Changed OAuth token+secret encryption to use supplemental user key.

crypto/nss_util.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CRYPTO_NSS_UTIL_H_
 #define CRYPTO_NSS_UTIL_H_
 #pragma once
 
 #include <string>
 #include "base/basictypes.h"
@@ skipping 115 matching lines @@
 
 // Returns true if the TPM is owned and PKCS#11 initialized with the
 // user and security officer PINs, and has been enabled in NSS by
 // calling EnableTPMForNSS, and opencryptoki has been successfully
 // loaded into NSS.
 CRYPTO_EXPORT bool IsTPMTokenReady();
 
 // Same as IsTPMTokenReady() except this attempts to initialize the token
 // if necessary.
 CRYPTO_EXPORT bool EnsureTPMTokenReady();
+
+// Gets supplemental user key. Creates one in NSS database if it does not exist.
+CRYPTO_EXPORT bool GetSupplementalUserKey(std::string* user_key);
+
+// Encrypt/decrypt |data| with supplemental user key.
+CRYPTO_EXPORT bool EncryptWithSupplementalUserKey(const std::string& data,
+                                                  std::string* encryped_data);
+CRYPTO_EXPORT bool DecryptWithSupplementalUserKey(const std::string& data,
+                                                  std::string* encryped_data);

[wtc, 2011/09/02 22:31:08]

It seems better to move these functions to some other files.
They don't seem like "NSS utils" to me.  Perhaps new files
for supplemental user key would be a good idea.

Nit: on line 140, change "Encrypt/decrypt" to "Encrypts/decrypts".

Nit: on line 144, the parameter should be named decrypted_data.

I am surprised that I don't need to pass the supplemental
user key as an argument to EncryptWithSupplementalUserKey
and DecryptWithSupplementalUserKey.

 #endif
 
 // Convert a NSS PRTime value into a base::Time object.
 // We use a int64 instead of PRTime here to avoid depending on NSPR headers.
 CRYPTO_EXPORT base::Time PRTimeToBaseTime(int64 prtime);
 
 #if defined(USE_NSS)
 // Exposed for unittests only.  |path| should be an existing directory under
 // which the DB files will be placed.  |description| is a user-visible name for
 // the DB, as a utf8 string, which will be truncated at 32 bytes.
@@ skipping 19 matching lines @@
  private:
   base::Lock *lock_;
   DISALLOW_COPY_AND_ASSIGN(AutoNSSWriteLock);
 };
 
 #endif  // defined(USE_NSS)
 
 }  // namespace crypto
 
 #endif  // CRYPTO_NSS_UTIL_H_