On NSS, treat non-permanent RSA private keys as ephemeral

On NSS, treat non-permanent RSA private keys as ephemeral

When generating/using a crypto::RSAPrivateKey with NSS,
prefer the internal software slot over other modules (such as
any TPMs [ChromeOS] or smart cards [Linux]) if the key being
generated is not marked as a permanent key.

BUG=none
R=wtc

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=207853

[Ryan Sleevi, 2013-06-20 00:49:34]

wtc: I have no clue why we're doing this, but on ChromeOS this can result in
extra indirection through the TPM via DBus, even when we don't want a permanent
key (which will cause chapsd to just use OpenSSL to implement everything).
Rather silly...

[wtc, 2013-06-20 19:57:37]

Patch set 1 LGTM. I suggest a change.

https://codereview.chromium.org/17447009/diff/1/crypto/rsa_private_key_nss.cc
File crypto/rsa_private_key_nss.cc (right):

https://codereview.chromium.org/17447009/diff/1/crypto/rsa_private_key_nss.cc...
crypto/rsa_private_key_nss.cc:211: PK11_GetInternalKeySlot());

I think we should use GetPublicNSSKeySlot() instead of
PK11_GetInternalKeySlot().

Actually, I think PK11_GetInternalSlot() (which is not
backed by the NSS cert and key databases) may be even
better.

[Ryan Sleevi, 2013-06-20 20:01:50]

Thanks for your review.

https://codereview.chromium.org/17447009/diff/1/crypto/rsa_private_key_nss.cc
File crypto/rsa_private_key_nss.cc (right):

https://codereview.chromium.org/17447009/diff/1/crypto/rsa_private_key_nss.cc...
crypto/rsa_private_key_nss.cc:211: PK11_GetInternalKeySlot());
On 2013/06/20 19:57:37, wtc wrote:
> 
> I think we should use GetPublicNSSKeySlot() instead of
> PK11_GetInternalKeySlot().

This was intentional, because I do not want to use any ChromeOS redirected slots
(such as the software slot), which indirectly may hit the TPM.

> 
> Actually, I think PK11_GetInternalSlot() (which is not
> backed by the NSS cert and key databases) may be even
> better.

Ah, this is actually what I intended. I didn't realize there were two functions!
bleh!

[commit-bot: I haz the power, 2013-06-20 20:58:06]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/17447009/5001

[commit-bot: I haz the power, 2013-06-20 22:23:13]

Step "update" is always a major failure.
Look at the try server FAQ for more details.
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_chro...

[commit-bot: I haz the power, 2013-06-20 22:27:04]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/17447009/5001

[commit-bot: I haz the power, 2013-06-21 16:29:45]

Change committed as 207853