Use the TLS 1.2 mechanisms for PKCS #11.

net/third_party/nss/ssl/ssl3ecc.c

 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* ECC code moved here from ssl3con.c */
 
 #include "nss.h"
@@ skipping 14 matching lines @@
 #include "prthread.h"
 #include "prinit.h"
 
 #include "pk11func.h"
 #include "secmod.h"
 
 #include <stdio.h>
 
 /* This is a bodge to allow this code to be compiled against older NSS headers
  * that don't contain the TLS 1.2 changes. */
-#ifndef CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256
-#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24)
+#ifndef CKM_TLS12_MASTER_KEY_DERIVE_DH
+#define CKM_TLS12_MASTER_KEY_DERIVE_DH      0x000003E2
 #endif
 
 #ifdef NSS_ENABLE_ECC
 
 /*
  * In NSS 3.13.2 the definition of the EC_POINT_FORM_UNCOMPRESSED macro
  * was moved from the internal header ec.h to the public header blapit.h.
  * Define the macro here when compiling against older system NSS headers.
  */
 #ifndef EC_POINT_FORM_UNCOMPRESSED
@@ skipping 257 matching lines @@
     if (!privKey || !pubKey) {
             ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL);
             rv = SECFailure;
             goto loser;
     }
     PRINT_BUF(50, (ss, "ECDH public value:",
                                         pubKey->u.ec.publicValue.data,
                                         pubKey->u.ec.publicValue.len));
 
     if (isTLS12) {
-        target = CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256;
+        target = CKM_TLS12_MASTER_KEY_DERIVE_DH;
     } else if (isTLS) {
         target = CKM_TLS_MASTER_KEY_DERIVE_DH;
     } else {
         target = CKM_SSL3_MASTER_KEY_DERIVE_DH;
     }
 
     /*  Determine the PMS */
     pms = PK11_PubDeriveWithKDF(privKey, svrPubKey, PR_FALSE, NULL, NULL,
                             CKM_ECDH1_DERIVE, target, CKA_DERIVE, 0,
                             CKD_NULL, NULL, NULL);
@@ skipping 70 matching lines @@
                                        1, &b, &length);
     if (rv != SECSuccess) {
         SEND_ALERT
         return SECFailure;      /* XXX Who sets the error code?? */
     }
 
     isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0);
     isTLS12 = (PRBool)(ss->ssl3.prSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2);
 
     if (isTLS12) {
-        target = CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256;
+        target = CKM_TLS12_MASTER_KEY_DERIVE_DH;
     } else if (isTLS) {
         target = CKM_TLS_MASTER_KEY_DERIVE_DH;
     } else {
         target = CKM_SSL3_MASTER_KEY_DERIVE_DH;
     }
 
     /*  Determine the PMS */
     pms = PK11_PubDeriveWithKDF(srvrPrivKey, &clntPubKey, PR_FALSE, NULL, NULL,
                             CKM_ECDH1_DERIVE, target, CKA_DERIVE, 0,
                             CKD_NULL, NULL, NULL);
@@ skipping 855 matching lines @@
     ssl3_DisableECCSuites(ss, ecdhe_ecdsa_suites);
     return SECFailure;
 
 loser:
     /* no common curve supported */
     ssl3_DisableECCSuites(ss, ecSuites);
     return SECFailure;
 }
 
 #endif /* NSS_ENABLE_ECC */