Copied OEMCrypto utils to Android.

The OEMCrypto utils have been copied over from the CDM repo.
Tests have been excluded for this CL.

Files represent a snapshot taken from http://go/wvgerrit/148270
and http://go/wvgerrit/148372.

Bug: 205902021
Change-Id: I1a58952cd1436a48974367c5436bf7296163e6f1

libwvdrmengine/oemcrypto/util/src/cmac.cpp

@@ -0,0 +1,173 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#include "cmac.h"
+
+#include <openssl/evp.h>
+
+#include "log.h"
+#include "scoped_object.h"
+
+namespace wvoec {
+namespace util {
+namespace {
+using ScopedCmacCtx = ScopedObject<CMAC_CTX, CMAC_CTX_free>;
+constexpr size_t kAes128KeySize = 16;
+constexpr size_t kAes256KeySize = 32;
+constexpr size_t kCmacOutputSize = 16;
+
+// Gets the appropriate AES block cipher for the CMAC algortihm
+// based on the key size.
+// Ownership of the pointer returned by this function is retained by
+// the OpenSSL/BoringSSL framework.
+const EVP_CIPHER* KeySizeToCipher(size_t key_size) {
+  switch (key_size) {
+    case kAes128KeySize:
+      return EVP_aes_128_cbc();
+    case kAes256KeySize:
+      return EVP_aes_256_cbc();
+  }
+  LOGE("Unexpected key size: size = %zu", key_size);
+  return nullptr;
+}
+}  // namespace
+
+// static
+std::unique_ptr<Cmac> Cmac::Create(const uint8_t* key, size_t key_size) {
+  std::unique_ptr<Cmac> cmac;
+  if (key == nullptr) {
+    LOGE("CMAC key is null");
+    return cmac;
+  }
+  if (key_size != kAes128KeySize && key_size != kAes256KeySize) {
+    LOGE("Invalid CMAC key size: size = %zu", key_size);
+    return cmac;
+  }
+  cmac.reset(new Cmac());
+  if (!cmac->Init(key, key_size)) {
+    cmac.reset();
+  }
+  return cmac;
+}
+
+// static
+std::unique_ptr<Cmac> Cmac::Create(const std::vector<uint8_t>& key) {
+  if (key.empty()) {
+    LOGE("CMAC key is empty");
+    return std::unique_ptr<Cmac>();
+  }
+  return Create(key.data(), key.size());
+}
+
+bool Cmac::Init(const uint8_t* key, size_t key_size) {
+  const EVP_CIPHER* const cipher = KeySizeToCipher(key_size);
+  if (cipher == nullptr) {
+    LOGE("Failed to get block cipher for CMAC");
+    return false;
+  }
+  ScopedCmacCtx ctx(CMAC_CTX_new());
+  if (!ctx) {
+    LOGE("Failed allocate CMAC CTX");
+    return false;
+  }
+  if (!CMAC_Init(ctx.get(), key, key_size, cipher, nullptr)) {
+    LOGE("Failed to initialize CMAC CTX");
+    return false;
+  }
+  ctx_ = ctx.release();
+  ready_ = true;
+  return true;
+}
+
+bool Cmac::Update(const uint8_t* data, size_t data_length) {
+  if (data == nullptr) {
+    LOGE("Data is null");
+    return false;
+  }
+  if (data_length == 0) {
+    return true;
+  }
+  if (!ready_) {
+    LOGE("CMAC must be reset before updating");
+    return false;
+  }
+  if (!CMAC_Update(ctx_, data, data_length)) {
+    LOGE("Failed to update CMAC CTX");
+    ready_ = false;
+    return false;
+  }
+  return true;
+}
+
+bool Cmac::Update(const std::vector<uint8_t>& data) {
+  return Update(data.data(), data.size());
+}
+
+bool Cmac::Update(uint8_t datum) { return Update(&datum, 1); }
+
+bool Cmac::Finalize(std::vector<uint8_t>* mac) {
+  if (mac == nullptr) {
+    LOGE("Output MAC buffer is null");
+    return false;
+  }
+  mac->clear();
+  return FinalizeAppend(mac);
+}
+
+bool Cmac::FinalizeAppend(std::vector<uint8_t>* mac) {
+  if (mac == nullptr) {
+    LOGE("Output MAC buffer is null");
+    return false;
+  }
+  if (!ready_) {
+    LOGE("CMAC must be reset before finalizing");
+    return false;
+  }
+  const size_t end = mac->size();
+  size_t mac_size = kCmacOutputSize;
+  mac->resize(end + mac_size);
+  if (!CMAC_Final(ctx_, &mac->at(end), &mac_size)) {
+    LOGE("Failed to finalize CMAC CTX");
+    mac->resize(end);
+    ready_ = false;
+    return false;
+  }
+  ready_ = false;
+  return true;
+}
+
+#ifdef OPENSSL_IS_BORINGSSL
+// BoringSSL allows for resetting a CMAC context explicitly, whereas
+// OpenSSL does so by reinitializing using all nulls/zeros.  This
+// causes segfaults on systems using BoringSSL.
+void Cmac::Reset() {
+  if (!CMAC_Reset(ctx_)) {
+    LOGE("Failed to reset CMAC CTX");
+    ready_ = false;
+  } else {
+    ready_ = true;
+  }
+}
+#else  // OpenSSL is OpenSSL
+void Cmac::Reset() {
+  if (!CMAC_Init(ctx_, nullptr, 0, nullptr, nullptr)) {
+    LOGE("Failed to reset CMAC CTX");
+    ready_ = false;
+  } else {
+    ready_ = true;
+  }
+}
+#endif
+
+Cmac::~Cmac() {
+  if (ctx_ != nullptr) {
+    CMAC_CTX_free(ctx_);
+    ctx_ = nullptr;
+  }
+  ready_ = false;
+}
+}  // namespace util
+}  // namespace wvoec

libwvdrmengine/oemcrypto/util/src/oemcrypto_drm_key.cpp

@@ -0,0 +1,186 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#include "oemcrypto_drm_key.h"
+
+#include <utility>
+
+#include "OEMCryptoCENC.h"
+#include "log.h"
+
+namespace wvoec {
+namespace util {
+// static
+std::unique_ptr<DrmPrivateKey> DrmPrivateKey::Create(
+    std::shared_ptr<RsaPrivateKey>&& rsa_key) {
+  if (!rsa_key) {
+    LOGE("No RSA key provided");
+    return std::unique_ptr<DrmPrivateKey>();
+  }
+  std::unique_ptr<DrmPrivateKey> drm_key(new DrmPrivateKey());
+  drm_key->rsa_key_ = std::move(rsa_key);
+  return drm_key;
+}
+
+// static
+std::unique_ptr<DrmPrivateKey> DrmPrivateKey::Create(
+    std::unique_ptr<RsaPrivateKey>&& rsa_key) {
+  if (!rsa_key) {
+    LOGE("No RSA key provided");
+    return std::unique_ptr<DrmPrivateKey>();
+  }
+  std::unique_ptr<DrmPrivateKey> drm_key(new DrmPrivateKey());
+  drm_key->rsa_key_ = std::move(rsa_key);
+  return drm_key;
+}
+
+// static
+std::unique_ptr<DrmPrivateKey> DrmPrivateKey::Create(
+    std::shared_ptr<EccPrivateKey>&& ecc_key) {
+  if (!ecc_key) {
+    LOGE("No ECC key provided");
+    return std::unique_ptr<DrmPrivateKey>();
+  }
+  std::unique_ptr<DrmPrivateKey> drm_key(new DrmPrivateKey());
+  drm_key->ecc_key_ = std::move(ecc_key);
+  return drm_key;
+}
+
+// static
+std::unique_ptr<DrmPrivateKey> DrmPrivateKey::Create(
+    std::unique_ptr<EccPrivateKey>&& ecc_key) {
+  if (!ecc_key) {
+    LOGE("No ECC key provided");
+    return std::unique_ptr<DrmPrivateKey>();
+  }
+  std::unique_ptr<DrmPrivateKey> drm_key(new DrmPrivateKey());
+  drm_key->ecc_key_ = std::move(ecc_key);
+  return drm_key;
+}
+
+OEMCryptoResult DrmPrivateKey::GetSessionKey(
+    const uint8_t* key_source, size_t key_source_size,
+    std::vector<uint8_t>* session_key) const {
+  if (session_key == nullptr) {
+    LOGE("Output session key is null");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // RSA -> Decrypt session key.
+  if (rsa_key_) {
+    if (!(rsa_key_->allowed_schemes() & kSign_RSASSA_PSS)) {
+      LOGE("RSA key cannot be used for session key decryption");
+      return OEMCrypto_ERROR_INVALID_RSA_KEY;
+    }
+    size_t session_key_size = rsa_key_->SessionKeyLength();
+    session_key->resize(session_key_size);
+    const OEMCryptoResult res = rsa_key_->DecryptSessionKey(
+        key_source, key_source_size, session_key->data(), &session_key_size);
+    if (res != OEMCrypto_SUCCESS) {
+      session_key->clear();
+      return res;
+    }
+    session_key->resize(session_key_size);
+    return OEMCrypto_SUCCESS;
+  }
+  // ECC -> ECDH.
+  // Step 1: Parse |key_source| as ECC key.
+  std::unique_ptr<EccPublicKey> ephemeral_ecc_key =
+      EccPublicKey::Load(key_source, key_source_size);
+  if (!ephemeral_ecc_key) {
+    LOGE("Failed to load server's ephemeral ECC key");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 2: Derive session key.
+  size_t session_key_size = ecc_key_->SessionKeyLength();
+  session_key->resize(session_key_size);
+  const OEMCryptoResult res = ecc_key_->DeriveSessionKey(
+      *ephemeral_ecc_key, session_key->data(), &session_key_size);
+  if (res != OEMCrypto_SUCCESS) {
+    session_key->clear();
+    return res;
+  }
+  session_key->resize(session_key_size);
+  return OEMCrypto_SUCCESS;
+}
+
+std::vector<uint8_t> DrmPrivateKey::GetSessionKey(
+    const std::vector<uint8_t>& key_source) const {
+  // RSA -> Decrypt session key.
+  if (rsa_key_) {
+    if (!(rsa_key_->allowed_schemes() & kSign_RSASSA_PSS)) {
+      LOGE("RSA key cannot be used for session key decryption");
+      return std::vector<uint8_t>();
+    }
+    return rsa_key_->DecryptSessionKey(key_source);
+  }
+  // ECC -> ECDH.
+  // Step 1: Parse |key_source| as ECC key.
+  std::unique_ptr<EccPublicKey> ephemeral_ecc_key =
+      EccPublicKey::Load(key_source);
+  if (!ephemeral_ecc_key) {
+    LOGE("Failed to load server's ephemeral ECC key");
+    return std::vector<uint8_t>();
+  }
+  // Step 2: Derive session key.
+  return ecc_key_->DeriveSessionKey(*ephemeral_ecc_key);
+}
+
+std::vector<uint8_t> DrmPrivateKey::GetEncryptionKey(
+    const std::vector<uint8_t>& key_source) const {
+  if (!rsa_key_) {
+    LOGE("Only RSA DRM keys can derive an encryption key");
+    return std::vector<uint8_t>();
+  }
+  return rsa_key_->DecryptEncryptionKey(key_source);
+}
+
+OEMCryptoResult DrmPrivateKey::GenerateSignature(
+    const uint8_t* message, size_t message_length, uint8_t* signature,
+    size_t* signature_length) const {
+  if (rsa_key_) {
+    return rsa_key_->GenerateSignature(message, message_length, kRsaPssDefault,
+                                       signature, signature_length);
+  }
+  return ecc_key_->GenerateSignature(message, message_length, signature,
+                                     signature_length);
+}
+
+std::vector<uint8_t> DrmPrivateKey::GenerateSignature(
+    const std::vector<uint8_t>& message) const {
+  if (rsa_key_) {
+    return rsa_key_->GenerateSignature(message, kRsaPssDefault);
+  }
+  return ecc_key_->GenerateSignature(message);
+}
+
+size_t DrmPrivateKey::SignatureSize() const {
+  if (rsa_key_) {
+    return rsa_key_->SignatureSize();
+  }
+  return ecc_key_->SignatureSize();
+}
+
+OEMCryptoResult DrmPrivateKey::GenerateRsaSignature(
+    const uint8_t* message, size_t message_length, uint8_t* signature,
+    size_t* signature_length) const {
+  if (!rsa_key_) {
+    LOGE("Only RSA DRM keys can generate PKCS1 signatures");
+    return OEMCrypto_ERROR_INVALID_RSA_KEY;
+  }
+  return rsa_key_->GenerateSignature(message, message_length, kRsaPkcs1Cast,
+                                     signature, signature_length);
+}
+
+std::vector<uint8_t> DrmPrivateKey::GenerateRsaSignature(
+    const std::vector<uint8_t>& message) const {
+  if (!rsa_key_) {
+    LOGE("Only RSA DRM keys can generate PKCS1 signatures");
+    return std::vector<uint8_t>();
+  }
+  return rsa_key_->GenerateSignature(message, kRsaPkcs1Cast);
+}
+}  // namespace util
+}  // namespace wvoec

libwvdrmengine/oemcrypto/util/src/oemcrypto_ecc_key.cpp

@@ -0,0 +1,931 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#include "oemcrypto_ecc_key.h"
+
+#include <assert.h>
+#include <string.h>
+
+#include <mutex>
+
+#include <openssl/bn.h>
+#include <openssl/crypto.h>
+#include <openssl/ec.h>
+#include <openssl/ecdsa.h>
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+#include <openssl/x509.h>
+
+#include "log.h"
+#include "scoped_object.h"
+
+namespace wvoec {
+namespace util {
+namespace {
+// Estimated max size (in bytes) of a serialized ECC key (public or
+// private).  These values are based on rough calculations for
+// secp521r1 (largest of the supported curves) and should be slightly
+// larger needed.
+constexpr size_t kPrivateKeySize = 250;
+constexpr size_t kPublicKeySize = 164;
+
+// 256 bit key, intended to be used with CMAC-AES-256.
+constexpr size_t kEccSessionKeySize = 32;
+
+using ScopedBigNum = ScopedObject<BIGNUM, BN_free>;
+using ScopedBigNumCtx = ScopedObject<BN_CTX, BN_CTX_free>;
+using ScopedBio = ScopedObject<BIO, BIO_vfree>;
+using ScopedEcKey = ScopedObject<EC_KEY, EC_KEY_free>;
+using ScopedEvpMdCtx = ScopedObject<EVP_MD_CTX, EVP_MD_CTX_free>;
+using ScopedEvpPkey = ScopedObject<EVP_PKEY, EVP_PKEY_free>;
+using ScopedPrivateKeyInfo =
+    ScopedObject<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>;
+using ScopedSigPoint = ScopedObject<ECDSA_SIG, ECDSA_SIG_free>;
+
+const EC_GROUP* GetEcGroup(EccCurve curve) {
+  // Creating a named EC_GROUP is an expensive operation, and they
+  // are always used in a manner which does not transfer ownership.
+  // Maintaining a process-wide set of supported EC groups reduces
+  // the overhead of group operations.
+  static std::mutex group_mutex;
+  static EC_GROUP* group_256 = nullptr;
+  static EC_GROUP* group_384 = nullptr;
+  static EC_GROUP* group_521 = nullptr;
+  std::lock_guard<std::mutex> group_lock(group_mutex);
+  switch (curve) {
+    case kEccSecp256r1: {
+      if (group_256 == nullptr) {
+        LOGD("Creating secp256r1 group");
+        // The curve secp256r1 was originally named prime256v1
+        // in the X9.62 specification.
+        group_256 = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
+        assert(group_256 != nullptr);
+      }
+      return group_256;
+    }
+    case kEccSecp384r1: {
+      if (group_384 == nullptr) {
+        LOGD("Creating secp384r1 group");
+        group_384 = EC_GROUP_new_by_curve_name(NID_secp384r1);
+        assert(group_384 != nullptr);
+      }
+      return group_384;
+    }
+    case kEccSecp521r1: {
+      if (group_521 == nullptr) {
+        LOGD("Creating secp521r1 group");
+        group_521 = EC_GROUP_new_by_curve_name(NID_secp521r1);
+        assert(group_521 != nullptr);
+      }
+      return group_521;
+    }
+    default:
+      LOGE("Cannot get EC group for unknown curve: curve = %d",
+           static_cast<int>(curve));
+      return nullptr;
+  }
+}
+
+// Determines which of the supported ECC curves the provided |key|
+// belongs to.
+//
+// This is intended to be used on keys that have been deserialized
+// from an ASN.1 structure which may have contained a key which is
+// supported by OpenSSL/BoringSSL but not necessarily by OEMCrypto.
+//
+// If the key group is unknown to OEMCrypto or if an error occurs,
+// kEccCurveUnknown is returned.
+EccCurve GetCurveFromKeyGroup(const EC_KEY* key) {
+  ScopedBigNumCtx ctx(BN_CTX_new());
+  if (!ctx) {
+    LOGE("Failed to allocate BN ctx");
+    return kEccCurveUnknown;
+  }
+  const EC_GROUP* group = EC_KEY_get0_group(key);
+  if (group == nullptr) {
+    LOGE("Provided key does not have a group");
+    return kEccCurveUnknown;
+  }
+  int rc = EC_GROUP_cmp(group, GetEcGroup(kEccSecp256r1), ctx.get());
+  if (rc == 0) {
+    return kEccSecp256r1;
+  }
+  if (rc == -1) {
+    LOGE("Error occurred while checking against secp256r1");
+    return kEccCurveUnknown;
+  }
+
+  rc = EC_GROUP_cmp(group, GetEcGroup(kEccSecp384r1), ctx.get());
+  if (rc == 0) {
+    return kEccSecp384r1;
+  }
+  if (rc == -1) {
+    LOGE("Error occurred while checking against secp384r1");
+    return kEccCurveUnknown;
+  }
+
+  rc = EC_GROUP_cmp(group, GetEcGroup(kEccSecp521r1), ctx.get());
+  if (rc == 0) {
+    return kEccSecp521r1;
+  }
+  if (rc == -1) {
+    LOGE("Error occurred while checking against secp521r1");
+    return kEccCurveUnknown;
+  }
+
+  LOGW("Unsupported curve group");
+  return kEccCurveUnknown;
+}
+
+// Compares the public EC points of both keys to see if they are the
+// equal.
+// Both |public_key| and |private_key| must be of the same group.
+bool IsMatchingKeyPair(const EC_KEY* public_key, const EC_KEY* private_key) {
+  ScopedBigNumCtx ctx(BN_CTX_new());
+  if (!ctx) {
+    LOGE("Failed to allocate BN ctx");
+    return false;
+  }
+  // Returns: 1 if not equal, 0 if equal, -1 if error.
+  const int res = EC_POINT_cmp(EC_KEY_get0_group(public_key),
+                               EC_KEY_get0_public_key(public_key),
+                               EC_KEY_get0_public_key(private_key), ctx.get());
+  if (res == -1) {
+    LOGE("Error occurred comparing keys");
+  }
+  return res == 0;
+}
+
+// Performs a SHA2 digest on the provided |message| and outputs the
+// computed hash to |digest|.
+// The digest algorithm used depends on which curve is used.
+//  - secp256r1 -> SHA-256
+//  - secp384r1 -> SHA-384
+//  - secp521r1 -> SHA-512
+// This function assumes that all parameters are valid.
+// Returns true on success, false otherwise.
+bool DigestMessage(EccCurve curve, const uint8_t* message, size_t message_size,
+                   std::vector<uint8_t>* digest) {
+  const EVP_MD* md_engine = nullptr;
+  switch (curve) {
+    case kEccSecp256r1: {
+      md_engine = EVP_sha256();
+      break;
+    }
+    case kEccSecp384r1: {
+      md_engine = EVP_sha384();
+      break;
+    }
+    case kEccSecp521r1: {
+      md_engine = EVP_sha512();
+      break;
+    }
+    case kEccCurveUnknown:
+      // This case is to suppress compiler warnings.  It will never
+      // occur.
+      break;
+  }
+  if (md_engine == nullptr) {
+    LOGE("Failed to get MD engine: curve = %d", static_cast<int>(curve));
+    return false;
+  }
+
+  ScopedEvpMdCtx md_ctx(EVP_MD_CTX_new());
+  if (!md_ctx) {
+    LOGE("Failed to create MD CTX");
+    return false;
+  }
+  if (!EVP_DigestInit_ex(md_ctx.get(), md_engine, nullptr)) {
+    LOGE("Failed to init MD CTX");
+    return false;
+  }
+  if (message_size > 0 &&
+      !EVP_DigestUpdate(md_ctx.get(), message, message_size)) {
+    LOGE("Failed to update");
+    return false;
+  }
+  digest->resize(EVP_MD_CTX_size(md_ctx.get()), 0);
+  const int res = EVP_DigestFinal_ex(md_ctx.get(), digest->data(), nullptr);
+  if (!res) {
+    LOGE("Failed to finalize");
+    return false;
+  }
+  return true;
+}
+
+// This KDF function is defined by OEMCrypto ECC specification.
+// Function signature is based on the |kdf| parameter of
+// ECDH_compute_key().  This function assumes that all pointer
+// parameters are not null.
+void* WidevineEccKdf(const void* secret, size_t secret_length, void* key,
+                     size_t* key_size) {
+  if (*key_size < kEccSessionKeySize) {
+    LOGE("Output buffer is too small: required = %zu, size = %zu",
+         kEccSessionKeySize, *key_size);
+    return nullptr;
+  }
+  std::vector<uint8_t> digest;
+  if (!DigestMessage(kEccSecp256r1 /* SHA-256 */,
+                     reinterpret_cast<const uint8_t*>(secret), secret_length,
+                     &digest)) {
+    LOGE("Cannot derive key: Failed to hash secret");
+    return nullptr;
+  }
+  if (digest.size() != kEccSessionKeySize) {
+    LOGE("Unexpected hash size: actual = %zu, expected = %zu", digest.size(),
+         kEccSessionKeySize);
+    return nullptr;
+  }
+  *key_size = kEccSessionKeySize;
+  memcpy(key, digest.data(), *key_size);
+  return key;
+}
+
+void OpensslFreeU8(uint8_t* ptr) { OPENSSL_free(ptr); }
+
+// Internal ECC public key serialization.
+OEMCryptoResult SerializeEccPublicKey(const EC_KEY* key, uint8_t* buffer,
+                                      size_t* buffer_size) {
+  if (buffer_size == nullptr) {
+    LOGE("Output buffer size is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (buffer == nullptr && *buffer_size > 0) {
+    LOGE("Output buffer is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+
+  uint8_t* der_key_raw = nullptr;
+  const int der_res = i2d_EC_PUBKEY(
+      const_cast<EC_KEY*>(key) /* Does not get modified */, &der_key_raw);
+  if (der_res < 0) {
+    LOGE("Public key serialization failed");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  ScopedObject<uint8_t, OpensslFreeU8> der_key(der_key_raw);
+  der_key_raw = nullptr;
+  if (!der_key) {
+    LOGE("Encoded key is unexpectedly null");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  if (der_res == 0) {
+    LOGE("Unexpected DER encoded size");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  const size_t required_size = static_cast<size_t>(der_res);
+  if (buffer == nullptr || *buffer_size < required_size) {
+    *buffer_size = required_size;
+    return OEMCrypto_ERROR_SHORT_BUFFER;
+  }
+  memcpy(buffer, der_key.get(), required_size);
+  *buffer_size = required_size;
+  return OEMCrypto_SUCCESS;
+}
+
+std::vector<uint8_t> SerializeEccPublicKey(const EC_KEY* key) {
+  size_t key_size = kPublicKeySize;
+  std::vector<uint8_t> key_data(key_size, 0);
+  const OEMCryptoResult res =
+      SerializeEccPublicKey(key, key_data.data(), &key_size);
+  if (res != OEMCrypto_SUCCESS) {
+    LOGE("Failed to serialize public key: result = %d", static_cast<int>(res));
+    key_data.clear();
+  } else {
+    key_data.resize(key_size);
+  }
+  return key_data;
+}
+
+bool ParseEccPrivateKeyInfo(const uint8_t* buffer, size_t length,
+                            ScopedEcKey* key, EccCurve* curve) {
+  if (length == 0) {
+    LOGE("Public key is too small: length  = %zu", length);
+    return false;
+  }
+  ScopedBio bio(BIO_new_mem_buf(buffer, static_cast<int>(length)));
+  if (!bio) {
+    LOGE("Failed to allocate BIO buffer");
+    return false;
+  }
+  // Step 1: Deserializes PKCS8 PrivateKeyInfo containing an ECC key.
+  ScopedPrivateKeyInfo priv_info(
+      d2i_PKCS8_PRIV_KEY_INFO_bio(bio.get(), nullptr));
+  if (!priv_info) {
+    LOGE("Failed to parse private key");
+    return false;
+  }
+  // Step 2: Convert to EC_KEY.
+  ScopedEvpPkey pkey(EVP_PKCS82PKEY(priv_info.get()));
+  if (!pkey) {
+    LOGE("Failed to convert PKCS8 to EVP");
+    return false;
+  }
+  const int key_type = EVP_PKEY_base_id(pkey.get());
+  if (key_type != EVP_PKEY_EC) {
+    LOGE("Decoded private key is not ECC");
+    return false;
+  }
+  key->reset(EVP_PKEY_get1_EC_KEY(pkey.get()));
+  if (!*key) {
+    LOGE("Failed to get ECC key");
+    return false;
+  }
+  // Step 3: Verify key parameters and curve family.
+  const int check = EC_KEY_check_key(key->get());
+  if (check == 0) {
+    LOGE("ECC key parameters are invalid");
+    return false;
+  } else if (check == -1) {
+    LOGE("Failed to check ECC key");
+    return false;
+  }
+  *curve = GetCurveFromKeyGroup(key->get());
+  if (*curve == kEccCurveUnknown) {
+    LOGE("Failed to determine key group");
+    return false;
+  }
+  // Required flags for IETF compliance.
+  EC_KEY_set_asn1_flag(key->get(), OPENSSL_EC_NAMED_CURVE);
+  EC_KEY_set_conv_form(key->get(), POINT_CONVERSION_UNCOMPRESSED);
+  return true;
+}
+}  // namespace
+
+std::string EccCurveToString(EccCurve curve) {
+  switch (curve) {
+    case kEccSecp256r1:
+      return "secp256r1";
+    case kEccSecp384r1:
+      return "secp384r1";
+    case kEccSecp521r1:
+      return "secp521r1";
+    case kEccCurveUnknown:
+      return "Unknown";
+  }
+  return "Unknown(" + std::to_string(static_cast<int>(curve)) + ")";
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::New(
+    const EccPrivateKey& private_key) {
+  std::unique_ptr<EccPublicKey> key(new EccPublicKey());
+  if (!key->InitFromPrivateKey(private_key)) {
+    LOGE("Failed to initialize public key from private key");
+    key.reset();
+  }
+  return key;
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::Load(const uint8_t* buffer,
+                                                 size_t length) {
+  if (buffer == nullptr) {
+    LOGE("Provided public key buffer is null");
+    return nullptr;
+  }
+  if (length == 0) {
+    LOGE("Provided public key buffer is zero length");
+    return nullptr;
+  }
+  std::unique_ptr<EccPublicKey> key(new EccPublicKey());
+  if (!key->InitFromSubjectPublicKeyInfo(buffer, length)) {
+    LOGE("Failed to initialize public key from SubjectPublicKeyInfo");
+    key.reset();
+  }
+  return key;
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::Load(const std::string& buffer) {
+  if (buffer.empty()) {
+    LOGE("Provided public key buffer is empty");
+    return std::unique_ptr<EccPublicKey>();
+  }
+  return Load(reinterpret_cast<const uint8_t*>(buffer.data()), buffer.size());
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::Load(
+    const std::vector<uint8_t>& buffer) {
+  if (buffer.empty()) {
+    LOGE("Provided public key buffer is empty");
+    return std::unique_ptr<EccPublicKey>();
+  }
+  return Load(buffer.data(), buffer.size());
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::LoadPrivateKeyInfo(
+    const uint8_t* buffer, size_t length) {
+  if (buffer == nullptr) {
+    LOGE("Provided public key buffer is null");
+    return nullptr;
+  }
+  if (length == 0) {
+    LOGE("Provided public key buffer is zero length");
+    return nullptr;
+  }
+  std::unique_ptr<EccPublicKey> key(new EccPublicKey());
+  if (!key->InitFromPrivateKeyInfo(buffer, length)) {
+    LOGE("Failed to initialize public key from PrivateKeyInfo");
+    key.reset();
+  }
+  return key;
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::LoadPrivateKeyInfo(
+    const std::string& buffer) {
+  if (buffer.empty()) {
+    LOGE("Provided public key buffer is empty");
+    return std::unique_ptr<EccPublicKey>();
+  }
+  return LoadPrivateKeyInfo(reinterpret_cast<const uint8_t*>(buffer.data()),
+                            buffer.size());
+}
+
+// static
+std::unique_ptr<EccPublicKey> EccPublicKey::LoadPrivateKeyInfo(
+    const std::vector<uint8_t>& buffer) {
+  if (buffer.empty()) {
+    LOGE("Provided public key buffer is empty");
+    return std::unique_ptr<EccPublicKey>();
+  }
+  return LoadPrivateKeyInfo(buffer.data(), buffer.size());
+}
+
+bool EccPublicKey::IsMatchingPrivateKey(
+    const EccPrivateKey& private_key) const {
+  if (private_key.curve() != curve_) {
+    return false;
+  }
+  return IsMatchingKeyPair(GetEcKey(), private_key.GetEcKey());
+}
+
+OEMCryptoResult EccPublicKey::Serialize(uint8_t* buffer,
+                                        size_t* buffer_size) const {
+  return SerializeEccPublicKey(key_, buffer, buffer_size);
+}
+
+std::vector<uint8_t> EccPublicKey::Serialize() const {
+  return SerializeEccPublicKey(key_);
+}
+
+OEMCryptoResult EccPublicKey::VerifySignature(const uint8_t* message,
+                                              size_t message_length,
+                                              const uint8_t* signature,
+                                              size_t signature_length) const {
+  if (signature == nullptr || signature_length == 0) {
+    LOGE("Signature is missing");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (message == nullptr && message_length > 0) {
+    LOGE("Bad message data");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  // Step 1: Parse signature.
+  const uint8_t* tp = signature;
+  ScopedSigPoint sig_point(d2i_ECDSA_SIG(nullptr, &tp, signature_length));
+  if (!sig_point) {
+    LOGE("Failed to parse signature");
+    // Most likely an invalid signature than an OpenSSL error.
+    return OEMCrypto_ERROR_SIGNATURE_FAILURE;
+  }
+  // Step 2: Hash message
+  std::vector<uint8_t> digest;
+  if (!DigestMessage(curve_, message, message_length, &digest)) {
+    LOGE("Failed to digest message");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 3: Verify signature
+  const int res = ECDSA_do_verify(
+      digest.data(), static_cast<int>(digest.size()), sig_point.get(), key_);
+  if (res == -1) {
+    LOGE("Error occurred checking signature");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  if (res == 0) {
+    LOGD("Signature did not match");
+    return OEMCrypto_ERROR_SIGNATURE_FAILURE;
+  }
+  return OEMCrypto_SUCCESS;
+}
+
+OEMCryptoResult EccPublicKey::VerifySignature(
+    const std::string& message, const std::string& signature) const {
+  if (signature.empty()) {
+    LOGE("Signature should not be empty");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  return VerifySignature(
+      reinterpret_cast<const uint8_t*>(message.data()), message.size(),
+      reinterpret_cast<const uint8_t*>(signature.data()), signature.size());
+}
+
+OEMCryptoResult EccPublicKey::VerifySignature(
+    const std::vector<uint8_t>& message,
+    const std::vector<uint8_t>& signature) const {
+  if (signature.empty()) {
+    LOGE("Signature should not be empty");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  return VerifySignature(message.data(), message.size(), signature.data(),
+                         signature.size());
+}
+
+EccPublicKey::~EccPublicKey() {
+  if (key_ != nullptr) {
+    EC_KEY_free(key_);
+    key_ = nullptr;
+  }
+  curve_ = kEccCurveUnknown;
+}
+
+bool EccPublicKey::InitFromSubjectPublicKeyInfo(const uint8_t* buffer,
+                                                size_t length) {
+  // Deserialize SubjectPublicKeyInfo
+  const uint8_t* tp = buffer;
+  ScopedEcKey key(d2i_EC_PUBKEY(nullptr, &tp, length));
+  if (!key) {
+    LOGE("Failed to parse ECC key");
+    return false;
+  }
+  // Verify key parameters and curve family.
+  const int check = EC_KEY_check_key(key.get());
+  if (check == 0) {
+    LOGE("ECC key parameters are invalid");
+    return false;
+  } else if (check == -1) {
+    LOGE("Failed to check ECC key");
+    return false;
+  }
+  curve_ = GetCurveFromKeyGroup(key.get());
+  if (curve_ == kEccCurveUnknown) {
+    LOGE("Failed to determine key group");
+    return false;
+  }
+  // Required flags for IETF compliance.
+  EC_KEY_set_asn1_flag(key.get(), OPENSSL_EC_NAMED_CURVE);
+  EC_KEY_set_conv_form(key.get(), POINT_CONVERSION_UNCOMPRESSED);
+  key_ = key.release();
+  return true;
+}
+
+bool EccPublicKey::InitFromPrivateKeyInfo(const uint8_t* buffer,
+                                          size_t length) {
+  ScopedEcKey private_key;
+  if (!ParseEccPrivateKeyInfo(buffer, length, &private_key, &curve_)) {
+    return false;
+  }
+  // TODO(sigquit): Strip private information.
+  key_ = private_key.release();
+  return true;
+}
+
+bool EccPublicKey::InitFromPrivateKey(const EccPrivateKey& private_key) {
+  ScopedEcKey key(EC_KEY_new());
+  if (!key) {
+    LOGE("Failed to allocate key");
+    return false;
+  }
+  if (!EC_KEY_set_group(key.get(), EC_KEY_get0_group(private_key.GetEcKey()))) {
+    LOGE("Failed to set group");
+    return false;
+  }
+  if (!EC_KEY_set_public_key(key.get(),
+                             EC_KEY_get0_public_key(private_key.GetEcKey()))) {
+    LOGE("Failed to set public point");
+    return false;
+  }
+  curve_ = private_key.curve();
+  // Required flags for IETF compliance.
+  EC_KEY_set_asn1_flag(key.get(), OPENSSL_EC_NAMED_CURVE);
+  EC_KEY_set_conv_form(key.get(), POINT_CONVERSION_UNCOMPRESSED);
+  key_ = key.release();
+  return true;
+}
+
+// static
+std::unique_ptr<EccPrivateKey> EccPrivateKey::New(EccCurve curve) {
+  std::unique_ptr<EccPrivateKey> key(new EccPrivateKey());
+  if (!key->InitFromCurve(curve)) {
+    LOGE("Failed to initialize private key from curve");
+    key.reset();
+  }
+  return key;
+}
+
+// static
+std::unique_ptr<EccPrivateKey> EccPrivateKey::Load(const uint8_t* buffer,
+                                                   size_t length) {
+  if (buffer == nullptr) {
+    LOGE("Provided private key buffer is null");
+    return nullptr;
+  }
+  if (length == 0) {
+    LOGE("Provided private key buffer is zero length");
+    return nullptr;
+  }
+  std::unique_ptr<EccPrivateKey> key(new EccPrivateKey());
+  if (!key->InitFromPrivateKeyInfo(buffer, length)) {
+    LOGE("Failed to initialize private key from PrivateKeyInfo");
+    key.reset();
+  }
+  return key;
+}
+
+// static
+std::unique_ptr<EccPrivateKey> EccPrivateKey::Load(const std::string& buffer) {
+  if (buffer.empty()) {
+    LOGE("Provided private key buffer is empty");
+    return std::unique_ptr<EccPrivateKey>();
+  }
+  return Load(reinterpret_cast<const uint8_t*>(buffer.data()), buffer.size());
+}
+
+// static
+std::unique_ptr<EccPrivateKey> EccPrivateKey::Load(
+    const std::vector<uint8_t>& buffer) {
+  if (buffer.empty()) {
+    LOGE("Provided private key buffer is empty");
+    return std::unique_ptr<EccPrivateKey>();
+  }
+  return Load(buffer.data(), buffer.size());
+}
+
+std::unique_ptr<EccPublicKey> EccPrivateKey::MakePublicKey() const {
+  return EccPublicKey::New(*this);
+}
+
+bool EccPrivateKey::IsMatchingPublicKey(const EccPublicKey& public_key) const {
+  if (public_key.curve() != curve_) {
+    return false;
+  }
+  return IsMatchingKeyPair(public_key.GetEcKey(), GetEcKey());
+}
+
+OEMCryptoResult EccPrivateKey::Serialize(uint8_t* buffer,
+                                         size_t* buffer_size) const {
+  if (buffer_size == nullptr) {
+    LOGE("Output buffer size is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (buffer == nullptr && *buffer_size > 0) {
+    LOGE("Output buffer is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  // Step 1: Convert EC_KEY key to EVP.
+  ScopedEvpPkey pkey(EVP_PKEY_new());
+  if (!pkey) {
+    LOGE("Failed to allocate EVP");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  if (!EVP_PKEY_set1_EC_KEY(pkey.get(), key_)) {
+    LOGE("Failed to set EVP ECC key");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 2: Convert ECC EVP to PKCS8 format.
+  ScopedPrivateKeyInfo priv_info(EVP_PKEY2PKCS8(pkey.get()));
+  if (!priv_info) {
+    LOGE("Failed to convert ECC key to PKCS8 info");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 3: Serialize PKCS8 to DER encoding.
+  ScopedBio bio(BIO_new(BIO_s_mem()));
+  if (!bio) {
+    LOGE("Failed to allocate IO buffer for ECC key");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  if (!i2d_PKCS8_PRIV_KEY_INFO_bio(bio.get(), priv_info.get())) {
+    LOGE("Failed to serialize ECC key");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 4: Determine key size and copy.
+  char* key_ptr = nullptr;
+  const long key_size = BIO_get_mem_data(bio.get(), &key_ptr);
+  if (key_size < 0) {
+    LOGE("Failed to get ECC key size");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  if (key_ptr == nullptr) {
+    LOGE("Encoded key is unexpectedly null");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  const size_t required_size = static_cast<size_t>(key_size);
+  if (*buffer_size < required_size) {
+    *buffer_size = required_size;
+    return OEMCrypto_ERROR_SHORT_BUFFER;
+  }
+  *buffer_size = required_size;
+  memcpy(buffer, key_ptr, required_size);
+  return OEMCrypto_SUCCESS;
+}
+
+std::vector<uint8_t> EccPrivateKey::Serialize() const {
+  size_t key_size = kPrivateKeySize;
+  std::vector<uint8_t> key_data(key_size, 0);
+  const OEMCryptoResult res = Serialize(key_data.data(), &key_size);
+  if (res != OEMCrypto_SUCCESS) {
+    LOGE("Failed to serialize private key: result = %d", static_cast<int>(res));
+    key_data.clear();
+  } else {
+    key_data.resize(key_size);
+  }
+  return key_data;
+}
+
+OEMCryptoResult EccPrivateKey::SerializeAsPublicKey(uint8_t* buffer,
+                                                    size_t* buffer_size) const {
+  return SerializeEccPublicKey(key_, buffer, buffer_size);
+}
+
+std::vector<uint8_t> EccPrivateKey::SerializeAsPublicKey() const {
+  return SerializeEccPublicKey(key_);
+}
+
+OEMCryptoResult EccPrivateKey::GenerateSignature(
+    const uint8_t* message, size_t message_length, uint8_t* signature,
+    size_t* signature_length) const {
+  if (signature_length == nullptr) {
+    LOGE("Output signature size is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (signature == nullptr && *signature_length > 0) {
+    LOGE("Output signature is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (message == nullptr && message_length > 0) {
+    LOGE("Invalid message data");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  const size_t expected_signature_length = ECDSA_size(key_);
+  if (*signature_length < expected_signature_length) {
+    *signature_length = expected_signature_length;
+    return OEMCrypto_ERROR_SHORT_BUFFER;
+  }
+
+  // Step 1: Hash message.
+  std::vector<uint8_t> digest;
+  if (!DigestMessage(curve_, message, message_length, &digest)) {
+    LOGE("Failed to digest message");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 2: Generate signature point.
+  ScopedSigPoint sig_point(
+      ECDSA_do_sign(digest.data(), static_cast<int>(digest.size()), key_));
+  if (!sig_point) {
+    LOGE("Failed to perform ECDSA");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  // Step 3: Serialize
+  std::vector<uint8_t> temp(expected_signature_length);
+  uint8_t* sig_ptr = temp.data();
+  const int res = i2d_ECDSA_SIG(sig_point.get(), &sig_ptr);
+  if (res <= 0) {
+    LOGE("Failed to serialize signature");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  const size_t required_size = static_cast<size_t>(res);
+  if (signature == nullptr || *signature_length < required_size) {
+    *signature_length = required_size;
+    return OEMCrypto_ERROR_SHORT_BUFFER;
+  }
+  memcpy(signature, temp.data(), required_size);
+  *signature_length = required_size;
+  return OEMCrypto_SUCCESS;
+}
+
+std::vector<uint8_t> EccPrivateKey::GenerateSignature(
+    const std::string& message) const {
+  size_t signature_size = SignatureSize();
+  std::vector<uint8_t> signature(signature_size, 0);
+  const OEMCryptoResult res =
+      GenerateSignature(reinterpret_cast<const uint8_t*>(message.data()),
+                        message.size(), signature.data(), &signature_size);
+  if (res != OEMCrypto_SUCCESS) {
+    LOGE("Failed to generate signature: result = %d", static_cast<int>(res));
+    signature.clear();
+  } else {
+    signature.resize(signature_size);
+  }
+  return signature;
+}
+
+std::vector<uint8_t> EccPrivateKey::GenerateSignature(
+    const std::vector<uint8_t>& message) const {
+  size_t signature_size = SignatureSize();
+  std::vector<uint8_t> signature(signature_size, 0);
+  const OEMCryptoResult res = GenerateSignature(
+      message.data(), message.size(), signature.data(), &signature_size);
+  if (res != OEMCrypto_SUCCESS) {
+    LOGE("Failed to generate signature: result = %d", static_cast<int>(res));
+    signature.clear();
+  } else {
+    signature.resize(signature_size);
+  }
+  return signature;
+}
+
+size_t EccPrivateKey::SignatureSize() const { return ECDSA_size(key_); }
+
+OEMCryptoResult EccPrivateKey::DeriveSessionKey(
+    const EccPublicKey& public_key, uint8_t* session_key,
+    size_t* session_key_size) const {
+  if (public_key.curve() != curve_) {
+    LOGE("Incompatible ECC keys: public = %s, private = %s",
+         EccCurveToString(public_key.curve()).c_str(),
+         EccCurveToString(curve_).c_str());
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (session_key_size == nullptr) {
+    LOGE("Output session key size buffer is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (session_key == nullptr && *session_key_size > 0) {
+    LOGE("Output session key buffer is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (*session_key_size < kEccSessionKeySize) {
+    *session_key_size = kEccSessionKeySize;
+    return OEMCrypto_ERROR_SHORT_BUFFER;
+  }
+  const int res = ECDH_compute_key(
+      session_key, kEccSessionKeySize,
+      EC_KEY_get0_public_key(public_key.GetEcKey()), key_, WidevineEccKdf);
+  if (res < 0) {
+    LOGE("ECDH error occurred");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  if (static_cast<size_t>(res) != kEccSessionKeySize) {
+    LOGE("Unexpected key size: size = %d", res);
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  *session_key_size = kEccSessionKeySize;
+  return OEMCrypto_SUCCESS;
+}
+
+std::vector<uint8_t> EccPrivateKey::DeriveSessionKey(
+    const EccPublicKey& public_key) const {
+  size_t session_key_size = kEccSessionKeySize;
+  std::vector<uint8_t> session_key(session_key_size, 0);
+  const OEMCryptoResult res =
+      DeriveSessionKey(public_key, session_key.data(), &session_key_size);
+  if (res != OEMCrypto_SUCCESS) {
+    LOGE("Failed to derive session key: result = %d", static_cast<int>(res));
+    session_key.clear();
+  } else {
+    session_key.resize(session_key_size);
+  }
+  return session_key;
+}
+
+size_t EccPrivateKey::SessionKeyLength() const { return kEccSessionKeySize; }
+
+EccPrivateKey::~EccPrivateKey() {
+  if (key_ != nullptr) {
+    EC_KEY_free(key_);
+    key_ = nullptr;
+  }
+  curve_ = kEccCurveUnknown;
+}
+
+bool EccPrivateKey::InitFromPrivateKeyInfo(const uint8_t* buffer,
+                                           size_t length) {
+  ScopedEcKey key;
+  if (!ParseEccPrivateKeyInfo(buffer, length, &key, &curve_)) return false;
+  key_ = key.release();
+  return true;
+}
+
+bool EccPrivateKey::InitFromCurve(EccCurve curve) {
+  const EC_GROUP* group = GetEcGroup(curve);
+  if (group == nullptr) {
+    LOGE("Failed to get ECC group");
+    return false;
+  }
+  ScopedEcKey key(EC_KEY_new());
+  if (!key) {
+    LOGE("Failed to allocate key");
+    return false;
+  }
+  if (!EC_KEY_set_group(key.get(), group)) {
+    LOGE("Failed to set group");
+    return false;
+  }
+  // Generate random key.
+  if (!EC_KEY_generate_key(key.get())) {
+    LOGE("Failed to generate random key");
+    return false;
+  }
+  curve_ = curve;
+  // Required flags for IETF compliance.
+  EC_KEY_set_asn1_flag(key.get(), OPENSSL_EC_NAMED_CURVE);
+  EC_KEY_set_conv_form(key.get(), POINT_CONVERSION_UNCOMPRESSED);
+  key_ = key.release();
+  return true;
+}
+}  // namespace util
+}  // namespace wvoec

libwvdrmengine/oemcrypto/util/src/oemcrypto_key_deriver.cpp

@@ -0,0 +1,154 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#include "oemcrypto_key_deriver.h"
+
+#include "log.h"
+
+namespace wvoec {
+namespace util {
+namespace {
+bool Derive128KeyAppend(Cmac* cmac, uint8_t counter, const uint8_t* ctx,
+                        size_t ctx_size, std::vector<uint8_t>* derived_key) {
+  cmac->Reset();
+  if (!cmac->Update(counter)) {
+    return false;
+  }
+  if (!cmac->Update(ctx, ctx_size)) {
+    return false;
+  }
+  if (!cmac->FinalizeAppend(derived_key)) {
+    return false;
+  }
+  return true;
+}
+
+bool Derive128Key(Cmac* cmac, uint8_t counter, const uint8_t* ctx,
+                  size_t ctx_size, std::vector<uint8_t>* derived_key) {
+  derived_key->clear();
+  return Derive128KeyAppend(cmac, counter, ctx, ctx_size, derived_key);
+}
+
+bool Derive256Key(Cmac* cmac, uint8_t counter_base, const uint8_t* ctx,
+                  size_t ctx_size, std::vector<uint8_t>* derived_key) {
+  derived_key->clear();
+  if (!Derive128KeyAppend(cmac, counter_base, ctx, ctx_size, derived_key)) {
+    return false;
+  }
+  return Derive128KeyAppend(cmac, counter_base + 1, ctx, ctx_size, derived_key);
+}
+}  // namespace
+
+// static
+std::unique_ptr<KeyDeriver> KeyDeriver::Create(const uint8_t* key,
+                                               size_t key_size) {
+  if (key == nullptr) {
+    LOGE("Key deriver key is null");
+    return std::unique_ptr<KeyDeriver>();
+  }
+  std::unique_ptr<KeyDeriver> key_deriver(new KeyDeriver());
+  if (!key_deriver->Init(key, key_size)) {
+    key_deriver.reset();
+  }
+  return key_deriver;
+}
+
+// static
+std::unique_ptr<KeyDeriver> KeyDeriver::Create(
+    const std::vector<uint8_t>& key) {
+  if (key.empty()) {
+    LOGE("Key deriver key is empty");
+    return std::unique_ptr<KeyDeriver>();
+  }
+  return Create(key.data(), key.size());
+}
+
+bool KeyDeriver::Init(const uint8_t* key, size_t key_size) {
+  cmac_ = Cmac::Create(key, key_size);
+  if (!cmac_) {
+    LOGE("Failed to create CMAC for key deriver");
+    return false;
+  }
+  return true;
+}
+
+bool KeyDeriver::DeriveServerMacKey(const uint8_t* mac_key_context,
+                                    size_t mac_key_context_size,
+                                    std::vector<uint8_t>* mac_key_server) {
+  if (mac_key_context == nullptr) {
+    LOGE("Server MAC key context is null");
+    return false;
+  }
+  if (mac_key_server == nullptr) {
+    LOGE("Output server MAC key buffer is null");
+    return false;
+  }
+  return Derive256Key(cmac_.get(), 0x01, mac_key_context, mac_key_context_size,
+                      mac_key_server);
+}
+
+bool KeyDeriver::DeriveServerMacKey(const std::vector<uint8_t>& mac_key_context,
+                                    std::vector<uint8_t>* mac_key_server) {
+  if (mac_key_context.empty()) {
+    LOGE("Server MAC key context is empty");
+    return false;
+  }
+  return DeriveServerMacKey(mac_key_context.data(), mac_key_context.size(),
+                            mac_key_server);
+}
+
+bool KeyDeriver::DeriveClientMacKey(const uint8_t* mac_key_context,
+                                    size_t mac_key_context_size,
+                                    std::vector<uint8_t>* mac_key_client) {
+  if (mac_key_context == nullptr) {
+    LOGE("Client MAC key context is null");
+    return false;
+  }
+  if (mac_key_client == nullptr) {
+    LOGE("Output client MAC key buffer is null");
+    return false;
+  }
+  return Derive256Key(cmac_.get(), 0x03, mac_key_context, mac_key_context_size,
+                      mac_key_client);
+}
+
+bool KeyDeriver::DeriveClientMacKey(const std::vector<uint8_t>& mac_key_context,
+                                    std::vector<uint8_t>* mac_key_client) {
+  if (mac_key_context.empty()) {
+    LOGE("Client MAC key context is empty");
+    return false;
+  }
+  return DeriveClientMacKey(mac_key_context.data(), mac_key_context.size(),
+                            mac_key_client);
+}
+
+bool KeyDeriver::DeriveEncryptionKey(const uint8_t* enc_key_context,
+                                     size_t enc_key_context_size,
+                                     std::vector<uint8_t>* enc_key) {
+  if (enc_key_context == nullptr) {
+    LOGE("Encryption key context is null");
+    return false;
+  }
+  if (enc_key == nullptr) {
+    LOGE("Output encryption key buffer is null");
+    return false;
+  }
+  return Derive128Key(cmac_.get(), 0x01, enc_key_context, enc_key_context_size,
+                      enc_key);
+}
+
+bool KeyDeriver::DeriveEncryptionKey(
+    const std::vector<uint8_t>& enc_key_context,
+    std::vector<uint8_t>* enc_key) {
+  if (enc_key_context.empty()) {
+    LOGE("Encryption key context is empty");
+    return false;
+  }
+  return DeriveEncryptionKey(enc_key_context.data(), enc_key_context.size(),
+                             enc_key);
+}
+}  // namespace util
+}  // namespace wvoec

libwvdrmengine/oemcrypto/util/src/oemcrypto_oem_cert.cpp

@@ -0,0 +1,234 @@
+// Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine License
+// Agreement.
+//
+//  Reference implementation utilities of OEMCrypto APIs
+//
+#include "oemcrypto_oem_cert.h"
+
+#include <string.h>
+
+#include <openssl/pkcs7.h>
+#include <openssl/rsa.h>
+#include <openssl/x509.h>
+
+#include "log.h"
+#include "oemcrypto_rsa_key.h"
+#include "scoped_object.h"
+
+namespace wvoec {
+namespace util {
+namespace {
+using ScopedCertificate = ScopedObject<X509, X509_free>;
+using ScopedEvpKey = ScopedObject<EVP_PKEY, EVP_PKEY_free>;
+using ScopedPkcs7 = ScopedObject<PKCS7, PKCS7_free>;
+
+constexpr size_t kExpectedCertCount = 2;  // Leaf and intermediate.
+constexpr int kDeviceCertIndex = 0;
+
+// Checks that the |public_key| from an X.509 certificate is the
+// correct public key of the serialized |private_key_data|.
+OEMCryptoResult VerifyRsaKey(const RSA* public_key,
+                             const std::vector<uint8_t>& private_key_data) {
+  if (public_key == nullptr) {
+    LOGE("RSA key is null");
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+  std::unique_ptr<RsaPrivateKey> private_key =
+      RsaPrivateKey::Load(private_key_data);
+  if (!private_key) {
+    LOGE("Failed to parse provided RSA private key");
+    return OEMCrypto_ERROR_INVALID_RSA_KEY;
+  }
+  if (!RsaKeysAreMatchingPair(public_key, private_key->GetRsaKey())) {
+    LOGE("OEM certificate keys do not match");
+    return OEMCrypto_ERROR_INVALID_RSA_KEY;
+  }
+  return OEMCrypto_SUCCESS;
+}
+}  // namespace
+
+// This utility class encapsulates the minimum functionality of an
+// OEM Public Certificate required to verify a device's OEM Public
+// Certificate.
+class OemPublicCertificate {
+ public:
+  // Loads a PKCS #7 signedData message with certificate chain.
+  // Minimum validation is performed.  Only checks that the
+  // device's public key is of a known type (RSA).
+  static std::unique_ptr<OemPublicCertificate> Load(const uint8_t* public_cert,
+                                                    size_t public_cert_size) {
+    std::unique_ptr<OemPublicCertificate> oem_public_cert;
+    if (public_cert == nullptr) {
+      LOGE("Public cert buffer is null");
+      return oem_public_cert;
+    }
+    if (public_cert_size == 0) {
+      LOGE("Public cert buffer is empty");
+      return oem_public_cert;
+    }
+    oem_public_cert.reset(new OemPublicCertificate());
+    if (!oem_public_cert->InitFromBuffer(public_cert, public_cert_size)) {
+      oem_public_cert.reset();
+    }
+    return oem_public_cert;
+  }
+
+  OemCertificate::KeyType key_type() const { return key_type_; }
+  const std::vector<uint8_t>& cert_data() const { return cert_data_; }
+
+  const RSA* GetPublicRsaKey() const {
+    return EVP_PKEY_get0_RSA(device_public_key_.get());
+  }
+
+  ~OemPublicCertificate() = default;
+
+  OemPublicCertificate(const OemPublicCertificate&) = delete;
+  OemPublicCertificate(OemPublicCertificate&&) = delete;
+  const OemPublicCertificate& operator=(const OemPublicCertificate&) = delete;
+  OemPublicCertificate& operator=(OemPublicCertificate&&) = delete;
+
+ private:
+  OemPublicCertificate() {}
+
+  bool InitFromBuffer(const uint8_t* public_cert, size_t public_cert_size) {
+    // Step 1: Parse the PKCS7 certificate chain as signedData.
+    const uint8_t* public_cert_ptr = public_cert;
+    pkcs7_.reset(d2i_PKCS7(nullptr, &public_cert_ptr, public_cert_size));
+    if (!pkcs7_) {
+      LOGE("Failed to parse PKCS#7 certificate chain");
+      return false;
+    }
+    if (!PKCS7_type_is_signed(pkcs7_.get())) {
+      LOGE("OEM Public Certificate is not PKCS#7 signed data");
+      return false;
+    }
+    PKCS7_SIGNED* signed_data = pkcs7_->d.sign;
+    // Step 2: Get the leaf certificate.
+    const size_t cert_count =
+        static_cast<size_t>(sk_X509_num(signed_data->cert));
+    if (cert_count != kExpectedCertCount) {
+      LOGE("Unexpected number of certificates: expected = %zu, actual = %zu",
+           kExpectedCertCount, cert_count);
+      return false;
+    }
+    X509* leaf_cert = sk_X509_value(signed_data->cert, kDeviceCertIndex);
+    // Step 3a: Get the device's public key.
+    device_public_key_.reset(X509_get_pubkey(leaf_cert));
+    if (!device_public_key_) {
+      LOGE("Device X.509 certificate is missing a public key");
+      return false;
+    }
+    // Step 3b: Check key type.
+    if (EVP_PKEY_get0_RSA(device_public_key_.get()) == nullptr) {
+      LOGE("Device public key is not RSA");
+      return false;
+    }
+    key_type_ = OemCertificate::kRsa;
+    cert_data_.assign(public_cert, public_cert + public_cert_size);
+    return true;
+  }
+
+  OemCertificate::KeyType key_type_ = OemCertificate::kNone;
+  // OpenSSL/BoringSSL's implementation of PKCS7 objects.
+  ScopedPkcs7 pkcs7_;
+  ScopedEvpKey device_public_key_;
+  std::vector<uint8_t> cert_data_;
+};
+
+// ===== ===== ===== OEM Certificate ===== ===== =====
+
+// static
+std::unique_ptr<OemCertificate> OemCertificate::Create(
+    const uint8_t* private_key_data, size_t private_key_size,
+    const uint8_t* public_cert_data, size_t public_cert_size) {
+  std::unique_ptr<OemCertificate> oem_cert;
+  // Step 1: Verify public cert is well-formed.
+  std::unique_ptr<OemPublicCertificate> oem_public_cert =
+      OemPublicCertificate::Load(public_cert_data, public_cert_size);
+  if (!oem_public_cert) {
+    LOGE("Invalid OEM Public Certificate");
+    return oem_cert;
+  }
+  // Step 2: Verify private key is well-formed.
+  switch (oem_public_cert->key_type()) {
+    case kRsa: {
+      std::unique_ptr<RsaPrivateKey> oem_private_key =
+          RsaPrivateKey::Load(private_key_data, private_key_size);
+      if (!oem_private_key) {
+        LOGE("Invalid OEM Private Key");
+        return oem_cert;
+      }
+    } break;
+    case kNone:  // Suppress compiler warnings.
+      return oem_cert;
+  }
+  // Step 3: Copy over data.
+  oem_cert.reset(new OemCertificate());
+  oem_cert->private_key_.assign(private_key_data,
+                                private_key_data + private_key_size);
+  oem_cert->public_cert_ = std::move(oem_public_cert);
+  return oem_cert;
+}
+
+// static
+std::unique_ptr<OemCertificate> OemCertificate::Create(
+    const std::vector<uint8_t>& private_key,
+    const std::vector<uint8_t>& public_cert) {
+  if (private_key.empty()) {
+    LOGE("Private key buffer is empty");
+    return std::unique_ptr<OemCertificate>();
+  }
+  if (public_cert.empty()) {
+    LOGE("Public cert buffer is empty");
+    return std::unique_ptr<OemCertificate>();
+  }
+  return Create(private_key.data(), private_key.size(), public_cert.data(),
+                public_cert.size());
+}
+
+OemCertificate::KeyType OemCertificate::key_type() const {
+  return public_cert_->key_type();
+}
+
+OEMCryptoResult OemCertificate::GetPublicCertificate(
+    uint8_t* public_cert, size_t* public_cert_length) const {
+  if (public_cert_length == nullptr) {
+    LOGE("Output |public_cert_length| is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (public_cert == nullptr && *public_cert_length > 0) {
+    LOGE("Output |public_cert| is null");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  const std::vector<uint8_t>& cert_data = public_cert_->cert_data();
+  if (*public_cert_length < cert_data.size()) {
+    *public_cert_length = cert_data.size();
+    return OEMCrypto_ERROR_SHORT_BUFFER;
+  }
+  *public_cert_length = cert_data.size();
+  memcpy(public_cert, cert_data.data(), cert_data.size());
+  return OEMCrypto_SUCCESS;
+}
+
+const std::vector<uint8_t>& OemCertificate::GetPublicCertificate() const {
+  return public_cert_->cert_data();
+}
+
+OEMCryptoResult OemCertificate::IsCertificateValid() const {
+  switch (key_type()) {
+    case kRsa:
+      return VerifyRsaKey(public_cert_->GetPublicRsaKey(), private_key_);
+    case kNone:  // Suppress compiler warnings.
+      break;
+  }
+  LOGE("Unexpected error key type: type = %d", static_cast<int>(key_type()));
+  return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+}
+
+// Constructor and destructor do not perform anything special, but
+// must be declared within a scope which defines OemPublicCertificate.
+OemCertificate::OemCertificate() {}
+OemCertificate::~OemCertificate() {}
+}  // namespace util
+}  // namespace wvoec

libwvdrmengine/oemcrypto/util/src/wvcrc.cpp

@@ -0,0 +1,88 @@
+// Copyright 2018 Google LLC. All Rights Reserved. This file and proprietary
+// source code may only be used and distributed under the Widevine
+// License Agreement.
+//
+// Compute CRC32/MPEG2 Checksum. Needed for verification of WV Keybox.
+//
+#include "platform.h"
+#include "wvcrc32.h"
+
+namespace wvoec {
+namespace util {
+#define INIT_CRC32 0xffffffff
+
+uint32_t wvrunningcrc32(const uint8_t* p_begin, size_t i_count,
+                        uint32_t i_crc) {
+  constexpr uint32_t CRC32[256] = {
+      0x00000000, 0x04c11db7, 0x09823b6e, 0x0d4326d9, 0x130476dc, 0x17c56b6b,
+      0x1a864db2, 0x1e475005, 0x2608edb8, 0x22c9f00f, 0x2f8ad6d6, 0x2b4bcb61,
+      0x350c9b64, 0x31cd86d3, 0x3c8ea00a, 0x384fbdbd, 0x4c11db70, 0x48d0c6c7,
+      0x4593e01e, 0x4152fda9, 0x5f15adac, 0x5bd4b01b, 0x569796c2, 0x52568b75,
+      0x6a1936c8, 0x6ed82b7f, 0x639b0da6, 0x675a1011, 0x791d4014, 0x7ddc5da3,
+      0x709f7b7a, 0x745e66cd, 0x9823b6e0, 0x9ce2ab57, 0x91a18d8e, 0x95609039,
+      0x8b27c03c, 0x8fe6dd8b, 0x82a5fb52, 0x8664e6e5, 0xbe2b5b58, 0xbaea46ef,
+      0xb7a96036, 0xb3687d81, 0xad2f2d84, 0xa9ee3033, 0xa4ad16ea, 0xa06c0b5d,
+      0xd4326d90, 0xd0f37027, 0xddb056fe, 0xd9714b49, 0xc7361b4c, 0xc3f706fb,
+      0xceb42022, 0xca753d95, 0xf23a8028, 0xf6fb9d9f, 0xfbb8bb46, 0xff79a6f1,
+      0xe13ef6f4, 0xe5ffeb43, 0xe8bccd9a, 0xec7dd02d, 0x34867077, 0x30476dc0,
+      0x3d044b19, 0x39c556ae, 0x278206ab, 0x23431b1c, 0x2e003dc5, 0x2ac12072,
+      0x128e9dcf, 0x164f8078, 0x1b0ca6a1, 0x1fcdbb16, 0x018aeb13, 0x054bf6a4,
+      0x0808d07d, 0x0cc9cdca, 0x7897ab07, 0x7c56b6b0, 0x71159069, 0x75d48dde,
+      0x6b93dddb, 0x6f52c06c, 0x6211e6b5, 0x66d0fb02, 0x5e9f46bf, 0x5a5e5b08,
+      0x571d7dd1, 0x53dc6066, 0x4d9b3063, 0x495a2dd4, 0x44190b0d, 0x40d816ba,
+      0xaca5c697, 0xa864db20, 0xa527fdf9, 0xa1e6e04e, 0xbfa1b04b, 0xbb60adfc,
+      0xb6238b25, 0xb2e29692, 0x8aad2b2f, 0x8e6c3698, 0x832f1041, 0x87ee0df6,
+      0x99a95df3, 0x9d684044, 0x902b669d, 0x94ea7b2a, 0xe0b41de7, 0xe4750050,
+      0xe9362689, 0xedf73b3e, 0xf3b06b3b, 0xf771768c, 0xfa325055, 0xfef34de2,
+      0xc6bcf05f, 0xc27dede8, 0xcf3ecb31, 0xcbffd686, 0xd5b88683, 0xd1799b34,
+      0xdc3abded, 0xd8fba05a, 0x690ce0ee, 0x6dcdfd59, 0x608edb80, 0x644fc637,
+      0x7a089632, 0x7ec98b85, 0x738aad5c, 0x774bb0eb, 0x4f040d56, 0x4bc510e1,
+      0x46863638, 0x42472b8f, 0x5c007b8a, 0x58c1663d, 0x558240e4, 0x51435d53,
+      0x251d3b9e, 0x21dc2629, 0x2c9f00f0, 0x285e1d47, 0x36194d42, 0x32d850f5,
+      0x3f9b762c, 0x3b5a6b9b, 0x0315d626, 0x07d4cb91, 0x0a97ed48, 0x0e56f0ff,
+      0x1011a0fa, 0x14d0bd4d, 0x19939b94, 0x1d528623, 0xf12f560e, 0xf5ee4bb9,
+      0xf8ad6d60, 0xfc6c70d7, 0xe22b20d2, 0xe6ea3d65, 0xeba91bbc, 0xef68060b,
+      0xd727bbb6, 0xd3e6a601, 0xdea580d8, 0xda649d6f, 0xc423cd6a, 0xc0e2d0dd,
+      0xcda1f604, 0xc960ebb3, 0xbd3e8d7e, 0xb9ff90c9, 0xb4bcb610, 0xb07daba7,
+      0xae3afba2, 0xaafbe615, 0xa7b8c0cc, 0xa379dd7b, 0x9b3660c6, 0x9ff77d71,
+      0x92b45ba8, 0x9675461f, 0x8832161a, 0x8cf30bad, 0x81b02d74, 0x857130c3,
+      0x5d8a9099, 0x594b8d2e, 0x5408abf7, 0x50c9b640, 0x4e8ee645, 0x4a4ffbf2,
+      0x470cdd2b, 0x43cdc09c, 0x7b827d21, 0x7f436096, 0x7200464f, 0x76c15bf8,
+      0x68860bfd, 0x6c47164a, 0x61043093, 0x65c52d24, 0x119b4be9, 0x155a565e,
+      0x18197087, 0x1cd86d30, 0x029f3d35, 0x065e2082, 0x0b1d065b, 0x0fdc1bec,
+      0x3793a651, 0x3352bbe6, 0x3e119d3f, 0x3ad08088, 0x2497d08d, 0x2056cd3a,
+      0x2d15ebe3, 0x29d4f654, 0xc5a92679, 0xc1683bce, 0xcc2b1d17, 0xc8ea00a0,
+      0xd6ad50a5, 0xd26c4d12, 0xdf2f6bcb, 0xdbee767c, 0xe3a1cbc1, 0xe760d676,
+      0xea23f0af, 0xeee2ed18, 0xf0a5bd1d, 0xf464a0aa, 0xf9278673, 0xfde69bc4,
+      0x89b8fd09, 0x8d79e0be, 0x803ac667, 0x84fbdbd0, 0x9abc8bd5, 0x9e7d9662,
+      0x933eb0bb, 0x97ffad0c, 0xafb010b1, 0xab710d06, 0xa6322bdf, 0xa2f33668,
+      0xbcb4666d, 0xb8757bda, 0xb5365d03, 0xb1f740b4};
+
+  /* Calculate the CRC */
+  while (i_count > 0) {
+    i_crc = (i_crc << 8) ^ CRC32[(i_crc >> 24) ^ ((uint32_t) * p_begin)];
+    p_begin++;
+    i_count--;
+  }
+
+  return(i_crc);
+}
+
+uint32_t wvcrc32(const uint8_t* p_begin, size_t i_count) {
+  return(wvrunningcrc32(p_begin, i_count, INIT_CRC32));
+}
+
+uint32_t wvcrc32Init() {
+  return INIT_CRC32;
+}
+
+uint32_t wvcrc32Cont(const uint8_t* p_begin, size_t i_count,
+                     uint32_t prev_crc) {
+  return(wvrunningcrc32(p_begin, i_count, prev_crc));
+}
+
+uint32_t wvcrc32n(const uint8_t* p_begin, size_t i_count) {
+  return htonl(wvrunningcrc32(p_begin, i_count, INIT_CRC32));
+}
+}  // namespace util
+}  // namespace wvoec