Enhanced and refactored the AttestationFlow interface.

chromeos/attestation/attestation_constants.h

Index: chromeos/attestation/attestation_constants.h
diff --git a/chromeos/attestation/attestation_constants.h b/chromeos/attestation/attestation_constants.h
new file mode 100644
index 0000000000000000000000000000000000000000..6e980f96ffab4eb7cf5b19cb2705b96e9d75b8e3
--- /dev/null
+++ b/chromeos/attestation/attestation_constants.h
@@ -0,0 +1,59 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROMEOS_ATTESTATION_ATTESTATION_CONSTANTS_H_
+#define CHROMEOS_ATTESTATION_ATTESTATION_CONSTANTS_H_
+
+namespace chromeos {
+namespace attestation {
+
+// Options available for customizing an attestation certificate.
+enum AttestationCertificateOptions {

[Mattias Nissler (ping if slow), 2013/04/24 12:57:53]

nit: We usually follow good practice for enums to share a common prefix, maybe
we should do that here as well?

[dkrahn, 2013/04/25 01:06:52]

The style guide gives this as an example of a good enum:
enum AlternateUrlTableErrors {
  OK = 0,
  OUT_OF_MEMORY = 1,
  MALFORMED_INPUT = 2,
};

I think a prefix on these would make them too long and verbose.  Especially the
options enums which are meant to be combined.  The purpose of these enums is to
make calling code more readable (e.g. func(OPTION1|OPTION2) instead of
func(true, true)) -- I don't want to defeat that so I prefer succinct names.  

Let me know if you feel strongly... 

[Daniel Erat, 2013/04/25 01:15:30]

I think I agree with Mattias here.  Omitting prefixes seems okay when there's
e.g. just a single enum scoped within a struct, but I find this case a bit more
confusing; there are e.g. two sets of options within the same namespace.  What
about names like the following?

CERTIFICATE_INCLUDE_STABLE_ID
CERTIFICATE_INCLUDE_DEVICE_STATE

KEY_DEVICE
KEY_USER

CHALLENGE_INCLUDE_SIGNED_PUBLIC_KEY

PROFILE_ENTERPRISE_MACHINE_CERTIFICATE
PROFILE_ENTERPRISE_USER_CERTIFICATE

[dkrahn, 2013/04/25 02:45:35]

That makes sense, and this CL does pull these out of CryptohomeClient and into
the attestation namespace.

Done!

+  CERTIFICATE_OPTION_NONE = 0,
+  // A stable identifier is simply an identifier that is not affected by device
+  // state changes, including device recovery.
+  INCLUDE_STABLE_ID = 1,
+  // Device state information contains a quoted assertion of whether the device
+  // is in verified mode.
+  INCLUDE_DEVICE_STATE = 1 << 1

[Mattias Nissler (ping if slow), 2013/04/24 12:57:53]

nit: putting a trailing colon here makes it easier to resolve potential merge
conflicts in the future.

[dkrahn, 2013/04/25 01:06:52]

Done.  Good idea.  I'm not in the habit...

+};
+
+// Key types supported by the Chrome OS attestation subsystem.
+enum AttestationKeyType {
+  // The key will be associated with the device itself and will be available
+  // regardless of which user is signed-in.
+  DEVICE_KEY,
+  // The key will be associated with the current user and will only be available
+  // when that user is signed-in.
+  USER_KEY

[Mattias Nissler (ping if slow), 2013/04/24 12:57:53]

ditto

[dkrahn, 2013/04/25 01:06:52]

Done.

+};
+
+// Options available for customizing an attestation challenge response.
+enum AttestationChallengeOptions {
+  CHALLENGE_RESPONSE_OPTION_NONE = 0,
+  // Indicates that a SignedPublicKeyAndChallenge should be embedded in the
+  // challenge response.
+  INCLUDE_SIGNED_PUBLIC_KEY = 1

[Mattias Nissler (ping if slow), 2013/04/24 12:57:53]

ditto.

[dkrahn, 2013/04/25 01:06:52]

Done.

+};
+
+// Available attestation certificate profiles.
+enum AttestationCertificateProfile {
+  // Uses the following options: INCLUDE_STABLE_ID | INCLUDE_DEVICE_STATE.
+  ENTERPRISE_MACHINE_CERTIFICATE,
+  // Uses the following options: INCLUDE_DEVICE_STATE.
+  ENTERPRISE_USER_CERTIFICATE,

[Mattias Nissler (ping if slow), 2013/04/24 12:57:53]

ah, and here you have it :)

[dkrahn, 2013/04/25 01:06:52]

there was a third value at one time :)

+};
+
+// A key name for the Enterprise Machine Key.  This key should always be stored
+// as a DEVICE_KEY.
+extern const char kEnterpriseMachineKey[];
+
+// A key name for the Enterprise User Key.  This key should always be stored as
+// a USER_KEY.
+extern const char kEnterpriseUserKey[];
+
+}  // namespace attestation
+}  // namespace chromeos
+
+#endif  // CHROMEOS_ATTESTATION_ATTESTATION_CONSTANTS_H_