1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
// Copyright 2013 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef NET_CERT_CT_LOG_VERIFIER_H_
#define NET_CERT_CT_LOG_VERIFIER_H_
#include <string>
#include <string_view>
#include "base/gtest_prod_util.h"
#include "base/memory/ref_counted.h"
#include "net/base/net_export.h"
#include "net/cert/signed_certificate_timestamp.h"
#include "third_party/boringssl/src/include/openssl/base.h"
namespace net {
namespace ct {
struct MerkleAuditProof;
struct MerkleConsistencyProof;
struct SignedTreeHead;
} // namespace ct
// Class for verifying signatures of a single Certificate Transparency
// log, whose identity is provided during construction.
// Currently can verify Signed Certificate Timestamp (SCT) and Signed
// Tree Head (STH) signatures.
// Immutable: Does not hold any state beyond the log information it was
// initialized with.
class NET_EXPORT CTLogVerifier
: public base::RefCountedThreadSafe<CTLogVerifier> {
public:
// Creates a new CTLogVerifier that will verify SignedCertificateTimestamps
// using |public_key|, which is a DER-encoded SubjectPublicKeyInfo.
// If |public_key| refers to an unsupported public key, returns NULL.
// |description| is a textual description of the log.
static scoped_refptr<const CTLogVerifier> Create(std::string_view public_key,
std::string description);
// Returns the log's key ID (RFC6962, Section 3.2)
const std::string& key_id() const { return key_id_; }
// Returns the log's human-readable description.
const std::string& description() const { return description_; }
// Verifies that |sct| is valid for |entry| and was signed by this log.
bool Verify(const ct::SignedEntryData& entry,
const ct::SignedCertificateTimestamp& sct) const;
// Verifies that |signed_tree_head| is a valid Signed Tree Head (RFC 6962,
// Section 3.5) for this log.
bool VerifySignedTreeHead(const ct::SignedTreeHead& signed_tree_head) const;
// Verifies that |proof| is a valid consistency proof (RFC 6962, Section
// 2.1.2) for this log, and which proves that |old_tree_hash| has
// been fully incorporated into the Merkle tree represented by
// |new_tree_hash|.
bool VerifyConsistencyProof(const ct::MerkleConsistencyProof& proof,
const std::string& old_tree_hash,
const std::string& new_tree_hash) const;
// Verifies that |proof| is a valid audit proof (RFC 6962, Section 2.1.1) for
// this log, and which proves that the certificate represented by |leaf_hash|
// has been incorporated into the Merkle tree represented by |root_hash|.
// Returns true if verification succeeds, false otherwise.
bool VerifyAuditProof(const ct::MerkleAuditProof& proof,
const std::string& root_hash,
const std::string& leaf_hash) const;
private:
FRIEND_TEST_ALL_PREFIXES(CTLogVerifierTest, VerifySignature);
friend class base::RefCountedThreadSafe<CTLogVerifier>;
explicit CTLogVerifier(std::string description);
~CTLogVerifier();
// Performs crypto-library specific initialization.
bool Init(std::string_view public_key);
// Performs the underlying verification using the selected public key. Note
// that |signature| contains the raw signature data (eg: without any
// DigitallySigned struct encoding).
bool VerifySignature(std::string_view data_to_sign,
std::string_view signature) const;
// Returns true if the signature and hash algorithms in |signature|
// match those of the log
bool SignatureParametersMatch(const ct::DigitallySigned& signature) const;
std::string key_id_;
std::string description_;
ct::DigitallySigned::HashAlgorithm hash_algorithm_ =
ct::DigitallySigned::HASH_ALGO_NONE;
ct::DigitallySigned::SignatureAlgorithm signature_algorithm_ =
ct::DigitallySigned::SIG_ALGO_ANONYMOUS;
bssl::UniquePtr<EVP_PKEY> public_key_;
};
} // namespace net
#endif // NET_CERT_CT_LOG_VERIFIER_H_
|
