Make generate_symmetric_key more generic.

Added a method generate_session_key() which should be used when
wrapping secrets for the drm.  For now, this has to be a 168-bit
3DES symmetric key.

2 files changed, 27 insertions, 8 deletions

diff --git a/base/common/python/pki/cryptoutil.py b/base/common/python/pki/cryptoutil.py
index b5d5fdc13..b39259dd5 100644
--- a/base/common/python/pki/cryptoutil.py
+++ b/base/common/python/pki/cryptoutil.py
@@ -46,11 +46,17 @@ class CryptoUtil(object):
         pass
 
     @abc.abstractmethod
-    def generate_symmetric_key(self, mechanism=None):
+    def generate_symmetric_key(self, mechanism=None, size=0):
         ''' Generate and return a symmetric key '''
         pass
 
     @abc.abstractmethod
+    def generate_session_key(self):
+        ''' Generate a session key to be used for wrapping data to the DRM
+        This must return a 3DES 168 bit key '''
+        pass
+
+    @abc.abstractmethod
     def symmetric_wrap(self, data, wrapping_key, mechanism=None, nonce_iv=None):
         ''' encrypt data using a symmetric key (wrapping key)'''
         pass
@@ -166,10 +172,23 @@ class NSSCryptoUtil(CryptoUtil):
 
         return encoding_ctx, decoding_ctx
 
-    def generate_symmetric_key(self, mechanism=nss.CKM_DES3_CBC_PAD):
-        ''' Returns a symmetric key.'''
+    def generate_symmetric_key(self, mechanism=nss.CKM_DES3_CBC_PAD, size=0):
+        ''' Returns a symmetric key.
+
+        Note that for fixed length keys, this length should be 0.  If no length
+        is provided, then the function will either use 0 (for fixed length keys)
+        or the maximaum available length for that algorithm and the token.
+        '''
         slot = nss.get_best_slot(mechanism)
-        return slot.key_gen(mechanism, None, slot.get_best_key_length(mechanism))
+        if size == 0:
+            size = slot.get_best_key_length(mechanism)
+        return slot.key_gen(mechanism, None, size)
+
+    def generate_session_key(self):
+        ''' Returns a session key to be used when wrapping secrets for the DRM
+        This will return a 168 bit 3DES key.
+        '''
+        return self.generate_symmetric_key(mechanism=nss.CKM_DES3_CBC_PAD)
 
     def symmetric_wrap(self, data, wrapping_key, mechanism=nss.CKM_DES3_CBC_PAD, nonce_iv=None):
         '''
diff --git a/base/common/python/pki/key.py b/base/common/python/pki/key.py
index 3fa5952db..b4158fed6 100644
--- a/base/common/python/pki/key.py
+++ b/base/common/python/pki/key.py
@@ -433,7 +433,7 @@ class KeyClient(object):
         if secret is None:
             raise ValueError("secret must be specified")
 
-        session_key = self.crypto.generate_symmetric_key()
+        session_key = self.crypto.generate_session_key()
         trans_wrapped_session_key = self.crypto.asymmetric_wrap(session_key, self.transport_cert)
         wrapped_secret = self.crypto.symmetric_wrap(secret, session_key)
 
@@ -591,7 +591,7 @@ class KeyClient(object):
         to authorize the recovery.
 
         To ensure data security in transit, the data will be returned encrypted by a session
-        key (56 bit DES3 symmetric key) - which is first wrapped (encrypted) by the public
+        key (168 bit 3DES symmetric key) - which is first wrapped (encrypted) by the public
         key of the DRM transport certificate before being sent to the DRM.  The
         parameter trans_wrapped_session_key refers to this wrapped session key.
 
@@ -616,7 +616,7 @@ class KeyClient(object):
         key_provided = True
         if trans_wrapped_session_key is None:
             key_provided = False
-            session_key = self.crypto.generate_symmetric_key()
+            session_key = self.crypto.generate_session_key()
             trans_wrapped_session_key = self.crypto.asymmetric_wrap(session_key,
                                                                     self.transport_cert)
 
@@ -660,7 +660,7 @@ class KeyClient(object):
         In this case, CryptoUtil methods will be called to create the data to securely send the
         passphrase to the DRM.  Basically, three pieces of data will be sent:
 
-        - the passphrase wrapped by a 56 bit DES3 symmetric key (the session key).  This
+        - the passphrase wrapped by a 168 bit 3DES symmetric key (the session key).  This
           is referred to as the parameter session_wrapped_passphrase above.
 
         - the session key wrapped with the public key in the DRM transport certificate.  This