imported changes from mozilla NSS:

- Bug 966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses r=jschanck,djackson (78d2f4a3)

security/nss/lib/mozpkix/include/pkix-test/pkixtestutil.h

@@ -348,6 +348,14 @@ class OCSPResponseContext final {
   OCSPResponseContext(const CertID& certID, std::time_t time);
 
   const CertID& certID;
+  // What digest algorithm to use to produce issuerNameHash and issuerKeyHash.
+  // Defaults to sha1.
+  DigestAlgorithm certIDHashAlgorithm;
+  // If non-empty, the sequence of bytes to use for hashAlgorithm when encoding
+  // this response. If empty, the sequence of bytes corresponding to
+  // certIDHashAlgorithm will be used. Defaults to empty.
+  ByteString certIDHashAlgorithmEncoded;
+
   // TODO(bug 980538): add a way to specify what certificates are included.
 
   // The fields below are in the order that they appear in an OCSP response.

security/nss/lib/mozpkix/include/pkix/pkixutil.h

@@ -258,6 +258,20 @@ Result CheckSubjectPublicKeyInfo(Input subjectPublicKeyInfo,
 #else
 #error Unsupported compiler for MOZILLA_PKIX_UNREACHABLE_DEFAULT.
 #endif
+
+inline size_t DigestAlgorithmToSizeInBytes(DigestAlgorithm digestAlgorithm) {
+  switch (digestAlgorithm) {
+    case DigestAlgorithm::sha1:
+      return 160 / 8;
+    case DigestAlgorithm::sha256:
+      return 256 / 8;
+    case DigestAlgorithm::sha384:
+      return 384 / 8;
+    case DigestAlgorithm::sha512:
+      return 512 / 8;
+      MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
+  }
+}
 }
 }  // namespace mozilla::pkix