Bug 1770885 - Don't verify the origin-trials public key. r=smaug

This takes half the time of the signature validation process, and we
trust the key we're providing, so we shouldn't need to do this.

Plus, PK11_VerifyWithMechanism verifies the key again
(see bug 1770921).

Differential Revision: https://phabricator.services.mozilla.com/D147171

dom/crypto/CryptoKey.cpp

@@ -862,7 +862,8 @@ nsresult CryptoKey::PrivateKeyToJwk(SECKEYPrivateKey* aPrivKey,
 }
 
 UniqueSECKEYPublicKey CreateECPublicKey(const SECItem* aKeyData,
-                                        const nsAString& aNamedCurve) {
+                                        const nsAString& aNamedCurve,
+                                        bool aVerifyValid) {
   UniquePLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
   if (!arena) {
     return nullptr;
@@ -893,9 +894,10 @@ UniqueSECKEYPublicKey CreateECPublicKey(const SECItem* aKeyData,
   key->u.ec.publicValue = *aKeyData;
 
   // Ensure the given point is on the curve.
-  if (!CryptoKey::PublicKeyValid(key.get())) {
+  if (aVerifyValid && !CryptoKey::PublicKeyValid(key.get())) {
     return nullptr;
   }
+  MOZ_ASSERT(aVerifyValid || CryptoKey::PublicKeyValid(key.get()));
 
   return UniqueSECKEYPublicKey(SECKEY_CopyPublicKey(key.get()));
 }

dom/crypto/WebCryptoCommon.h

@@ -315,7 +315,8 @@ inline SECItem* CreateECParamsForCurve(const nsAString& aNamedCurve,
 
 // Implemented in CryptoKey.cpp
 UniqueSECKEYPublicKey CreateECPublicKey(const SECItem* aKeyData,
-                                        const nsAString& aNamedCurve);
+                                        const nsAString& aNamedCurve,
+                                        bool aVerifyValid = true);
 
 }  // namespace mozilla::dom
 

dom/origin-trials/OriginTrials.cpp

@@ -56,15 +56,20 @@ bool VerifySignature(const uint8_t* aSignature, uintptr_t aSignatureLen,
   MOZ_RELEASE_ASSERT(aSignatureLen == 64);
   LOG("VerifySignature()\n");
 
-  const unsigned char* key = StaticPrefs::dom_origin_trials_test_key_enabled()
-                                 ? kTestKey
-                                 : kProdKey;
+  const unsigned char* key =
+      StaticPrefs::dom_origin_trials_test_key_enabled() ? kTestKey : kProdKey;
 
   static_assert(sizeof(kTestKey) == sizeof(kProdKey));
   const SECItem rawKey{siBuffer, const_cast<unsigned char*>(key),
                        sizeof(kProdKey)};
   MOZ_RELEASE_ASSERT(rawKey.data[0] == EC_POINT_FORM_UNCOMPRESSED);
-  UniqueSECKEYPublicKey pubKey = dom::CreateECPublicKey(&rawKey, kEcAlgorithm);
+
+  // Key verification takes a lot of time when verifying tokens, and it is
+  // unnecessary work since the keys are trusted.
+  const bool kVerifyValid = false;
+
+  UniqueSECKEYPublicKey pubKey =
+      dom::CreateECPublicKey(&rawKey, kEcAlgorithm, kVerifyValid);
   if (NS_WARN_IF(!pubKey)) {
     LOG("  Failed to create public key?");
     return false;