Re: [TLS] [pkix] Cert Enumeration and Key Assurance With DNSSEC

["Jeffrey A. Williams" <[e-mail]>]

Ralph and all,

-----Original Message-----
>From: Ralph Holz <[e-mail]>
>Sent: Oct 5, 2010 11:48 AM
>To: 
>Cc: [e-mail]
>Subject: Re: [TLS] [pkix] Cert Enumeration and Key Assurance With DNSSEC
>
>Hi,
>
>>   I am guessing here that you are in favor of pinning certs?
>> If my guess is correct, can you tell us all why you are?
>
>I am not sure I am in favour. The practical argument for it would be
>that a changed certificate should be reason for a user to stop for a
>moment and think. OK for now, maybe. However, many certs have life-times
>of 1 year or 2. Given that one day we may visit many more https-secured
>sites, we would likely see more false alerts again soon, too - precisely
>the thing that Firefox has been criticised for when it introduced its
>new warning dialogue.
>
>On a more theoretical basis, I am also not sure if the 1:1 binding of
>"one entity/identity - one key" is desirable.

We agree here.
>
>Still, given the current PKI trust model and the current state of PKI as
>such, I would probably vote with those in favour of pinning for the moment.

Ok I understand your point I think.  The bigger problem is, or seems to
be the trust model itself, which I have concerns about and made those
very clear on more than one occasion.  
>
>> I am not as there are instances where a perfictly valid cert
>> is used but that the issuing CA has had their Cert database
>> hacked or corrupted and a secondary Cert becomes necessary
>> or at least preferrable as a temporary fix.  Of course such
>> a cert would need to be issued by a different CA.
>
>Well... listening to CAs and their EV statements, such things should not
>happen too often anyway. It should not be a argument against pinning.

Maybe not, but given the state of CA's and now Trust anchors to a degree,
I don't see how logically and positively one can pin any Cert without
some possibility of miss-pinning same depending on of course what the
method one is pinning the Cert too exactly for assurance reasons.  I
can think and/or know of a few Trust Anchors I would NEVER try to pin
any cert too, and I can also think of several issuing and USG certified
CA's I would not, and do not trust regardless of which Anchor they may be
accurately/effectively pinned too.
>
>-- 
>Best regards,
>Ralph
>_______________________________________________
>TLS mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/tls

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [e-mail]
Phone: [phone]