Introduce a 2048-bit compromised keys list, and use it to block a key…

… erroneously shipped with the Shibboleth IdP 3.0.0-alpha1 release.

mdx/_openssl_blacklists/compromised-2048.txt

@@ -0,0 +1,15 @@
+#
+# This is a list of known-compromised 2048-bit keys in OpenSSL format.
+#
+# Derive new values from a private key file as follows:
+#
+#   openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | \
+#       cut -d ' ' -f 1 | cut -c 21-
+#
+# You can also derive a new blacklist value from an X.509 certificate as follows:
+#
+#   openssl x509 -noout -modulus -in /tmp/cert.pem | sha1sum | \
+#       cut -d ' ' -f 1 | cut -c 21-
+#
+# Shibboleth IdP dummy key, shipped in 3.0.0-alpha1 release
+959a1a153444578d010b

mdx/common-beans.xml

@@ -1052,8 +1052,8 @@
                                 Compromised key blacklists.
                                 
                                 Again, don't need to check for keys below our minimum key size.
-                                This currently means there are no compromised keys to check for.
                             -->
+                            <ref bean="compromised.2048"/>
                         </list>
                     </property>
                 </bean>

mdx/uk/beans.xml

@@ -458,8 +458,8 @@
                                 Compromised key blacklists.
                                 
                                 Again, don't need to check for keys below our minimum key size.
-                                This currently means there are no compromised keys to check for.
                             -->
+                            <ref bean="compromised.2048"/>
                         </list>
                     </property>
                 </bean>

mdx/uk/verbs.xml

@@ -321,8 +321,8 @@
                                 Compromised key blacklists.
                                 
                                 Again, don't need to check for keys below our minimum key size.
-                                This currently means there are no compromised keys to check for.
                             -->
+                            <ref bean="compromised.2048"/>
                         </list>
                     </property>
                 </bean>

mdx/validation-beans.xml

@@ -758,6 +758,19 @@
         </property>
     </bean>
 
+    <!--
+        Blacklist of known compromised 2048-bit keys, e.g., "dummy" keys shipped with
+        SAML products that are sometimes deployed by accident.
+    -->
+    <bean id="compromised.2048" parent="X509RSAOpenSSLBlacklistValidator"
+        p:id="compromised.2048" p:keySize="2048">
+        <property name="blacklistResource">
+            <bean parent="ClassPathResource">
+                <constructor-arg value="_openssl_blacklists/compromised-2048.txt"/>
+            </bean>
+        </property>
+    </bean>
+
     <!--
         *********************************************
         ***                                       ***