[webcrypto] Fix a bug where generated RSA private keys couldn't be exported.

[webcrypto] Fix a bug where generated RSA private keys couldn't be exported or cloned.

BUG=245025
R=rsleevi@chromium.org, wtc@chromium.org

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=260100

[Ryan Sleevi, 2014-03-27 18:40:52]

lgtm

[eroman, 2014-03-27 18:54:01]

The CQ bit was checked by eroman@chromium.org

[commit-bot: I haz the power, 2014-03-27 18:55:54]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/eroman@chromium.org/213423007/60001

[wtc, 2014-03-27 19:38:23]

Patch set 4 LGTM. You can fix the comment later.

https://codereview.chromium.org/213423007/diff/60001/content/child/webcrypto/...
File content/child/webcrypto/platform_crypto_nss.cc (right):

https://codereview.chromium.org/213423007/diff/60001/content/child/webcrypto/...
content/child/webcrypto/platform_crypto_nss.cc:1158: // however the tests pass
without it too.

Summary: I suggest this comment:
  // The private key must be marked as insensitive and extractable, otherwise
  // it cannot later be exported in unencrypted form or structured-cloned.

Details:

Remove the "Throw in extractable for good measure ..." part. If you don't
specify PK11_ATTR_EXTRACTABLE or PK11_ATTR_UNEXTRACTABLE, you are relying on the
token's default. The fact that PK11_ATTR_EXTRACTABLE isn't necessary means the
NSS softoken defaults to extractable keys.

More info on the two attributes:
Extractable: whether the key can be extracted at all, regardless of the form.
Sensitive: the key can only be extracted in encrypted form (i.e., requires the
use of C_WrapKey).

If you need to export unencrypted PrivateKeyInfo, you need the key to be
insensitive and extractable.

[eroman, 2014-03-27 19:50:45]

The CQ bit was unchecked by eroman@chromium.org

[eroman, 2014-03-27 19:54:29]

Changed the comment as suggested in patchset 5.

[eroman, 2014-03-27 19:54:36]

The CQ bit was checked by eroman@chromium.org

[commit-bot: I haz the power, 2014-03-27 19:56:53]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/eroman@chromium.org/213423007/80001

[commit-bot: I haz the power, 2014-03-27 21:21:57]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-03-27 21:21:58]

Try jobs failed on following builders:
  tryserver.chromium on linux_chromium_chromeos_rel

[eroman, 2014-03-27 21:42:43]

The CQ bit was checked by eroman@chromium.org

[commit-bot: I haz the power, 2014-03-27 21:45:39]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/eroman@chromium.org/213423007/80001

[eroman, 2014-03-28 09:22:25]

The CQ bit was unchecked by eroman@chromium.org

[eroman, 2014-03-28 09:22:33]

The CQ bit was checked by eroman@chromium.org

[eroman, 2014-03-28 09:31:08]

Committed patchset #5 manually as r260100 (presubmit successful).