IETF Logo Mail Archive

Re: [saag] On PKI vs. Pinning (SAAG 108 preview)

Yaron Sheffer <yaronf.ietf@gmail.com> Wed, 29 July 2020 12:03 UTC

Return-Path: <yaronf.ietf@gmail.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 686803A09E4 for <saag@ietfa.amsl.com>; Wed, 29 Jul 2020 05:03:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.981
X-Spam-Level:
X-Spam-Status: No, score=-1.981 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, MALFORMED_FREEMAIL=0.116, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NDVE2Kbqae1i for <saag@ietfa.amsl.com>; Wed, 29 Jul 2020 05:03:35 -0700 (PDT)
Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16C633A0B6C for <saag@ietf.org>; Wed, 29 Jul 2020 05:03:25 -0700 (PDT)
Received: by mail-wr1-x429.google.com with SMTP id r4so18420059wrx.9 for <saag@ietf.org>; Wed, 29 Jul 2020 05:03:24 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version:content-transfer-encoding; bh=4DWi5SiGciSkGKP2bZYMWWXGdWJw5fuFCJ+qpMnxI/o=; b=OGvKRBnB6VtT6oc0vmBCS5e4/wvd3THEYmjHCDTRPr2yrvbu5q3n1jOPVefL0jCKIs UUS29nuJT3/2xcqlLQmxkRcmO0mde4C1/hR1cDWP/yJkye0AvZLdtZ6yURjfOy/WtbUr rYeNeN/NCr1H7IZKERDo2roC2GAaJ3uUoTjJheR3UcvIrKVS08ErU+gsCK0BNTa2jjh+ +HS1V6oHVRG3QSKiLly5URnFdLxhw2iBBgy0zKwa0mr36QYRI0YmtE5uCsGQ7hEKkA65 Q3AgMhboEmln7Ic4Q/4j9tsG/vzpiawX1f0Hpdfjm9r4tAO3obzmZJ4MpY3h4OvjCD4u cUhg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version :content-transfer-encoding; bh=4DWi5SiGciSkGKP2bZYMWWXGdWJw5fuFCJ+qpMnxI/o=; b=qsZq0CCCYVNDbYFol/WvnCkRi0ySEYBJ/0M9USZhGyZ0+/m6tNmGVwZOpLc9EwYYI+ xuQiRe0nB4g6+7LbklN5qKt+9yYBkFsszjr+1vZOcqUygq5WQ3eMnzXLMdfNpVruKfqB AGkp9g7Rm7hJC2TH7BBN1cS+UizVgc8K1heEAWiD0bzTdCdTdrOna+17AiXDgKAk6eyh e5Ns2B2bpiVpDWatTWqSRL/U+CqdqQaMDEUNQLfeQdcceafv4bFgLZiHmL89jshdkH4j VTFzPVMKXuhpzIqiGEVGlbjiqPsLfX9h8enGbxe1K7kGOvBUsd8kk3QXOWMqxBh98d+F SYdA==
X-Gm-Message-State: AOAM531jOxk0RE6IjS4BHAWl5uaz9NNI87vEoI6Ly7yHoGL7fU7OQ1mR gxQ+ZKShbGsQKkEg+ZdFa3M=
X-Google-Smtp-Source: ABdhPJzkd1yPymlHV+4p0GwH5cp5rLhZ+10TiRKnWLtMHXtkH86vR4YlKJcsqdZs4Q5CioyLMrbO7w==
X-Received: by 2002:a5d:6992:: with SMTP id g18mr28711995wru.15.1596024203452; Wed, 29 Jul 2020 05:03:23 -0700 (PDT)
Received: from [10.0.0.140] (bzq-109-66-125-13.red.bezeqint.net. [109.66.125.13]) by smtp.gmail.com with ESMTPSA id h11sm5433548wrb.68.2020.07.29.05.03.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Jul 2020 05:03:22 -0700 (PDT)
User-Agent: Microsoft-MacOutlook/16.39.20071300
Date: Wed, 29 Jul 2020 15:03:21 +0300
From: Yaron Sheffer <yaronf.ietf@gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Benjamin Kaduk <kaduk@mit.edu>
CC: saag@ietf.org
Message-ID: <5DFF62E7-6D72-44FC-9B03-2706E1BB7EDF@gmail.com>
Thread-Topic: [saag] On PKI vs. Pinning (SAAG 108 preview)
References: <20200728191331.GV41010@kduck.mit.edu> <e928e548-f82d-2809-200e-0fc4ac93db14@cs.tcd.ie> <20200728194235.GY41010@kduck.mit.edu> <1c4951d6-a67c-47c6-315e-2ad3776c94ec@cs.tcd.ie>
In-Reply-To: <1c4951d6-a67c-47c6-315e-2ad3776c94ec@cs.tcd.ie>
Mime-version: 1.0
Content-type: text/plain; charset="UTF-8"
Content-transfer-encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/rjXcsGn7Sov8sToEOwXoKNlqRmI>
Subject: Re: [saag] On PKI vs. Pinning (SAAG 108 preview)
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Jul 2020 12:03:39 -0000

Exactly! Daniel Migault and I published an RFC [1] on "identity pinning" in TLS 1.3. This is TOFU pinning seen as a second factor, where the first factor is PKI. It also happens to be very low maintenance and independent of certificate (EE and CA certificate) changes. This solution is especially useful for enterprise use cases, where certificate transparency doesn't do the job.

Thanks,
	Yaron

[1] https://www.rfc-editor.org/rfc/rfc8672.html

On 7/28/20, 22:49, "saag on behalf of Stephen Farrell" <saag-bounces@ietf.org on behalf of stephen.farrell@cs.tcd.ie> wrote:



    On 28/07/2020 20:42, Benjamin Kaduk wrote:
    > Sorry for the clumsy description.  Basically, if you squint hard, you could
    > claim that at least some types of pinning are actually a PKI, just a
    > degenerate PKI. 

    Ah gotcha.

    ISTM more useful to treat pinning as an adjunct to whatever
    PKI is used by the application that can be MITM'd and not
    bother with pinning as a potential replacement for that
    PKI. There's nothing wrong with an application being based
    on it's very-own PKI of course, but seems less useful for
    the IETF to try describe pinning for custom protocols where
    we don't know the details.

    Cheers,
    S.
    _______________________________________________
    saag mailing list
    saag@ietf.org
    https://www.ietf.org/mailman/listinfo/saag

v2.23.0 | Report a Bug | By Email