto::SymmetricKey* key,
-    const std::string& salt,
-    const std::string& encrypted_token_hex) {
-  std::vector<uint8> encrypted_token_bytes;
-  if (!base::HexStringToBytes(encrypted_token_hex, &encrypted_token_bytes)) {
-    LOG(WARNING) << "Corrupt encrypted token found.";
-    return std::string();
-  }
-
-  std::string encrypted_token(
-      reinterpret_cast<char*>(encrypted_token_bytes.data()),
-      encrypted_token_bytes.size());
-  crypto::Encryptor encryptor;
-  if (!encryptor.Init(key, crypto::Encryptor::CTR, std::string())) {
-    LOG(WARNING) << "Failed to initialize Encryptor.";
-    return std::string();
-  }
-
-  std::string nonce = salt.substr(0, kKeySize);
-  std::string token;
-  CHECK(encryptor.SetCounter(nonce));
-  if (!encryptor.Decrypt(encrypted_token, &token)) {
-    LOG(WARNING) << "Failed to decrypt token.";
-    return std::string();
-  }
-  return token;
-}
-
 string16 GetDisplayString(net::X509Certificate* cert, bool hardware_backed) {
   std::string org;
   if (!cert->subject().organization_names.empty())
     org = cert->subject().organization_names[0];
   if (org.empty())
     org = cert->subject().GetDisplayName();
   string16 issued_by = UTF8ToUTF16(
       x509_certificate_model::GetIssuerCommonName(cert->os_cert_handle(),
                                                   org));  // alternative text
   string16 issued_to = UTF8ToUTF16(
@@ skipping 99 matching lines @@
   virtual const CertList& GetServerCertificates() const OVERRIDE {
     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
     return server_certs_;
   }
 
   virtual const CertList& GetCACertificates() const OVERRIDE {
     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
     return server_ca_certs_;
   }
 
-  virtual std::string EncryptToken(const std::string& token) OVERRIDE {
+  virtual crypto::SymmetricKey* PassphraseToKey(const std::string& passprhase,
+                                                const std::string& salt) {
+    return crypto::SymmetricKey::DeriveKeyFromPassword(
+        crypto::SymmetricKey::AES, passprhase, salt, 1000, 256);
+  }
+
+  virtual std::string EncryptWithSystemSalt(const std::string& token) OVERRIDE {
     // Don't care about token encryption while debugging.
     if (!base::chromeos::IsRunningOnChromeOS())
       return token;
+
+    if (!LoadSystemSaltKey()) {
+      LOG(WARNING) << "System salt key is not available for encrypt.";
+      return std::string();
+    }
+    return EncryptTokenWithKey(
+        system_salt_key_.get(),
+        CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt(),
+        token);
+  }
+
+  virtual std::string EncryptWithUserKey(const std::string& token) OVERRIDE {
+    // Don't care about token encryption while debugging.
+    if (!base::chromeos::IsRunningOnChromeOS())
+      return token;
 
     if (!LoadSupplementalUserKey()) {
       LOG(WARNING) << "Supplemental user key is not available for encrypt.";
       return std::string();
     }
+    return EncryptTokenWithKey(
+        supplemental_user_key_.get(),
+        CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt(),
+        token);
+  }
+
+  // Encrypts (AES) the token given |key| and |salt|.
+  virtual std::string EncryptTokenWithKey(crypto::SymmetricKey* key,
+                                          const std::string& salt,
+                                          const std::string& token) {
     crypto::Encryptor encryptor;
-    if (!encryptor.Init(supplemental_user_key_.get(), crypto::Encryptor::CTR,
-                        std::string())) {
+    if (!encryptor.Init(key, crypto::Encryptor::CTR, std::string())) {
       LOG(WARNING) << "Failed to initialize Encryptor.";
       return std::string();
     }
-    std::string salt =
-        CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt();
     std::string nonce = salt.substr(0, kKeySize);
     std::string encoded_token;
     CHECK(encryptor.SetCounter(nonce));
     if (!encryptor.Encrypt(token, &encoded_token)) {
       LOG(WARNING) << "Failed to encrypt token.";
       return std::string();
     }
 
     return StringToLowerASCII(base::HexEncode(
         reinterpret_cast<const void*>(encoded_token.data()),
         encoded_token.size()));
   }
 
-  virtual std::string DecryptToken(
+  virtual std::string DecryptWithSystemSalt(
       const std::string& encrypted_token_hex) OVERRIDE {
     // Don't care about token encryption while debugging.
     if (!base::chromeos::IsRunningOnChromeOS())
+      return encrypted_token_hex;
+
+    if (!LoadSystemSaltKey()) {
+      LOG(WARNING) << "System salt key is not available for decrypt.";
+      return std::string();
+    }
+    return DecryptTokenWithKey(
+        system_salt_key_.get(),
+        CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt(),
+        encrypted_token_hex);
+  }
+
+  virtual std::string DecryptWithUserKey(
+      const std::string& encrypted_token_hex) OVERRIDE {
+    // Don't care about token encryption while debugging.
+    if (!base::chromeos::IsRunningOnChromeOS())
       return encrypted_token_hex;
 
     if (!LoadSupplementalUserKey()) {
       LOG(WARNING) << "Supplemental user key is not available for decrypt.";
       return std::string();
     }
-    return DecryptTokenWithKey(supplemental_user_key_.get(),
+    return DecryptTokenWithKey(
+        supplemental_user_key_.get(),
         CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt(),
         encrypted_token_hex);
   }
 
+  // Decrypts (AES) hex encoded encrypted token given |key| and |salt|.
+  virtual std::string DecryptTokenWithKey(
+      crypto::SymmetricKey* key,
+      const std::string& salt,
+      const std::string& encrypted_token_hex) {
+    std::vector<uint8> encrypted_token_bytes;
+    if (!base::HexStringToBytes(encrypted_token_hex, &encrypted_token_bytes)) {
+      LOG(WARNING) << "Corrupt encrypted token found.";
+      return std::string();
+    }
+
+    std::string encrypted_token(
+        reinterpret_cast<char*>(encrypted_token_bytes.data()),
+        encrypted_token_bytes.size());
+    crypto::Encryptor encryptor;
+    if (!encryptor.Init(key, crypto::Encryptor::CTR, std::string())) {
+      LOG(WARNING) << "Failed to initialize Encryptor.";
+      return std::string();
+    }
+
+    std::string nonce = salt.substr(0, kKeySize);
+    std::string token;
+    CHECK(encryptor.SetCounter(nonce));
+    if (!encryptor.Decrypt(encrypted_token, &token)) {
+      LOG(WARNING) << "Failed to decrypt token.";
+      return std::string();
+    }
+    return token;
+  }
+
   // net::CertDatabase::Observer implementation. Observer added on UI thread.
   virtual void OnCertTrustChanged(const net::X509Certificate* cert) OVERRIDE {
     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   }
 
   virtual void OnCertAdded(const net::X509Certificate* cert) OVERRIDE {
     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
     // Only load certificates if we have completed an initial request.
     if (certificates_loaded_) {
       BrowserThread::PostTask(
@@ skipping 129 matching lines @@
       // Set 'loaded' to true for the UI, since we are not waiting on loading.
       LOG(WARNING) << "Requesting supplemental use key before login.";
       return false;
     }
     if (!supplemental_user_key_.get()) {
       supplemental_user_key_.reset(crypto::GetSupplementalUserKey());
     }
     return supplemental_user_key_.get() != NULL;
   }
 
+  // TODO: should this use the system salt for both the password and the salt
+  // value, or should this use a separate salt value?
+  bool LoadSystemSaltKey() {
+    if (!system_salt_key_.get()) {
+      system_salt_key_.reset(PassphraseToKey(
+        CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt(),
+        CrosLibrary::Get()->GetCryptohomeLibrary()->GetSystemSalt()));
+    }
+    return system_salt_key_.get() != NULL;
+  }
+
   // Call this to start the certificate list initialization process.
   // Must be called from the UI thread.
   void RequestCertificates() {
     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
     certificates_requested_ = true;
 
     if (!UserManager::Get()->IsUserLoggedIn()) {
       // If we are not logged in, we cannot load any certificates.
       // Set 'loaded' to true for the UI, since we are not waiting on loading.
@@ skipping 107 matching lines @@
 
   // Cached TPM token name.
   std::string tpm_token_name_;
 
   // Cached TPM user pin.
   std::string tpm_user_pin_;
 
   // Supplemental user key.
   scoped_ptr<crypto::SymmetricKey> supplemental_user_key_;
 
+  // A key based on the system salt.  Useful for encrypting device-level
+  // data for which we have no additional credentials.
+  scoped_ptr<crypto::SymmetricKey> system_salt_key_;
+
   // Local state.
   bool user_logged_in_;
   bool certificates_requested_;
   bool certificates_loaded_;
   // The key store for the current user has been loaded. This flag is needed to
   // ensure that the key store will not be loaded twice in the policy recovery
   // "safe-mode".
   bool key_store_loaded_;
 
   // Certificates.
@@ skipping 77 matching lines @@
     net::X509Certificate* cert = GetCertificateAt(index);
     net::X509Certificate::OSCertHandle cert_handle = cert->os_cert_handle();
     std::string id = x509_certificate_model::GetPkcs11Id(cert_handle);
     if (id == pkcs11_id)
       return index;
   }
   return -1;  // Not found.
 }
 
 }  // chromeos