This change loads opencryptoki and uses the TPM for keygen tags.

base/nss_util_internal.h

Index: base/nss_util_internal.h
diff --git a/base/nss_util_internal.h b/base/nss_util_internal.h
index 139740b4ab367935de237a73b561901697fe1e6a..be8436a625b094e6cb181a184cecbe58e9a6c1bd 100644
--- a/base/nss_util_internal.h
+++ b/base/nss_util_internal.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -13,9 +13,17 @@
 
 namespace base {
 
-// Returns a reference to the default NSS key slot. Caller must release
-// reference with PK11_FreeSlot.
-PK11SlotInfo* GetDefaultNSSKeySlot();
+// Returns a reference to the default NSS key slot for storing
+// public-key data only (e.g. server certs). Caller must release
+// returned reference with PK11_FreeSlot.
+PK11SlotInfo* GetPublicNSSKeySlot();
+
+// Returns a reference to the default slot for storing private-key and
+// mixed private-key/public-key data.  Returns a hardware (TPM) NSS
+// key slot if on ChromeOS and EnableTPMForNSS() has been called
+// successfully. Caller must release returned reference with
+// PK11_FreeSlot.
+PK11SlotInfo* GetPrivateNSSKeySlot();

[wtc, 2011/04/07 05:56:33]

The use of "Public" vs. "Private" here is confusing.
I'll think about better names.  Probably GetNSSDBSlot()
and GetPreferredPrivateKeySlot().

[Greg Spencer (Chromium), 2011/04/07 16:46:28]

Well, but this enables us to implement our policy clearly: our policy is to
place all certs/keys with private matter into the TPM, and all
public-matter-only objects into the sofware slot (for speed).  When I read the
code that uses this, the names make it clear that the right policy is being
followed.

I realize that public and private are overloaded terms between crypto and C++,
but at the least I would like it to be obvious from the names they are both
using NSS, and the circumstances under which to use them.  "GetNSSDBSlot"
doesn't say anything about why you would choose that slot over the other one,
since the TPM is managed by NSS here too.

I also like the symmetry of GetPrivate/GetPublic, because it implies that if you
don't use one, you use the other one.

 
 }  // namespace base