OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_QUIC_CORE_CRYPTO_CRYPTO_SECRET_BOXER_H_ | 5 #ifndef NET_QUIC_CORE_CRYPTO_CRYPTO_SECRET_BOXER_H_ |
6 #define NET_QUIC_CORE_CRYPTO_CRYPTO_SECRET_BOXER_H_ | 6 #define NET_QUIC_CORE_CRYPTO_CRYPTO_SECRET_BOXER_H_ |
7 | 7 |
8 #include <stddef.h> | 8 #include <cstddef> |
9 | |
10 #include <string> | 9 #include <string> |
11 #include <vector> | 10 #include <vector> |
12 | 11 |
13 #include "base/macros.h" | 12 #include "base/macros.h" |
14 #include "base/strings/string_piece.h" | 13 #include "base/strings/string_piece.h" |
15 #include "net/quic/platform/api/quic_export.h" | 14 #include "net/quic/platform/api/quic_export.h" |
16 #include "net/quic/platform/api/quic_mutex.h" | 15 #include "net/quic/platform/api/quic_mutex.h" |
17 | 16 |
18 namespace net { | 17 namespace net { |
19 | 18 |
20 class QuicRandom; | 19 class QuicRandom; |
21 | 20 |
22 // CryptoSecretBoxer encrypts small chunks of plaintext (called 'boxing') and | 21 // CryptoSecretBoxer encrypts small chunks of plaintext (called 'boxing') and |
23 // then, later, can authenticate+decrypt the resulting boxes. This object is | 22 // then, later, can authenticate+decrypt the resulting boxes. This object is |
24 // thread-safe. | 23 // thread-safe. |
25 class QUIC_EXPORT_PRIVATE CryptoSecretBoxer { | 24 class QUIC_EXPORT_PRIVATE CryptoSecretBoxer { |
26 public: | 25 public: |
27 CryptoSecretBoxer(); | 26 CryptoSecretBoxer(); |
28 ~CryptoSecretBoxer(); | 27 ~CryptoSecretBoxer(); |
29 | 28 |
30 // GetKeySize returns the number of bytes in a key. | 29 // GetKeySize returns the number of bytes in a key. |
31 static size_t GetKeySize(); | 30 static size_t GetKeySize(); |
32 | 31 |
| 32 // SetKeys sets a list of encryption keys. The first key in the list will be |
33 // used by |Box|, but all supplied keys will be tried by |Unbox|, to handle | 33 // used by |Box|, but all supplied keys will be tried by |Unbox|, to handle |
34 // key skew across the fleet. This must be called before |Box| or |Unbox|. | 34 // key skew across the fleet. This must be called before |Box| or |Unbox|. |
35 // Keys must be |GetKeySize()| bytes long. | 35 // Keys must be |GetKeySize()| bytes long. |
36 void SetKeys(const std::vector<std::string>& keys); | 36 void SetKeys(const std::vector<std::string>& keys); |
37 | 37 |
38 // Box encrypts |plaintext| using a random nonce generated from |rand| and | 38 // Box encrypts |plaintext| using a random nonce generated from |rand| and |
39 // returns the resulting ciphertext. Since an authenticator and nonce are | 39 // returns the resulting ciphertext. Since an authenticator and nonce are |
40 // included, the result will be slightly larger than |plaintext|. The first | 40 // included, the result will be slightly larger than |plaintext|. The first |
41 // key in the std::vector supplied to |SetKeys| will be used. | 41 // key in the vector supplied to |SetKeys| will be used. |
42 std::string Box(QuicRandom* rand, base::StringPiece plaintext) const; | 42 std::string Box(QuicRandom* rand, base::StringPiece plaintext) const; |
43 | 43 |
44 // Unbox takes the result of a previous call to |Box| in |ciphertext| and | 44 // Unbox takes the result of a previous call to |Box| in |ciphertext| and |
45 // authenticates+decrypts it. If |ciphertext| cannot be decrypted with any of | 45 // authenticates+decrypts it. If |ciphertext| cannot be decrypted with any of |
46 // the supplied keys, the function returns false. Otherwise, |out_storage| is | 46 // the supplied keys, the function returns false. Otherwise, |out_storage| is |
47 // used to store the result and |out| is set to point into |out_storage| and | 47 // used to store the result and |out| is set to point into |out_storage| and |
48 // contains the original plaintext. | 48 // contains the original plaintext. |
49 bool Unbox(base::StringPiece ciphertext, | 49 bool Unbox(base::StringPiece ciphertext, |
50 std::string* out_storage, | 50 std::string* out_storage, |
51 base::StringPiece* out) const; | 51 base::StringPiece* out) const; |
52 | 52 |
53 private: | 53 private: |
54 mutable QuicMutex lock_; | 54 mutable QuicMutex lock_; |
55 std::vector<std::string> keys_ GUARDED_BY(lock_); | 55 std::vector<std::string> keys_ GUARDED_BY(lock_); |
56 | 56 |
57 DISALLOW_COPY_AND_ASSIGN(CryptoSecretBoxer); | 57 DISALLOW_COPY_AND_ASSIGN(CryptoSecretBoxer); |
58 }; | 58 }; |
59 | 59 |
60 } // namespace net | 60 } // namespace net |
61 | 61 |
62 #endif // NET_QUIC_CORE_CRYPTO_CRYPTO_SECRET_BOXER_H_ | 62 #endif // NET_QUIC_CORE_CRYPTO_CRYPTO_SECRET_BOXER_H_ |
OLD | NEW |