Copy challenge*Key methods to enterprise.platformKeys.

chrome/common/extensions/api/enterprise_platform_keys.idl

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Use the <code>chrome.enterprise.platformKeys</code> API to generate
 // hardware-backed keys and to install certificates for these keys. The
 // certificates will be managed by the platform and can be used for TLS
 // authentication, network access or by other extension through
 // $(ref:platformKeys chrome.platformKeys).
 [platforms = ("chromeos")]
@@ skipping 27 matching lines @@
 
   // Callback to which the certificates are passed.
   // |certificates|: The list of certificates, each in DER encoding of a X.509
   //     certificate.
   callback GetCertificatesCallback = void(ArrayBuffer[] certificates);
 
   // Invoked by importCertificate or removeCertificate when the respective
   // operation is finished.
   callback DoneCallback = void();
 
+  // Invoked by <code>challengeMachineKey</code> or
+  // <code>challengeUserKey</code> with the challenge response.
+  // |response|: The challenge response, encoded using Base64.
+  callback ChallengeCallback = void(DOMString response);
+
   interface Functions {
     // Returns the available Tokens. In a regular user's session the list will
     // always contain the user's token with <code>id</code> <code>"user"</code>.
     // If a system-wide TPM token is available, the returned list will also
     // contain the system-wide token with <code>id</code> <code>"system"</code>.
     // The system-wide token will be the same for all sessions on this device
     // (device in the sense of e.g. a Chromebook).
     [nocompile] static void getTokens(GetTokensCallback callback);
 
     // Returns the list of all client certificates available from the given
@@ skipping 19 matching lines @@
     // Removes <code>certificate</code> from the given token if present.
     // Should be used to remove obsolete certificates so that they are not
     // considered during authentication and do not clutter the certificate
     // choice. Should be used to free storage in the certificate store.
     // |tokenId|: The id of a Token returned by <code>getTokens</code>.
     // |certificate|: The DER encoding of a X.509 certificate.
     // |callback|: Called back when this operation is finished.
     static void removeCertificate(DOMString tokenId,
                                   ArrayBuffer certificate,
                                   optional DoneCallback callback);
+
+    // Challenges a hardware-backed Enterprise Machine Key and emits the
+    // response as part of a remote attestation protocol. Only useful on Chrome
+    // OS and in conjunction with the Verified Access Web API which both issues
+    // challenges and verifies responses. A successful verification by the
+    // Verified Access Web API is a strong signal of all of the following:
+    // * The current device is a legitimate Chrome OS device.
+    // * The current device is managed by the domain specified during
+    //   verification.
+    // * The current signed-in user is managed by the domain specified during
+    //   verification.
+    // * The current device state complies with enterprise device policy. For
+    //   example, a policy may specify that the device must not be in developer
+    //   mode.
+    // * Any device identity emitted by the verification is tightly bound to the
+    //   hardware of the current device.
+    // This function is highly restricted and will fail if the current device
+    // is not managed, the current user is not managed, or if this operation
+    // has not explicitly been enabled for the caller by enterprise device
+    // policy. The Enterprise Machine Key does not reside in the
+    // <code>"system"</code> token and is not accessible by any other API.
+    // |challenge|: A challenge as emitted by the Verified Access Web API,
+    //              encoded using Base64.

[emaxx, 2016/02/19 17:20:58]

Isn't it better to use ArrayBuffer's instead of the base64-encoded strings?

As far as I can see, the existing methods in the chrome.enterprise.platformKeys
API (or, for example, in the somehow relevant chrome.certificateProvider API)
use ArrayBuffer in order to pass and receive the binary data.

[Devlin, 2016/02/19 18:05:02]

I don't know that one is inherently better than the other (probably depends on
the data), but I would say that we should be consistent.  So yeah, I'd prefer
ArrayBuffer here.

[Darren Krahn, 2016/02/23 23:39:46]

Done.

+    // |callback|: Called back with the challenge response.
+    static void challengeMachineKey(DOMString challenge,
+                                    ChallengeCallback callback);
+
+    // Challenges a hardware-backed Enterprise User Key and emits the response
+    // as part of a remote attestation protocol. Only useful on Chrome OS and in
+    // conjunction with the Verified Access Web API which both issues challenges
+    // and verifies responses. A successful verification by the Verified Access
+    // Web API is a strong signal of all of the following:
+    // * The current device is a legitimate Chrome OS device.
+    // * The current device is managed by the domain specified during
+    //   verification.
+    // * The current signed-in user is managed by the domain specified during
+    //   verification.
+    // * The current device state complies with enterprise user policy. For
+    //   example, a policy may specify that the device must not be in developer
+    //   mode.
+    // * The public key emitted by the verification is tightly bound to the
+    //   hardware of the current device and to the current signed-in user.
+    // This function is highly restricted and will fail if the current device is
+    // not managed, the current user is not managed, or if this operation has
+    // not explicitly been enabled for the caller by enterprise user policy.
+    // The Enterprise User Key does not reside in the <code>"user"</code> token
+    // and is not accessible by any other API.
+    // |challenge|: A challenge as emitted by the Verified Access Web API,
+    //              encoded using Base64.
+    // |registerKey|: If set, the current Enterprise User Key is registered with
+    //                the <code>"user"</code> token and relinquishes the
+    //                Enterprise User Key role. The key can then be associated
+    //                with a certificate and used like any other signing key.
+    //                This key is 2048-bit RSA. Subsequent calls to this
+    //                function will then generate a new Enterprise User Key.
+    // |callback|: Called back with the challenge response.
+    static void challengeUserKey(DOMString challenge,
+                                 boolean registerKey,
+                                 ChallengeCallback callback);
   };
 };