tree a9c20e9ee93f7c09c5de6244f7b432614781505b
parent 12248fd3e82e61ca4be194caf6347152dacf219d
author Shawn Willden <swillden@google.com> 1436397136 -0600
committer Shawn Willden <swillden@google.com> 1436464386 -0600

Truncate too-long digests for keymaster 0 ECDSA sign operations

BoringSSL doesn't pre-truncate too-long digests before calling the ECDSA
sign operation via the ENGINE interface, and TrustyKeymaster is picky
about accepting them.  This means that trying to sign a message with,
say, a 256-bit key and a 384-bit hash fails on Volantis.

This CL also corrects an error in get_supported_digests for ECDSA, which
was advertising support for MD5.  BoringSSL doesn't support ECDSA with
MD5 and we're not offering it in the JCA API, so the solution is simply
not to advertise it and to return a better error code if it's requested
anyway.

Bug: 22355708
Change-Id: Iba2dad6953db7eda23951760b734f499a13c5191