Fixed slot selection in HMAC class to ensure that we are using softtoken instead of TPM slots.

crypto/hmac_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/hmac.h"
 
 #include <nss.h>
 #include <pk11pub.h>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "crypto/nss_util.h"
 #include "crypto/scoped_nss_types.h"
 
+#if defined(OS_CHROMEOS)
+#include "crypto/nss_util_internal.h"
+#endif
+
 namespace crypto {
 
 struct HMACPlatformData {
   CK_MECHANISM_TYPE mechanism_;
   ScopedPK11Slot slot_;
   ScopedPK11SymKey sym_key_;
 };
 
 HMAC::HMAC(HashAlgorithm hash_alg)
     : hash_alg_(hash_alg), plat_(new HMACPlatformData()) {
@@ skipping 16 matching lines @@
 
 bool HMAC::Init(const unsigned char *key, int key_length) {
   EnsureNSSInit();
 
   if (plat_->slot_.get()) {
     // Init must not be called more than twice on the same HMAC object.
     NOTREACHED();
     return false;
   }
 
+#if defined(OS_CHROMEOS)
+  // TODO(zelidrag): http://crosbug.com/21633
+  // For yet unknown reasons, on ChromeOS PK11_GetBestSlot is matching slot from
+  // TPM here on a fresh machine when an account is just created. Need to
+  // investigate what is the underlying cause of this transient behavior.
+  plat_->slot_.reset(GetPublicNSSKeySlot());
+#else
   plat_->slot_.reset(PK11_GetBestSlot(plat_->mechanism_, NULL));

[wtc, 2011/10/22 22:58:23]

Please try
    plat_->slot_.reset(PK11_GetInternalSlot());

If that works, that's my preferred solution.

PK11_GetInternalSlot() returns a slot in the NSS soft token
that does not need the NSS cert/key databases.  Since we
don't need to store the HMAC key persistently on line 74
below, using this slot is enough.

+#endif
   if (!plat_->slot_.get()) {
     NOTREACHED();
     return false;
   }
 
   SECItem key_item;
   key_item.type = siBuffer;
   key_item.data = const_cast<unsigned char*>(key);  // NSS API isn't const.
   key_item.len = key_length;
 
@@ skipping 46 matching lines @@
   if (PK11_DigestFinal(context.get(),
                        digest, &len, digest_length) != SECSuccess) {
     NOTREACHED();
     return false;
   }
 
   return true;
 }
 
 }  // namespace crypto