Prefer to generate SHA-1 signatures for TLS 1.2 client authentication if

Prefer to generate SHA-1 signatures for TLS 1.2 client authentication if
the client private key is a 1024-bit RSA or DSA key.

Older Estonian ID cards with 1024-bit RSA keys cannot sign SHA-256
hashes.

1024-bit DSA keys were formerly specified to be used with SHA-1 only.

R=agl@chromium.org,rsleevi@chromium.org
BUG=278370
TEST=manual testing by someone who has an older Estonian ID card

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=221609

[wtc, 2013-09-05 21:53:21]

https://codereview.chromium.org/23596013/diff/1/net/third_party/nss/ssl/ssl3c...
File net/third_party/nss/ssl/ssl3con.c (right):

https://codereview.chromium.org/23596013/diff/1/net/third_party/nss/ssl/ssl3c...
net/third_party/nss/ssl/ssl3con.c:7077: prefer_sha1 =
SECKEY_PublicKeyStrength(pubk) <= 128;

SECKEY_PublicKeyStrength returns the key size in bytes.

[agl, 2013-09-05 21:56:59]

LGTM, although I wasn't adverse to trying the SHA-256 signature and falling back
either (assuming that the SHA-256 attempt fails quickly).

[Ryan Sleevi, 2013-09-05 21:57:59]

LGTM, same comment as agl.

[wtc, 2013-09-05 22:18:32]

https://codereview.chromium.org/23596013/diff/6001/net/third_party/nss/ssl/ss...
File net/third_party/nss/ssl/ssl3con.c (right):

https://codereview.chromium.org/23596013/diff/6001/net/third_party/nss/ssl/ss...
net/third_party/nss/ssl/ssl3con.c:6142: }

Trying the SHA-256 signature and falling back requires refactoring
this part of ssl3_SendCertificateVerify (lines 6092-6142).

I thought I could patch the current approach if we were willing to
use SHA-1 with 1024-bit RSA signatures, which seems fine to me because
these signatures are only used for authentication. Using SHA-1 with
1024-bit DSA keys seems prudent to me because it used to be the only
specified type of DSA signature. Since we have to handle 1024-bit DSA
as a special case, I decided to also handle 1024-bit RSA at the same
time.

[commit-bot: I haz the power, 2013-09-05 22:50:50]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/wtc@chromium.org/23596013/6001

[commit-bot: I haz the power, 2013-09-06 06:40:05]

Change committed as 221609