Remove certificates from Channel ID

net/ssl/channel_id_store.h

Index: net/ssl/channel_id_store.h
diff --git a/net/ssl/channel_id_store.h b/net/ssl/channel_id_store.h
index 1e971a5e82f8f9338e43f907b9e75a3022b84e25..71c7dae6ac56d47eea85dba232d0103eb8e7c0f1 100644
--- a/net/ssl/channel_id_store.h
+++ b/net/ssl/channel_id_store.h
@@ -32,31 +32,26 @@ class NET_EXPORT ChannelIDStore
     ChannelID();
     ChannelID(const std::string& server_identifier,
               base::Time creation_time,
-              base::Time expiration_time,
               const std::string& private_key,
-              const std::string& cert);
+              const std::string& public_key);
     ~ChannelID();
 
     // Server identifier.  For domain bound certs, for instance "verisign.com".
     const std::string& server_identifier() const { return server_identifier_; }
-    // The time the certificate was created, also the start of the certificate
-    // validity period.
+    // The time the certificate was created.
     base::Time creation_time() const { return creation_time_; }
-    // The time after which this certificate is no longer valid.
-    base::Time expiration_time() const { return expiration_time_; }
     // The encoding of the private key depends on the type.
     // rsa_sign: DER-encoded PrivateKeyInfo struct.
     // ecdsa_sign: DER-encoded EncryptedPrivateKeyInfo struct.

[Ryan Sleevi, 2015/04/15 22:50:03]

This comment no longer applies, does it?

If not, should this (and the rest of the ChannelID store) be refactored in terms
of simply crypto::ECPrivateKey<>, which lets you push the encoding/decoding down
into the store?

That is, no consumer of the ChannelIDStore ever has to know of the
public/private key split.

[nharper, 2015/04/25 02:59:20]

Correct - it no longer applies. It's reworded.
My impression from reading the code is that ChannelIDStore is only used by
ChannelIDService, and any consumers we care about would be working with that
interface. That's why I decided to make ChannelIDService do the
encoding/decoding, and let the store just handle storing the keypair (and no
encoding/decoding). I guess I wasn't very clear on this part of the design in my
doc
https://docs.google.com/document/d/1lNTkg-1iSMkeqgIvFoekz7rBUfIHaaDF3v2XSPyPw....

I think I'm ok with pushing it down from ChannelIDService to ChannelIDStore (it
might also clean up some of the
ExportKeypair/CreateECPrivateKeyFromSerializedKey helper method nonsense in
ChannelIDService), but I want to check that that's the correct design choice
before jumping into it.

     const std::string& private_key() const { return private_key_; }
-    // DER-encoded certificate.
-    const std::string& cert() const { return cert_; }
+    // DER-encoded public key.
+    const std::string& public_key() const { return public_key_; }
 
    private:
     std::string server_identifier_;
     base::Time creation_time_;
-    base::Time expiration_time_;
     std::string private_key_;
-    std::string cert_;
+    std::string public_key_;
   };
 
   typedef std::list<ChannelID> ChannelIDList;
@@ -64,7 +59,6 @@ class NET_EXPORT ChannelIDStore
   typedef base::Callback<void(
       int,
       const std::string&,
-      base::Time,
       const std::string&,
       const std::string&)> GetChannelIDCallback;
   typedef base::Callback<void(const ChannelIDList&)> GetChannelIDListCallback;
@@ -79,7 +73,6 @@ class NET_EXPORT ChannelIDStore
   // asynchronously.
   virtual int GetChannelID(
       const std::string& server_identifier,
-      base::Time* expiration_time,
       std::string* private_key_result,
       std::string* cert_result,

[Ryan Sleevi, 2015/04/15 22:50:03]

*cough*

[nharper, 2015/04/25 02:59:20]

Done.

       const GetChannelIDCallback& callback) = 0;
@@ -88,7 +81,6 @@ class NET_EXPORT ChannelIDStore
   virtual void SetChannelID(
       const std::string& server_identifier,
       base::Time creation_time,
-      base::Time expiration_time,
       const std::string& private_key,
       const std::string& cert) = 0;

[Ryan Sleevi, 2015/04/15 22:50:03]

*cough*

[nharper, 2015/04/25 02:59:20]

Done.