Use the NSS internal key slot for all temporary key operations

Use the NSS internal key slot for all temporary key operations

Rather than calling PK11_GetBestSlot, which requires enumerating all
connected tokens, use PK11_GetInternalSlot, which explicitly uses the
internal NSS key database. On Linux, this will ignore any user preferences
regarding what tokens should be used for which mechanisms, but for
internal/temporary operations, this is an acceptable tradeoff.

BUG=chrome-os-partner:14707
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=162309

[Ryan Sleevi, 2012-10-16 19:22:25]

wtc: For your review. You'll note that this is very similar to the Mozilla issue
we recently discussed with the RNG, but this applies to the use of AES (and DES)
keys.

I'm still in the process of auditing the callers, but I believe this change
would only have impact for Linux users, and only when generating new (random)
keys. All existing key storage methods should work.

akalin, nzea: FYI

[Ryan Sleevi, 2012-10-16 19:25:08]

http://codereview.chromium.org/11186004/diff/1/crypto/encryptor_nss.cc
File crypto/encryptor_nss.cc (right):

http://codereview.chromium.org/11186004/diff/1/crypto/encryptor_nss.cc#newcode56
crypto/encryptor_nss.cc:56: slot_.reset(PK11_GetInternalSlot());
wtc: It's not immediately clear to me why we even initialize slot_, since it
appears unused (PK11_CreateContextBySymKey will attempt to use the keys' slot).
Was this just meant to see if the mechanism was supported?

If so, should we be probing key's slot directly then?

[wtc, 2012-10-16 21:26:57]

Patch set 1 LGTM.

Could you open an NSS bug report about the problems you
discovered with PK11_GetBestSlot() and ask Bob Relyea if it
is wrong to assume PK11_GetBestSlot() is fast? I'd like to
know if we should also try to make PK11_GetBestSlot() as fast
as possible. Thanks!

http://codereview.chromium.org/11186004/diff/1/crypto/encryptor_nss.cc
File crypto/encryptor_nss.cc (right):

http://codereview.chromium.org/11186004/diff/1/crypto/encryptor_nss.cc#newcode56
crypto/encryptor_nss.cc:56: slot_.reset(PK11_GetInternalSlot());

We should remove the unused slot_ member. I guess this
was a code-copying mistake.

[commit-bot: I haz the power, 2012-10-17 00:04:01]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/11186004/6

[commit-bot: I haz the power, 2012-10-17 00:44:28]

Sorry for I got bad news for ya.
Compile failed with a clobber build.
Your code is likely broken or HEAD is junk. Please ensure your
code is not broken then alert the build sheriffs.
Look at the try server FAQ for more details.

[commit-bot: I haz the power, 2012-10-17 01:07:34]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/11186004/6

[commit-bot: I haz the power, 2012-10-17 03:18:59]

Change committed as 162309