On NSS, treat non-permanent RSA private keys as ephemeral

crypto/rsa_private_key_nss.cc

Index: crypto/rsa_private_key_nss.cc
diff --git a/crypto/rsa_private_key_nss.cc b/crypto/rsa_private_key_nss.cc
index 977460ff92dbfec5fdcbf0a2733f520767873532..15c82fca424e79b13f0f432862322814e6df3da5 100644
--- a/crypto/rsa_private_key_nss.cc
+++ b/crypto/rsa_private_key_nss.cc
@@ -207,7 +207,8 @@ RSAPrivateKey* RSAPrivateKey::CreateWithParams(uint16 num_bits,
 
   scoped_ptr<RSAPrivateKey> result(new RSAPrivateKey);
 
-  ScopedPK11Slot slot(GetPrivateNSSKeySlot());
+  ScopedPK11Slot slot(permanent ? GetPrivateNSSKeySlot() :
+                      PK11_GetInternalKeySlot());

[wtc, 2013/06/20 19:57:37]

I think we should use GetPublicNSSKeySlot() instead of
PK11_GetInternalKeySlot().

Actually, I think PK11_GetInternalSlot() (which is not
backed by the NSS cert and key databases) may be even
better.

[Ryan Sleevi, 2013/06/20 20:01:50]

This was intentional, because I do not want to use any ChromeOS redirected slots
(such as the software slot), which indirectly may hit the TPM.
Ah, this is actually what I intended. I didn't realize there were two functions!
bleh!

   if (!slot.get())
     return NULL;
 
@@ -237,7 +238,8 @@ RSAPrivateKey* RSAPrivateKey::CreateFromPrivateKeyInfoWithParams(
 
   scoped_ptr<RSAPrivateKey> result(new RSAPrivateKey);
 
-  ScopedPK11Slot slot(GetPrivateNSSKeySlot());
+  ScopedPK11Slot slot(permanent ? GetPrivateNSSKeySlot() :
+                      PK11_GetInternalKeySlot());
   if (!slot.get())
     return NULL;