Copied OEMCrypto utils to Android.

The OEMCrypto utils have been copied over from the CDM repo.
Tests have been excluded for this CL.

Files represent a snapshot taken from http://go/wvgerrit/148270
and http://go/wvgerrit/148372.

Bug: 205902021
Change-Id: I1a58952cd1436a48974367c5436bf7296163e6f1

libwvdrmengine/oemcrypto/util/include/cmac.h

@@ -0,0 +1,61 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_CMAC_H_
+#define WVOEC_UTIL_CMAC_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+#include <vector>
+
+#include <openssl/cmac.h>
+
+namespace wvoec {
+namespace util {
+class Cmac {
+ public:
+  // Creates an AES-128-CMAC or an AES-256-CMAC depending on |key_size|.
+  // Returns an empty pointer if the key size is not valid.
+  static std::unique_ptr<Cmac> Create(const uint8_t* key, size_t key_size);
+  static std::unique_ptr<Cmac> Create(const std::vector<uint8_t>& key);
+
+  // Updates the CMAC with more data.  This allows for streaming or
+  // scatter-gather based MAC generation.
+  // Returns true if the data was updated successfully and false
+  // if any unexpected errors occur.
+  bool Update(const uint8_t* data, size_t data_length);
+  bool Update(const std::vector<uint8_t>& data);
+  bool Update(uint8_t datum);
+
+  // Generates the final MAC and stores it in the |mac| output
+  // parameter.
+  // After finalizing, one must reset the Cmac instance before it
+  // can digest additional information.
+  bool Finalize(std::vector<uint8_t>* mac);
+  // Similar to Finalize() except that the output is appended to
+  // the end of the provided |mac| buffer.
+  bool FinalizeAppend(std::vector<uint8_t>* mac);
+
+  // Clears the underlying CMAC without clearing the key.  Resetting
+  // it to its post-initialization state.
+  void Reset();
+
+  ~Cmac();
+
+ private:
+  Cmac() {}
+
+  // Assumes |key_size| is a valid AES-128 or AES-256 key.
+  bool Init(const uint8_t* key, size_t key_size);
+
+  CMAC_CTX* ctx_ = nullptr;
+  bool ready_ = false;
+};
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_CMAC_H_

libwvdrmengine/oemcrypto/util/include/oemcrypto_drm_key.h

@@ -0,0 +1,85 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_DRM_KEY_H_
+#define WVOEC_UTIL_DRM_KEY_H_
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "OEMCryptoCENCCommon.h"
+#include "oemcrypto_ecc_key.h"
+#include "oemcrypto_rsa_key.h"
+
+namespace wvoec {
+namespace util {
+// DRM private key performs all of the operations required by an
+// OEMCrypto session's RSA/ECC private key.
+class DrmPrivateKey {
+ public:
+  // Create an RSA-based DRM key.
+  static std::unique_ptr<DrmPrivateKey> Create(
+      std::shared_ptr<RsaPrivateKey>&& rsa_key);
+  static std::unique_ptr<DrmPrivateKey> Create(
+      std::unique_ptr<RsaPrivateKey>&& rsa_key);
+  // Create an ECC-based DRM key.
+  static std::unique_ptr<DrmPrivateKey> Create(
+      std::shared_ptr<EccPrivateKey>&& ecc_key);
+  static std::unique_ptr<DrmPrivateKey> Create(
+      std::unique_ptr<EccPrivateKey>&& ecc_key);
+
+  bool IsRsaKey() const { return static_cast<bool>(rsa_key_); }
+  bool IsEccKey() const { return static_cast<bool>(ecc_key_); }
+
+  // Generates a session key from the key source.
+  // For RSA keys, |key_source| is an encrypted session key.
+  // For ECC keys, |key_source| is a ephemeral public key to be
+  // used in ECDH.
+  OEMCryptoResult GetSessionKey(const uint8_t* key_source,
+                                size_t key_source_size,
+                                std::vector<uint8_t>* session_key) const;
+  std::vector<uint8_t> GetSessionKey(
+      const std::vector<uint8_t>& key_source) const;
+
+  // Generates a encryption key from the key source.
+  // For RSA keys, |key_source| is an encrypted encryption key.
+  // For ECC keys, this method is not supported.
+  std::vector<uint8_t> GetEncryptionKey(
+      const std::vector<uint8_t>& key_source) const;
+
+  // Generates a signature for the provided message.
+  // For RSA keys, the signature is RSASSA-PSS.
+  // For ECC keys, the signature is ECDSA.
+  OEMCryptoResult GenerateSignature(const uint8_t* message,
+                                    size_t message_length, uint8_t* signature,
+                                    size_t* signature_length) const;
+  std::vector<uint8_t> GenerateSignature(
+      const std::vector<uint8_t>& message) const;
+  size_t SignatureSize() const;
+
+  // Generates a signature for the provided message.
+  // For RSA keys, the signature is RSASSA-PKCS1.
+  // For ECC keys, this is not supported.
+  OEMCryptoResult GenerateRsaSignature(const uint8_t* message,
+                                       size_t message_length,
+                                       uint8_t* signature,
+                                       size_t* signature_length) const;
+  std::vector<uint8_t> GenerateRsaSignature(
+      const std::vector<uint8_t>& message) const;
+
+  ~DrmPrivateKey() {}
+
+ private:
+  DrmPrivateKey() {}
+
+  // Only one will be set.
+  std::shared_ptr<EccPrivateKey> ecc_key_;
+  std::shared_ptr<RsaPrivateKey> rsa_key_;
+};
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_DRM_KEY_H_

libwvdrmengine/oemcrypto/util/include/oemcrypto_ecc_key.h

@@ -0,0 +1,281 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_ECC_KEY_H_
+#define WVOEC_UTIL_ECC_KEY_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include <openssl/ec.h>
+
+#include "OEMCryptoCENCCommon.h"
+
+namespace wvoec {
+namespace util {
+enum EccCurve {
+  kEccCurveUnknown = 0,
+  kEccSecp256r1 = 256,
+  kEccSecp384r1 = 384,
+  kEccSecp521r1 = 521
+};
+
+// Returns the string representation of the provided curve.
+// Intended for logging purposes.
+std::string EccCurveToString(EccCurve curve);
+
+class EccPrivateKey;
+
+class EccPublicKey {
+ public:
+  // Creates a new public key equivalent of the provided private key.
+  static std::unique_ptr<EccPublicKey> New(const EccPrivateKey& private_key);
+
+  // Loads a serialized EC public key.
+  // The provided |buffer| must contain a valid ASN.1 DER encoded
+  // SubjectPublicKey.  Only supported curves by this API are those
+  // enumerated by EccCurve.
+  //
+  //  buffer: SubjectPublicKeyInfo = {
+  //    algorithm: AlgorithmIdentifier = {
+  //      algorithm: OID = id-ecPublicKey,
+  //      parameters: ECParameters = {
+  //        namedCurve: OID = secp256r1 | secp384r1 | secp521r1
+  //      }
+  //    },
+  //    subjectPublicKey: BIT STRING = ... -- SEC1 encoded ECPoint
+  //  }
+  //
+  // Failure will occur if the provided |buffer| does not contain a
+  // valid SubjectPublicKey, or if the specified curve is not
+  // supported.
+  static std::unique_ptr<EccPublicKey> Load(const uint8_t* buffer,
+                                            size_t length);
+  static std::unique_ptr<EccPublicKey> Load(const std::string& buffer);
+  static std::unique_ptr<EccPublicKey> Load(const std::vector<uint8_t>& buffer);
+
+  // Loads a serialized ECC private key, but only converting the public key.
+  static std::unique_ptr<EccPublicKey> LoadPrivateKeyInfo(const uint8_t* buffer,
+                                                          size_t length);
+  static std::unique_ptr<EccPublicKey> LoadPrivateKeyInfo(
+      const std::string& buffer);
+  static std::unique_ptr<EccPublicKey> LoadPrivateKeyInfo(
+      const std::vector<uint8_t>& buffer);
+
+  EccCurve curve() const { return curve_; }
+  const EC_KEY* GetEcKey() const { return key_; }
+
+  // Checks if the provided |private_key| is the EC private key of this
+  // public key.
+  bool IsMatchingPrivateKey(const EccPrivateKey& private_key) const;
+
+  // Serializes the public key into an ASN.1 DER encoded SubjectPublicKey
+  // representation.
+  // On success, |buffer_size| is populated with the number of bytes
+  // written to |buffer|, and OEMCrypto_SUCCESS is returned.
+  // If the provided |buffer_size| is too small, ERROR_SHORT_BUFFER
+  // is returned and |buffer_size| is set to the required buffer size.
+  OEMCryptoResult Serialize(uint8_t* buffer, size_t* buffer_size) const;
+  // Same as above, except directly returns the serialized key.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> Serialize() const;
+
+  // Verifies the |signature| matches the provided |message| by the
+  // private equivalent of this public key.
+  // The |signature| should be a valid ASN.1 DER encoded
+  // ECDSA-Sig-Value.
+  // This implementation uses ECDSA with the following digest
+  // algorithms for the supported curve types.
+  //  - SHA-256 / secp256r1
+  //  - SHA-384 / secp384r1 (optional support)
+  //  - SHA-512 / secp521r1 (optional support)
+  // Returns:
+  //    OEMCrypto_SUCCESS if signature is valid
+  //    OEMCrypto_ERROR_SIGNATURE_FAILURE if the signature is invalid
+  //    Any other result indicates an unexpected error
+  OEMCryptoResult VerifySignature(const uint8_t* message, size_t message_length,
+                                  const uint8_t* signature,
+                                  size_t signature_length) const;
+  OEMCryptoResult VerifySignature(const std::string& message,
+                                  const std::string& signature) const;
+  OEMCryptoResult VerifySignature(const std::vector<uint8_t>& message,
+                                  const std::vector<uint8_t>& signature) const;
+
+  ~EccPublicKey();
+
+  EccPublicKey(const EccPublicKey&) = delete;
+  EccPublicKey(EccPublicKey&&) = delete;
+  const EccPublicKey& operator=(const EccPublicKey&) = delete;
+  EccPublicKey& operator=(EccPublicKey&&) = delete;
+
+ private:
+  EccPublicKey() {}
+
+  // Initializes the public key object using the provided |buffer|.
+  // In case of any failure, false is return and the key should be
+  // discarded.
+  bool InitFromSubjectPublicKeyInfo(const uint8_t* buffer, size_t length);
+  bool InitFromPrivateKeyInfo(const uint8_t* buffer, size_t length);
+  // Initializes the public key object from a private.
+  bool InitFromPrivateKey(const EccPrivateKey& private_key);
+
+  // OpenSSL/BoringSSL implementation of an ECC key.
+  // As a public key, this will only have key point initialized.
+  EC_KEY* key_ = nullptr;
+  EccCurve curve_ = kEccCurveUnknown;
+};  // class EccPublicKey
+
+class EccPrivateKey {
+ public:
+  // Creates a new, pseudorandom ECC private key belonging to the
+  // curve specified.
+  static std::unique_ptr<EccPrivateKey> New(EccCurve curve);
+
+  // Loads a serialized ECC private key.
+  // The provided |buffer| must contain a valid ASN.1 DER encoded
+  // PrivateKeyInfo containing a valid ECC key description.  Only
+  // supported curves by this API are those enumerated by EccCurve.
+  //
+  //  PrivateKeyInfo := {
+  //    version: INTEGER = v1(0) | v2(1),
+  //    privateKeyAlgorithm: AlgorithmIdentifier := {
+  //      algorithm: OID = id-ecPublicKey,
+  //      parameters: ECParameters = {
+  //        namedCurve: OID = secp256r1 | secp384r1 | secp521r1
+  //      }
+  //    },
+  //    privateKey: OCTET STRING = ..., -- BER encoding of ECPrivateKey
+  //  }
+  //
+  //  ECPrivateKey := {
+  //    version: INTEGER = ecPrivateKeyVer1(1),
+  //    privateKey: OCTET STRING = ...,  -- I2OSP of private key point
+  //    -- |parameters| are obtained from PrivateKeyInfo
+  //    publicKey: BIT STRING OPTIONAL = ... -- SEC1 encoded ECPoint
+  //  }
+  // Note: If the public key is not included, then it is computed from
+  // the private key.
+  //
+  // References:
+  //  RFC 5208 - Description of PrivateKeyInfo
+  //  RFC 5480 - Curve OIDs
+  //  RFC 5915 - Description of ECPrivateKey in PrivateKeyInfo
+  //
+  // Failure will occur if the provided |buffer| does not contain a
+  // valid PrivateKeyInfo, key is not an ECC key, the specified
+  // curve is not supported, or the key is not valid.
+  static std::unique_ptr<EccPrivateKey> Load(const uint8_t* buffer,
+                                             size_t length);
+  static std::unique_ptr<EccPrivateKey> Load(const std::string& buffer);
+  static std::unique_ptr<EccPrivateKey> Load(
+      const std::vector<uint8_t>& buffer);
+
+  // Creates a new ECC public key of this private key.
+  // Equivalent to calling EccPublicKey::New with this private
+  // key.
+  std::unique_ptr<EccPublicKey> MakePublicKey() const;
+
+  EccCurve curve() const { return curve_; }
+  const EC_KEY* GetEcKey() const { return key_; }
+
+  // Checks if the provided |public_key| is the EC public key of this
+  // private key.
+  bool IsMatchingPublicKey(const EccPublicKey& public_key) const;
+
+  // Serializes the private key into an ASN.1 DER encoded PrivateKeyInfo
+  // representation.
+  // On success, |buffer_size| is populated with the number of bytes
+  // written to |buffer|, and SUCCESS is returned.
+  // If the provided |buffer_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |buffer_size| is
+  // set to the required buffer size.
+  OEMCryptoResult Serialize(uint8_t* buffer, size_t* buffer_size) const;
+  // Same as above, except directly returns the serialized key.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> Serialize() const;
+
+  // Serializes the public component of the private key into an ASN.1
+  // DER encoded SubjectPublicKey representation.
+  // On success, |buffer_size| is populated with the number of bytes
+  // written to |buffer|, and SUCCESS is returned.
+  // If the provided |buffer_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |buffer_size| is
+  // set to the required buffer size.
+  OEMCryptoResult SerializeAsPublicKey(uint8_t* buffer,
+                                       size_t* buffer_size) const;
+  // Same as above, except directly returns the serialized key.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> SerializeAsPublicKey() const;
+
+  // Signs the provided |message| and serializes the signature
+  // point to |signature| as a ASN.1 DER encoded ECDSA-Sig-Value.
+  // This implementation uses ECDSA with the following digest
+  // algorithms for the supported curve types.
+  //  - SHA-256 / secp256r1
+  //  - SHA-384 / secp384r1 (optional support)
+  //  - SHA-512 / secp521r1 (optional support)
+  // On success, |signature_length| is populated with the number of
+  // bytes written to |signature|, and SUCCESS is returned.
+  // If the provided |signature_length| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |signature_length|
+  // is set to the required signature size.
+  OEMCryptoResult GenerateSignature(const uint8_t* message,
+                                    size_t message_length, uint8_t* signature,
+                                    size_t* signature_length) const;
+  // Same as above, except directly returns the serialized signature.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> GenerateSignature(
+      const std::vector<uint8_t>& message) const;
+  std::vector<uint8_t> GenerateSignature(const std::string& message) const;
+  // Returns an upper bound for the signature size.  May be larger than
+  // the actual signature generated by GenerateSignature().
+  size_t SignatureSize() const;
+
+  // Derives the OEMCrypto session key used for deriving other keys.
+  // The provided public key must be of the same curve.
+  // On success, |session_key_size| is populated with the number of
+  // bytes written to |session_key|, and OEMCrypto_SUCCESS is returned.
+  // If the provided |session_key_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |session_key_size|
+  // is set to the required buffer size.
+  OEMCryptoResult DeriveSessionKey(const EccPublicKey& public_key,
+                                   uint8_t* session_key,
+                                   size_t* session_key_size) const;
+  // Same as above, except directly returns the derived key.
+  std::vector<uint8_t> DeriveSessionKey(const EccPublicKey& public_key) const;
+  // Returns the byte length of the symmetric key that would be derived
+  // by DeriveSymmetricKey().
+  size_t SessionKeyLength() const;
+
+  ~EccPrivateKey();
+
+  EccPrivateKey(const EccPrivateKey&) = delete;
+  EccPrivateKey(EccPrivateKey&&) = delete;
+  const EccPrivateKey& operator=(const EccPrivateKey&) = delete;
+  EccPrivateKey& operator=(EccPrivateKey&&) = delete;
+
+ private:
+  EccPrivateKey() {}
+
+  // Initializes the public key object using the provided |buffer|.
+  // In case of any failure, false is return and the key should be
+  // discarded.
+  bool InitFromPrivateKeyInfo(const uint8_t* buffer, size_t length);
+  // Generates a new key based on the provided curve.
+  bool InitFromCurve(EccCurve curve);
+
+  // OpenSSL/BoringSSL implementation of an ECC key.
+  // The public point of the key will always be present.
+  EC_KEY* key_ = nullptr;
+  EccCurve curve_ = kEccCurveUnknown;
+};  // class EccPrivateKey
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_ECC_KEY_H_

libwvdrmengine/oemcrypto/util/include/oemcrypto_key_deriver.h

@@ -0,0 +1,61 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_KEY_DERIVER_H_
+#define WVOEC_UTIL_KEY_DERIVER_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+#include <vector>
+
+#include "cmac.h"
+
+namespace wvoec {
+namespace util {
+class KeyDeriver {
+ public:
+  // Create a new key deriver using either the session key or the device
+  // key.
+  // Returns an empty pointer if the key size is not valid.
+  static std::unique_ptr<KeyDeriver> Create(const uint8_t* key,
+                                            size_t key_size);
+  static std::unique_ptr<KeyDeriver> Create(const std::vector<uint8_t>& key);
+
+  // Derive the mac_key[server] from the provided |mac_key_context|.
+  bool DeriveServerMacKey(const uint8_t* mac_key_context,
+                          size_t mac_key_context_size,
+                          std::vector<uint8_t>* mac_key_server);
+  bool DeriveServerMacKey(const std::vector<uint8_t>& mac_key_context,
+                          std::vector<uint8_t>* mac_key_server);
+
+  // Derive the mac_key[client] from the provided |mac_key_context|.
+  bool DeriveClientMacKey(const uint8_t* mac_key_context,
+                          size_t mac_key_context_size,
+                          std::vector<uint8_t>* mac_key_client);
+  bool DeriveClientMacKey(const std::vector<uint8_t>& mac_key_context,
+                          std::vector<uint8_t>* mac_key_client);
+
+  // Derive the enc_key from the provided |enc_key_context|.
+  bool DeriveEncryptionKey(const uint8_t* enc_key_context,
+                           size_t enc_key_context_size,
+                           std::vector<uint8_t>* enc_key);
+  bool DeriveEncryptionKey(const std::vector<uint8_t>& enc_key_context,
+                           std::vector<uint8_t>* enc_key);
+
+  ~KeyDeriver() {}
+
+ private:
+  KeyDeriver() {}
+
+  bool Init(const uint8_t* key, size_t key_size);
+
+  std::unique_ptr<Cmac> cmac_;
+};
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_KEY_DERIVER_H_

libwvdrmengine/oemcrypto/util/include/oemcrypto_oem_cert.h

@@ -0,0 +1,104 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_OEM_CERT_H_
+#define WVOEC_UTIL_OEM_CERT_H_
+
+#include <memory>
+#include <vector>
+
+#include "OEMCryptoCENCCommon.h"
+
+namespace wvoec {
+namespace util {
+class OemPublicCertificate;
+
+// An OEM Certificate is a factory provisioned root of trust
+// certificate which consists of a public certificate and its
+// matching private key.
+// The public certificate must be an ASN.1 DER encoded PKCS #7
+// ContentInfo of type signedData (RFC2315).  The device's X.509
+// certificate must be the first certificate in the chain of
+// SignedContent |certificates|.
+// The certificates are X.509 Certificate as defined in RFC 5280
+// signed by the device manufacturers certificate which is signed
+// by Google.
+// The OEM Public Cert should only contain the device's certificate
+// and the OEM's intermediate certificate.
+// The private key storage format is at the discretion of the OEM;
+// the reference implementation uses PKCS8 PrivateKeyInfo.
+class OemCertificate {
+ public:
+  enum KeyType {
+    kNone = 0,
+    // Private key is an ASN.1 DER encoded PrivateKeyInfo specifying
+    // an RSA encryption key.
+    kRsa = 1
+  };
+
+  // Creates a new OEM Certificate and performs basic validation
+  // to ensure that the private key and public cert are well-formed.
+  // The |public_cert| provided is parsed as an X.509 Certificate
+  // and the public key is verified against the private key.
+  // The |private_key| is parsed depending on the key type.
+  // If any error occurs or if the provided data is malformed, an
+  // empty pointer is returned.
+  static std::unique_ptr<OemCertificate> Create(const uint8_t* private_key,
+                                                size_t private_key_size,
+                                                const uint8_t* public_cert,
+                                                size_t public_cert_size);
+  static std::unique_ptr<OemCertificate> Create(
+      const std::vector<uint8_t>& private_key,
+      const std::vector<uint8_t>& public_cert);
+
+  // Returns the key type of the OEM Public key and private key.
+  // As of OEMCrypto v16, the only supported key type is RSA.
+  KeyType key_type() const;
+
+  // Returns the private key data.  Intended to be used for calls
+  // to OEMCrypto_LoadOEMPrivateKey().
+  const std::vector<uint8_t>& GetPrivateKey() const { return private_key_; }
+
+  // Returns a copy of the ASN.1 DER encoded PKCS #7 certificate chain.
+  // If |*public_cert_length| is large enough, the complete
+  // certificate is copied to the buffer specified by |public_cert|,
+  // |*public_cert_length| is adjusted to the actual size of the
+  // certificate data, and SUCCESS is returned.
+  // If |*public_cert_length| is not large enough, then it is
+  // set to size of the certificate and ERROR_SHORT_BUFFER is
+  // returned.
+  OEMCryptoResult GetPublicCertificate(uint8_t* public_cert,
+                                       size_t* public_cert_length) const;
+  // Returns the certificate directly.  Intended to be used for
+  // testing.
+  const std::vector<uint8_t>& GetPublicCertificate() const;
+
+  // Verifies that the RSA key included in the OEM Cert is valid.
+  // The existence of an OemCertificate already ensures that the
+  // OEM Public Certificate and private key data are well-formed.
+  // This takes the check another step further and ensures that
+  // the private key matches the public key in the public cert
+  // (ie, same modulos and public exponent).
+  OEMCryptoResult IsCertificateValid() const;
+
+  ~OemCertificate();
+
+  OemCertificate(const OemCertificate&) = delete;
+  OemCertificate(OemCertificate&&) = delete;
+  const OemCertificate& operator=(const OemCertificate&) = delete;
+  OemCertificate& operator=(OemCertificate&&) = delete;
+
+ private:
+  OemCertificate();
+
+  // Serialized private key matching the OEM certificate.
+  std::vector<uint8_t> private_key_;
+  // Serialized OEM Certificate.
+  std::unique_ptr<OemPublicCertificate> public_cert_;
+};  // class OemCertificate
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_OEM_CERT_H_

libwvdrmengine/oemcrypto/util/include/oemcrypto_rsa_key.h

@@ -0,0 +1,376 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_RSA_KEY_H_
+#define WVOEC_UTIL_RSA_KEY_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include <openssl/rsa.h>
+
+#include "OEMCryptoCENC.h"
+
+namespace wvoec {
+namespace util {
+enum RsaFieldSize {
+  kRsaFieldUnknown = 0,
+  kRsa2048Bit = 2048,
+  kRsa3072Bit = 3084
+};
+
+// Identifies the RSA signature algorithm to be used when signing
+// messages or verifying message signatures.
+// The two standard signing algorithms specified by PKCS1 RSA V2.1
+// are RSASSA-PKCS1 and RSASSA-PSS.  Each require agreement on a
+// set of options.  For OEMCrypto, only one set of options are agreed
+// upon for each RSA signature scheme.  CAST receivers specify a
+// special implementation of PKCS1 where the message is already
+// digested and encoded when provided.
+enum RsaSignatureAlgorithm {
+  // RSASSA-PSS with default options:
+  //  Hash algorithm: SHA-1
+  //  MGF: MGF1 with SHA-1
+  //  Salt length: 20 bytes
+  //  Trailer field: 0xbc
+  kRsaPssDefault = 0,
+  // RSASSA-PKCS1 for CAST receivers.
+  // Assumes message is already digested & encoded.  Max message length
+  // is 83 bytes.
+  kRsaPkcs1Cast = 1
+};
+
+// Returns the string representation of the provided RSA field size.
+// Intended for logging purposes.
+std::string RsaFieldSizeToString(RsaFieldSize field_size);
+
+// Compares two OpenSSL/BoringSSL RSA keys to see if their public RSA
+// components are matching.
+// This function assumes both keys are valid.
+// Returns true if they are matching, false otherwise.
+bool RsaKeysAreMatchingPair(const RSA* public_key, const RSA* private_key);
+
+class RsaPrivateKey;
+
+class RsaPublicKey {
+ public:
+  // Creates a new public key equivalent of the provided private key.
+  static std::unique_ptr<RsaPublicKey> New(const RsaPrivateKey& private_key);
+
+  // Creates an RSA public key from a native OpenSSL/BoringSSL RSA key handle.
+  // Ownership of the handle is NOT transferred.
+  static std::unique_ptr<RsaPublicKey> FromSslHandle(
+      const RSA* rsa_handle, uint32_t allowed_schemes = kSign_RSASSA_PSS);
+
+  // Loads a serialized RSA public key.
+  // The provided |buffer| must contain a valid ASN.1 DER encoded
+  // SubjectPublicKey.  This API will reject any RSA key that is not
+  // approximately to 2048bits or 3072bits.
+  //
+  //  buffer: SubjectPublicKeyInfo = {
+  //    algorithm: AlgorithmIdentifier = {
+  //      algorithm: OID = rsaEncryption,
+  //      parameters: NULL = null
+  //    },
+  //    subjectPublicKey: BIT STRING = ... -- ASN.1 DER encoded RSAPublicKey
+  //  }
+  //
+  // Failure will occur if the provided |buffer| does not contain a
+  // valid SubjectPublicKey, or if the specified curve is not
+  // supported.
+  static std::unique_ptr<RsaPublicKey> Load(const uint8_t* buffer,
+                                            size_t length);
+  static std::unique_ptr<RsaPublicKey> Load(const std::string& buffer);
+  static std::unique_ptr<RsaPublicKey> Load(const std::vector<uint8_t>& buffer);
+
+  // Loads a serialized RSA private key, but only converting the public key.
+  static std::unique_ptr<RsaPublicKey> LoadPrivateKeyInfo(const uint8_t* buffer,
+                                                          size_t length);
+  static std::unique_ptr<RsaPublicKey> LoadPrivateKeyInfo(
+      const std::string& buffer);
+  static std::unique_ptr<RsaPublicKey> LoadPrivateKeyInfo(
+      const std::vector<uint8_t>& buffer);
+
+  RsaFieldSize field_size() const { return field_size_; }
+  uint32_t allowed_schemes() const { return allowed_schemes_; }
+  const RSA* GetRsaKey() const { return key_; }
+
+  // Checks if the provided |private_key| is the RSA private key of this
+  // public key.
+  bool IsMatchingPrivateKey(const RsaPrivateKey& private_key) const;
+
+  // Serializes the public key into an ASN.1 DER encoded SubjectPublicKey
+  // representation.
+  // On success, |buffer_size| is populated with the number of bytes
+  // written to |buffer|, and OEMCrypto_SUCCESS is returned.
+  // If the provided |buffer_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |buffer_size| is set
+  // to the required buffer size.
+  OEMCryptoResult Serialize(uint8_t* buffer, size_t* buffer_size) const;
+  // Same as above, except directly returns the serialized key.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> Serialize() const;
+
+  // Verifies the |signature| matches the provided |message| by the
+  // private equivalent of this public key.
+  // The signature algorithm can be specified via the |algorithm| field.
+  // See RsaSignatureAlgorithm for details on each algorithm.
+  //
+  // Returns:
+  //    OEMCrypto_SUCCESS if signature is valid
+  //    OEMCrypto_ERROR_SIGNATURE_FAILURE if the signature is invalid
+  //    OEMCrypto_ERROR_UNKNOWN_FAILURE if any error occurs
+  OEMCryptoResult VerifySignature(
+      const uint8_t* message, size_t message_length, const uint8_t* signature,
+      size_t signature_length,
+      RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
+  OEMCryptoResult VerifySignature(
+      const std::string& message, const std::string& signature,
+      RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
+  OEMCryptoResult VerifySignature(
+      const std::vector<uint8_t>& message,
+      const std::vector<uint8_t>& signature,
+      RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
+
+  // Encrypts the OEMCrypto session key used for deriving other keys.
+  // On success, |enc_session_key_size| is populated with the number
+  // of bytes written to |enc_session_key|, and OEMCrypto_SUCCESS is
+  // returned.  If the provided |enc_session_key_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and
+  // |enc_session_key_size| is set to the required buffer size.
+  OEMCryptoResult EncryptSessionKey(const uint8_t* session_key,
+                                    size_t session_key_size,
+                                    uint8_t* enc_session_key,
+                                    size_t* enc_session_key_size) const;
+  // Same as above, except directly returns the encrypted key.
+  std::vector<uint8_t> EncryptSessionKey(
+      const std::vector<uint8_t>& session_key) const;
+  std::vector<uint8_t> EncryptSessionKey(const std::string& session_key) const;
+
+  // Encrypts the OEMCrypto encryption key used for encrypting the
+  // DRM private key.
+  // On success, |enc_encryption_key_size| is populated with the
+  // number of bytes written to |enc_encryption_key|, and
+  // OEMCrypto_SUCCESS is returned.
+  // If the provided |enc_encryption_key_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and
+  // |enc_encryption_key_size| is set to the required buffer size.
+  OEMCryptoResult EncryptEncryptionKey(const uint8_t* encryption_key,
+                                       size_t encryption_key_size,
+                                       uint8_t* enc_encryption_key,
+                                       size_t* enc_encryption_key_size) const;
+  // Same as above, except directly returns the encrypted key.
+  std::vector<uint8_t> EncryptEncryptionKey(
+      const std::vector<uint8_t>& encryption_key) const;
+  std::vector<uint8_t> EncryptEncryptionKey(
+      const std::string& encryption_key) const;
+
+  ~RsaPublicKey();
+
+  RsaPublicKey(const RsaPublicKey&) = delete;
+  RsaPublicKey(RsaPublicKey&&) = delete;
+  const RsaPublicKey& operator=(const RsaPublicKey&) = delete;
+  RsaPublicKey& operator=(RsaPublicKey&&) = delete;
+
+ private:
+  RsaPublicKey() {}
+
+  // Initializes the public key object using the provided |buffer|.
+  // In case of any failure, false is return and the key should be
+  // discarded.
+  bool InitFromSubjectPublicKeyInfo(const uint8_t* buffer, size_t length);
+  bool InitFromPrivateKeyInfo(const uint8_t* buffer, size_t length);
+  // Initializes the public key object from a private.
+  bool InitFromPrivateKey(const RsaPrivateKey& private_key);
+  // Initializes the public key object from an existing
+  // OpenSSL/BoringSSL RSA key handle.  The RSA key must be
+  // initialized and |allowed_schemes| must be a valid value.
+  bool InitFromSslHandle(const RSA* rsa_handle, uint32_t allowed_schemes);
+
+  // Signature specialization functions.
+  OEMCryptoResult VerifySignaturePss(const uint8_t* message,
+                                     size_t message_length,
+                                     const uint8_t* signature,
+                                     size_t signature_length) const;
+  OEMCryptoResult VerifySignaturePkcs1Cast(const uint8_t* message,
+                                           size_t message_length,
+                                           const uint8_t* signature,
+                                           size_t signature_length) const;
+
+  // RSAES-OAEP encrypt.
+  OEMCryptoResult EncryptOaep(const uint8_t* message, size_t message_size,
+                              uint8_t* enc_message,
+                              size_t* enc_message_length) const;
+
+  // OpenSSL/BoringSSL implementation of an RSA key.
+  // Will only include components of an RSA public key.
+  RSA* key_ = nullptr;
+  uint32_t allowed_schemes_ = 0;
+  RsaFieldSize field_size_ = kRsaFieldUnknown;
+};  // class RsaPublicKey
+
+class RsaPrivateKey {
+ public:
+  // Creates a new, pseudorandom RSA private key.
+  static std::unique_ptr<RsaPrivateKey> New(RsaFieldSize field_size);
+
+  // Loads a serialized RSA private key.
+  // The provided |buffer| must contain a valid ASN.1 DER encoded
+  // PrivateKeyInfo (RFC 5208).
+  //
+  //  buffer: PrivateKeyInfo = {
+  //    version: INTEGER = v1(0),
+  //    privateKeyAlgorithm: OID = rsaEncryption,
+  //    privateKey: OCTET STRING = ...,
+  //      -- BER encoding of RSAPrivateKey (RFC 3447)
+  //    attributes: Attributes = ...  -- Optional, not used by OEMCrypto
+  //  }
+  // Note: If the public key is not included, then it is computed from
+  // the private.
+  //
+  // Failure will occur if the provided |buffer| does not contain a
+  // valid RSAPrivateKey, or if the specified curve is not supported.
+  static std::unique_ptr<RsaPrivateKey> Load(const uint8_t* buffer,
+                                             size_t length);
+  static std::unique_ptr<RsaPrivateKey> Load(const std::string& buffer);
+  static std::unique_ptr<RsaPrivateKey> Load(
+      const std::vector<uint8_t>& buffer);
+
+  // Creates a new RSA public key of this private key.
+  // Equivalent to calling RsaPublicKey::New with this private
+  // key.
+  std::unique_ptr<RsaPublicKey> MakePublicKey() const;
+
+  RsaFieldSize field_size() const { return field_size_; }
+  uint32_t allowed_schemes() const { return allowed_schemes_; }
+  const RSA* GetRsaKey() const { return key_; }
+
+  // Checks if the provided |public_key| is the RSA public key of this
+  // private key.
+  bool IsMatchingPublicKey(const RsaPublicKey& public_key) const;
+
+  // Serializes the private key into an ASN.1 DER encoded X
+  // representation.
+  // On success, |buffer_size| is populated with the number of bytes
+  // written to |buffer|, and OEMCrypto_SUCCESS is returned.
+  // If the provided |buffer_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |buffer_size| is
+  // set to the required buffer size.
+  OEMCryptoResult Serialize(uint8_t* buffer, size_t* buffer_size) const;
+  // Same as above, except directly returns the serialized key.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> Serialize() const;
+
+  // Signs the provided |message| using the RSA signing algorithm
+  // specified by |algorithm|.  See RsaSignatureAlgorithm for
+  // details on each algorithm.
+  //
+  // On success, |signature_length| is populated with the number of
+  // bytes written to |signature|, and OEMCrypto_SUCCESS is returned.
+  // If the provided |signature_length| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |signature_length|
+  // is set to the required signature size.
+  OEMCryptoResult GenerateSignature(const uint8_t* message,
+                                    size_t message_length,
+                                    RsaSignatureAlgorithm algorithm,
+                                    uint8_t* signature,
+                                    size_t* signature_length) const;
+  // Same as above, except directly returns the serialized signature.
+  // Returns an empty vector on error.
+  std::vector<uint8_t> GenerateSignature(
+      const std::vector<uint8_t>& message,
+      RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
+  std::vector<uint8_t> GenerateSignature(
+      const std::string& message,
+      RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
+  // Returns an upper bound for the signature size.  May be larger than
+  // the actual signature generated by GenerateSignature().
+  size_t SignatureSize() const;
+
+  // Decrypts the OEMCrypto session key used for deriving other keys.
+  // On success, |session_key_size| is populated with the number of
+  // bytes written to |session_key|, and OEMCrypto_SUCCESS is returned.
+  // If the provided |session_key_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |session_key_size|
+  // is set to the required buffer size.
+  OEMCryptoResult DecryptSessionKey(const uint8_t* enc_session_key,
+                                    size_t enc_session_key_size,
+                                    uint8_t* session_key,
+                                    size_t* session_key_size) const;
+  // Same as above, except directly returns the decrypted key.
+  std::vector<uint8_t> DecryptSessionKey(
+      const std::vector<uint8_t>& enc_session_key) const;
+  std::vector<uint8_t> DecryptSessionKey(
+      const std::string& enc_session_key) const;
+  // Returns the byte length of the symmetric key that would be derived
+  // by DecryptSessionKey().
+  size_t SessionKeyLength() const;
+
+  // Decrypts the OEMCrypto encryption key used for decrypting DRM
+  // private key.
+  // On success, |encryption_key_size| is populated with the number of
+  // bytes written to |encryption_key|, and OEMCrypto_SUCCESS is
+  // returned.
+  // If the provided |encryption_key_size| is too small,
+  // OEMCrypto_ERROR_SHORT_BUFFER is returned and |encryption_key_size|
+  // is set to the required buffer size.
+  OEMCryptoResult DecryptEncryptionKey(const uint8_t* enc_encryption_key,
+                                       size_t enc_encryption_key_size,
+                                       uint8_t* encryption_key,
+                                       size_t* encryption_key_size) const;
+  // Same as above, except directly returns the decrypted key.
+  std::vector<uint8_t> DecryptEncryptionKey(
+      const std::vector<uint8_t>& enc_encryption_key) const;
+  std::vector<uint8_t> DecryptEncryptionKey(
+      const std::string& enc_encryption_key) const;
+
+  ~RsaPrivateKey();
+
+  RsaPrivateKey(const RsaPrivateKey&) = delete;
+  RsaPrivateKey(RsaPrivateKey&&) = delete;
+  const RsaPrivateKey& operator=(const RsaPrivateKey&) = delete;
+  RsaPrivateKey& operator=(RsaPrivateKey&&) = delete;
+
+ private:
+  RsaPrivateKey() {}
+
+  // Initializes the public key object using the provided |buffer|.
+  // In case of any failure, false is return and the key should be
+  // discarded.
+  bool InitFromPrivateKeyInfo(const uint8_t* buffer, size_t length);
+  // Generates a new key based on the provided field size.
+  bool InitFromFieldSize(RsaFieldSize field_size);
+
+  // Signature specialization functions.
+  OEMCryptoResult GenerateSignaturePss(const uint8_t* message,
+                                       size_t message_length,
+                                       uint8_t* signature,
+                                       size_t* signature_length) const;
+  OEMCryptoResult GenerateSignaturePkcs1Cast(const uint8_t* message,
+                                             size_t message_length,
+                                             uint8_t* signature,
+                                             size_t* signature_length) const;
+
+  // RSAES-OAEP decrypt.
+  OEMCryptoResult DecryptOaep(const uint8_t* enc_message,
+                              size_t enc_message_size, uint8_t* message,
+                              size_t expected_message_length) const;
+
+  // OpenSSL/BoringSSL implementation of an RSA key.
+  // Will include all components of an RSA private key.
+  RSA* key_ = nullptr;
+  uint32_t allowed_schemes_ = 0;
+  // Set true if the deserialized key contained an allowed schemes.
+  bool explicit_schemes_ = false;
+  RsaFieldSize field_size_ = kRsaFieldUnknown;
+};  // class RsaPrivateKey
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_RSA_KEY_H_

libwvdrmengine/oemcrypto/util/include/scoped_object.h

@@ -0,0 +1,70 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#ifndef WVOEC_UTIL_SCOPED_OBJECT_H_
+#define WVOEC_UTIL_SCOPED_OBJECT_H_
+
+namespace wvoec {
+namespace util {
+// A generic wrapper around pointer.  This allows for automatic
+// memory clean up when the ScopedObject variable goes out of scope.
+// This is intended to be used with OpenSSL/BoringSSL structs.
+template <typename Type, void Destructor(Type*)>
+class ScopedObject {
+ public:
+  ScopedObject() : ptr_(nullptr) {}
+  ScopedObject(Type* ptr) : ptr_(ptr) {}
+  ~ScopedObject() {
+    if (ptr_) {
+      Destructor(ptr_);
+      ptr_ = nullptr;
+    }
+  }
+
+  // Copy construction and assignment are not allowed.
+  ScopedObject(const ScopedObject& other) = delete;
+  ScopedObject& operator=(const ScopedObject& other) = delete;
+
+  // Move construction and assignment are allowed.
+  ScopedObject(ScopedObject&& other) : ptr_(other.ptr_) {
+    other.ptr_ = nullptr;
+  }
+  ScopedObject& operator=(ScopedObject&& other) {
+    if (ptr_) {
+      Destructor(ptr_);
+    }
+    ptr_ = other.ptr_;
+    other.ptr_ = nullptr;
+    return *this;
+  }
+
+  explicit operator bool() const { return ptr_ != nullptr; }
+
+  Type& operator*() { return *ptr_; }
+  Type* get() const { return ptr_; }
+  Type* operator->() const { return ptr_; }
+
+  // Releasing the pointer will remove the responsibility of the
+  // ScopedObject to clean up the pointer.
+  Type* release() {
+    Type* temp = ptr_;
+    ptr_ = nullptr;
+    return temp;
+  }
+
+  void reset(Type* ptr = nullptr) {
+    if (ptr_) {
+      Destructor(ptr_);
+    }
+    ptr_ = ptr;
+  }
+
+ private:
+  Type* ptr_ = nullptr;
+};
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_SCOPED_OBJECT_H_

libwvdrmengine/oemcrypto/util/include/wvcrc32.h

@@ -0,0 +1,22 @@
+// Copyright 2018 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine
+// License Agreement.
+//
+// Compute CRC32/MPEG2 Checksum. Needed for verification of WV Keybox.
+//
+#ifndef WVOEC_UTIL_WVCRC32_H_
+#define WVOEC_UTIL_WVCRC32_H_
+
+#include <stdint.h>
+
+namespace wvoec {
+namespace util {
+uint32_t wvcrc32(const uint8_t* p_begin, size_t i_count);
+uint32_t wvcrc32Init();
+uint32_t wvcrc32Cont(const uint8_t* p_begin, size_t i_count, uint32_t prev_crc);
+
+// Convert to network byte order
+uint32_t wvcrc32n(const uint8_t* p_begin, size_t i_count);
+}  // namespace util
+}  // namespace wvoec
+#endif  // WVOEC_UTIL_WVCRC32_H_