IETF Logo Mail Archive

Re: [saag] On PKI vs. Pinning (SAAG 108 preview)

Daniel Migault <mglt.ietf@gmail.com> Wed, 29 July 2020 16:03 UTC

Return-Path: <mglt.ietf@gmail.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60CB73A0C7B for <saag@ietfa.amsl.com>; Wed, 29 Jul 2020 09:03:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fOk4M2O4uLOt for <saag@ietfa.amsl.com>; Wed, 29 Jul 2020 09:03:48 -0700 (PDT)
Received: from mail-vs1-xe33.google.com (mail-vs1-xe33.google.com [IPv6:2607:f8b0:4864:20::e33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6DCB3A0C77 for <saag@ietf.org>; Wed, 29 Jul 2020 09:03:47 -0700 (PDT)
Received: by mail-vs1-xe33.google.com with SMTP id a17so12346411vsq.6 for <saag@ietf.org>; Wed, 29 Jul 2020 09:03:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2eURCWa/LUofeY1t4owcVgvc2ggbDcF+EDjxX70P0p4=; b=Fv3ZHJzmL7cWu+WMMFPLL+92Ais5GH0ZL0EpmM8qE7EX5U2WigXfkhoX1Iw52dkifh ER6ZLc9Ia8+A9DlcPsYuwV1N7Eu1iZE5S1RU3aAPxx44rX4JyJxIlP0hFlRzmY1SDSUK V5Ujon754xj5ws959vIWaicpPgJOhgEtVbjTOl9osgDxVnA0OLzvfSpsenLzWZ9b9T+J 9Yd8ym0tp/ljKpSEmDLM1iwFKD4AOAwO5qW88XHWC6qCMkQ+IOjC/RLnfJpzW9+v2Nr5 vqty/k2H6G2Xn5J0sBf2qpVDFICExjXaP1Xw4ixmbc2T+HzY3qT8llffyOT/lYiXqd7I mpJQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2eURCWa/LUofeY1t4owcVgvc2ggbDcF+EDjxX70P0p4=; b=X/W4prq67TJFw1wl/GmBovFidKYebsQkErYSfEPgkwOzpa/WhdgeIhuHMkeT9WvBn5 tSuPcCThuj5BfCsbAp7TZPTboWt9iiWRZfLK5QFFvcn377NGF+dT+D1/Bf6rTG27b3pK GhmbyKrZ48hKsmiVS9iTXj5YKMAHsISgeDgDEMaFajPTJFsh+aaRWu2JACptw0dv+9XD 58RZNpN1d03/a/vaQkWmAyqlM+bVNJXHm/MToSlKnoXfJSXcttl4REAFqJHZEOYFEpZf aM5/dln8j3xDAtcY05osVHCY8GW6qjKTJOp5aMIS/43zFDFjWZtqaKaMWxfn5VpPJErb t9qA==
X-Gm-Message-State: AOAM531R4M7RiGqO7KxPrrJdynsY8sm5vqFgRn/x8RW5qpdSGjdwWf6/ fFwjlm44FVyXcv4+JysHCfC0B6D8lzFGxrjgZpYzBg==
X-Google-Smtp-Source: ABdhPJz2S8w2c4QXlMFPNa80BeSvjLc2JbxUmUu2DdkvGAkCnMSPeUIy1Jt8OBwaXvlteM5voZ42pCy6eoVR+cFmx0E=
X-Received: by 2002:a67:e28c:: with SMTP id g12mr5498623vsf.31.1596038625840; Wed, 29 Jul 2020 09:03:45 -0700 (PDT)
MIME-Version: 1.0
References: <20200728191331.GV41010@kduck.mit.edu> <e928e548-f82d-2809-200e-0fc4ac93db14@cs.tcd.ie> <20200728194235.GY41010@kduck.mit.edu> <1c4951d6-a67c-47c6-315e-2ad3776c94ec@cs.tcd.ie> <CAG5KPzx0RsYmS8E78Giz5we6bgOmwMvTUH6q_Qk-2gfSVFsLGg@mail.gmail.com> <b7a7fb62-6bba-b628-0d06-890f5211f85a@cs.tcd.ie>
In-Reply-To: <b7a7fb62-6bba-b628-0d06-890f5211f85a@cs.tcd.ie>
From: Daniel Migault <mglt.ietf@gmail.com>
Date: Wed, 29 Jul 2020 12:03:34 -0400
Message-ID: <CADZyTkmYXOWQYHw1_EVRCivesKC2QDUmP5DHDfT6gVdkoBSwKw@mail.gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Cc: Ben Laurie <ben@links.org>, IETF Security Area Advisory Group <saag@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000057d30e05ab96b3e6"
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/CLt1m8n5rwouSuiKm_ag0vkTWgk>
Subject: Re: [saag] On PKI vs. Pinning (SAAG 108 preview)
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Jul 2020 16:03:49 -0000

On Tue, Jul 28, 2020 at 4:09 PM Stephen Farrell <stephen.farrell@cs.tcd.ie>
wrote:

>
>
> On 28/07/2020 20:56, Ben Laurie wrote:
> > I'm a little surprised by this conversation. Why would SAAG want to
> support
> > a practice that flies in the face of everything we know about key
> > management?
>
> Sorry if I gave the wrong impression. I agree with you
> that pinning to application keys is a bad idea.
>

I am wondering what exactly is an application key. Is-it a sort of
self-signed certificate hard coded in the application or would a secret
generated by the application on  a per session basis is considered as an
application key.


>
> I do think there's a role for pinning to CAs that you
> already gotta trust, as a way to fail rather than allow
> a MITM, for the cases where that's better.
>
> One issue I see is that we have CA we do not trust. I suppose here that CA
pining is mentioned as opposed to certificate pinning. In both cases, it
seems to me that pinning these entities makes it very hard for the
application to change CA  or certificate.


> S
>
> >
> > On Tue, 28 Jul 2020 at 20:49, Stephen Farrell <stephen.farrell@cs.tcd.ie
> >
> > wrote:
> >
> >>
> >>
> >> On 28/07/2020 20:42, Benjamin Kaduk wrote:
> >>> Sorry for the clumsy description.  Basically, if you squint hard, you
> >> could
> >>> claim that at least some types of pinning are actually a PKI, just a
> >>> degenerate PKI.
> >>
> >> Ah gotcha.
> >>
> >> ISTM more useful to treat pinning as an adjunct to whatever
> >> PKI is used by the application that can be MITM'd and not
> >> bother with pinning as a potential replacement for that
> >> PKI. There's nothing wrong with an application being based
> >> on it's very-own PKI of course, but seems less useful for
> >> the IETF to try describe pinning for custom protocols where
> >> we don't know the details.
> >>
> >> Cheers,
> >> S.
> >> _______________________________________________
> >> saag mailing list
> >> saag@ietf.org
> >> https://www.ietf.org/mailman/listinfo/saag
> >>
> >
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>


-- 
Daniel Migault
Ericsson

v2.23.0 | Report a Bug | By Email