This change loads opencryptoki and uses the TPM for keygen tags.

base/nss_util_internal.h

-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_NSS_SLOT_UTIL_H_
 #define BASE_NSS_SLOT_UTIL_H_
 #pragma once
 
 #include <secmodt.h>
 
 // These functions return a type defined in an NSS header, and so cannot be
 // declared in nss_util.h.  Hence, they are declared here.
 
 namespace base {
 
-// Returns a reference to the default NSS key slot. Caller must release
-// reference with PK11_FreeSlot.
-PK11SlotInfo* GetDefaultNSSKeySlot();
+// Returns a reference to the default NSS key slot for storing
+// public-key data only (e.g. server certs). Caller must release
+// returned reference with PK11_FreeSlot.
+PK11SlotInfo* GetPublicNSSKeySlot();
+
+// Returns a reference to the default slot for storing private-key and
+// mixed private-key/public-key data.  Returns a hardware (TPM) NSS
+// key slot if on ChromeOS and EnableTPMForNSS() has been called
+// successfully. Caller must release returned reference with
+// PK11_FreeSlot.
+PK11SlotInfo* GetPrivateNSSKeySlot();

[wtc, 2011/04/07 05:56:33]

The use of "Public" vs. "Private" here is confusing.
I'll think about better names.  Probably GetNSSDBSlot()
and GetPreferredPrivateKeySlot().

[Greg Spencer (Chromium), 2011/04/07 16:46:28]

Well, but this enables us to implement our policy clearly: our policy is to
place all certs/keys with private matter into the TPM, and all
public-matter-only objects into the sofware slot (for speed).  When I read the
code that uses this, the names make it clear that the right policy is being
followed.

I realize that public and private are overloaded terms between crypto and C++,
but at the least I would like it to be obvious from the names they are both
using NSS, and the circumstances under which to use them.  "GetNSSDBSlot"
doesn't say anything about why you would choose that slot over the other one,
since the TPM is managed by NSS here too.

I also like the symmetry of GetPrivate/GetPublic, because it implies that if you
don't use one, you use the other one.

 
 }  // namespace base
 
 #endif  // BASE_NSS_UTIL_H_