Re: [saag] On PKI vs. Pinning (SAAG 108 preview)

[Nico Williams <[e-mail]>]

On Tue, Jul 28, 2020 at 12:13:31PM -0700, Benjamin Kaduk wrote:
> One of the agenda items for Thursday's SAAG session at IETF 108 is
> "Discussion on PKI vs. Pinning Applicability".  This is intended to be
> Security Area Advisory Group in its core meaning -- I want to get the sense
> of the IETF security community.  There are some draft slides for SAAG at
> https://www.ietf.org/proceedings/108/slides/slides-108-saag-chair-slides-pkipinning-bcp-72-00
> (starting at slide 33; note to self: change template to include slide
> numbers), and in true IETF spirit I'm hoping we can get a lot of it covered
> on the list in advance.
> 
> As a lead-in, this topic came to mind due to a thread on the NFSv4 list,
> discussing the RPC-over-TLS work that's in IESG Evaluation.  A participant
> made the claim (see thread at
> https://mailarchive.ietf.org/arch/msg/nfsv4/SLTNqWbjE-H8JshLk0HwlwxArrI/)
> that certificate pinning is needed for RPC-TLS, and I did not have the
> impression that this was the consensus position of the IETF security
> community ... but I also don't have any data to support that impression
> (yet?).

Speaking as an implementor of credential orchestration systems for
corporate networks, the claim that NFSv4-over-TLS requires pinning is
wrong.  NFSv4-over-TLS, like most applications running over TLS, needs a
reasonable management solution for a) conveying trust anchors to relying
parties, b) certifying (here: server) keys in those PKIs.

In a corporate network I absolutely would not want TOFU.

But in any case, as long as the server software lets me configure a
credential, and the client software lets me configure TOFU (with or
without interactive confirmation), or pre-share keys.  I'm ok with the
RFC talking about pinning, though I would prefer it leave all details of
how the TLS server is authenticated to... the TLS spec.

Nico
--