Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate.h

Index: net/base/x509_certificate.h
===================================================================
--- net/base/x509_certificate.h	(revision 110129)
+++ net/base/x509_certificate.h	(working copy)
@@ -74,6 +74,14 @@
 
   typedef std::vector<OSCertHandle> OSCertHandles;
 
+  enum {
+    NONE,
+    RSA,
+    DSA,
+    ECDSA,
+    DH,

[agl, 2011/11/16 15:57:55]

OTHER?

(For example, ECDH. I wouldn't want code to assume that these are the only valid
key types. It's the sort of thing that might change in the future.)


Later: I see that you're using NONE for OTHER. I think NONE is a misleading
name.

+  } PublicKeyType;
+
   // Predicate functor used in maps when X509Certificate is used as the key.
   class NET_EXPORT LessThan {
    public:
@@ -404,6 +412,9 @@
   // the first element.
   bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const;
 
+  // Returns the length of the public key in bits.
+  static unsigned int GetPublicKeyLengthInBits(OSCertHandle cert_handle);
+
   // Returns the OSCertHandle of this object. Because of caching, this may
   // differ from the OSCertHandle originally supplied during initialization.
   // Note: On Windows, CryptoAPI may return unexpected results if this handle