IETF Logo Mail Archive

Re: [saag] On PKI vs. Pinning (SAAG 108 preview)

Michael Richardson <mcr+ietf@sandelman.ca> Mon, 17 August 2020 06:16 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C46633A09C5 for <saag@ietfa.amsl.com>; Sun, 16 Aug 2020 23:16:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cZpaMZaDj6vL for <saag@ietfa.amsl.com>; Sun, 16 Aug 2020 23:16:57 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47D573A09C1 for <saag@ietf.org>; Sun, 16 Aug 2020 23:16:57 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id C8244389E4; Mon, 17 Aug 2020 01:56:05 -0400 (EDT)
Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id OWD1jEUu2T4D; Mon, 17 Aug 2020 01:56:04 -0400 (EDT)
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id B4D40389E3; Mon, 17 Aug 2020 01:56:03 -0400 (EDT)
Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 4EEAA373; Mon, 17 Aug 2020 02:16:53 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Benjamin Kaduk <kaduk@mit.edu>, saag@ietf.org
In-Reply-To: <1c4951d6-a67c-47c6-315e-2ad3776c94ec@cs.tcd.ie>
References: <20200728191331.GV41010@kduck.mit.edu> <e928e548-f82d-2809-200e-0fc4ac93db14@cs.tcd.ie> <20200728194235.GY41010@kduck.mit.edu> <1c4951d6-a67c-47c6-315e-2ad3776c94ec@cs.tcd.ie>
X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Mon, 17 Aug 2020 02:16:53 -0400
Message-ID: <12777.1597645013@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/HPxsubj6TQs5MEibd4NdzBZRFHU>
Subject: Re: [saag] On PKI vs. Pinning (SAAG 108 preview)
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Aug 2020 06:16:59 -0000

{trying to catch up on this thread}

Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
    > On 28/07/2020 20:42, Benjamin Kaduk wrote:
    >> Sorry for the clumsy description.  Basically, if you squint hard, you could
    >> claim that at least some types of pinning are actually a PKI, just a
    >> degenerate PKI.

    > Ah gotcha.

    > ISTM more useful to treat pinning as an adjunct to whatever
    > PKI is used by the application that can be MITM'd and not
    > bother with pinning as a potential replacement for that
    > PKI. There's nothing wrong with an application being based
    > on it's very-own PKI of course, but seems less useful for
    > the IETF to try describe pinning for custom protocols where
    > we don't know the details.

Why would the protocol detail matter?
It some protocol (could be well known), that has a custom, non-CABForum
mediate, trust relationship.
So, basically, ALL of IoT: whether Web Connected devices that only ever call
home, or Information Centric Network IoT based systems of the future.
All of the remote attestation systems are based upon various amounts of
private-PKI pinning as well.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-

v2.23.0 | Report a Bug | By Email