From cb9cf094bdccda0664980a5251aa0326f79c2128 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 12 Dec 2013 10:42:03 +0000
Subject: [PATCH] Enforce 2048-bit RSA key minimum on UKf-registered entities.

---
 mdx/uk/beans.xml | 21 +++++++++++++++------
 mdx/uk/verbs.xml | 20 +++++++++++++-------
 2 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index a9a66472..0135788f 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -424,17 +424,26 @@
                     p:id="checkCertificates">
                     <property name="validators">
                         <list>
-                            <!-- Error on RSA key length less than 1024 bits. -->
+                            <!-- Error on RSA key length less than 2048 bits. -->
                             <bean parent="X509CertificateRSAKeyLengthValidator"
-                                p:warningBoundary="0" p:errorBoundary="1024"/>
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
                             <!-- Error on small RSA public exponents. -->
                             <bean parent="X509CertificateRSAExponentValidator"/>
-                            <!-- Debian weak key blacklists. -->
-                            <ref bean="debian.1024"/>
+                            
+                            <!--
+                                Debian weak key blacklists.
+                                
+                                Don't need to check for keys below our minimum key size.
+                            -->
                             <ref bean="debian.2048"/>
                             <ref bean="debian.4096"/>
-                            <!-- Compromised key blacklists. -->
-                            <ref bean="compromised.1024"/>
+                            
+                            <!--
+                                Compromised key blacklists.
+                                
+                                Again, don't need to check for keys below our minimum key size.
+                                This currently means there are no compromised keys to check for.
+                            -->
                         </list>
                     </property>
                 </bean>
diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml
index 3cc88a3f..39c92ada 100644
--- a/mdx/uk/verbs.xml
+++ b/mdx/uk/verbs.xml
@@ -179,9 +179,6 @@
                     p:id="checkCertificates">
                     <property name="validators">
                         <list>
-                            <!-- Error on RSA key length less than 2048 bits. -->
-                            <bean parent="X509CertificateRSAKeyLengthValidator"
-                                p:warningBoundary="0" p:errorBoundary="2048"/>
                             <!-- Error on inconsistent subjectAltNames. -->
                             <bean parent="X509CertificateConsistentNameValidator"/>
                         </list>
@@ -312,12 +309,21 @@
                             <bean parent="X509CertificateRSAExponentValidator"/>
                             <!-- Error on inconsistent subjectAltNames. -->
                             <bean parent="X509CertificateConsistentNameValidator"/>
-                            <!-- Debian weak key blacklists. -->
-                            <ref bean="debian.1024"/>
+
+                            <!--
+                                Debian weak key blacklists.
+                                
+                                Don't need to check for keys below our minimum key size.
+                            -->
                             <ref bean="debian.2048"/>
                             <ref bean="debian.4096"/>
-                            <!-- Compromised key blacklists. -->
-                            <ref bean="compromised.1024"/>
+                            
+                            <!--
+                                Compromised key blacklists.
+                                
+                                Again, don't need to check for keys below our minimum key size.
+                                This currently means there are no compromised keys to check for.
+                            -->
                         </list>
                     </property>
                 </bean>