Re: [websec] Protocol Action: 'Public Key Pinning Extension for HTTP' to Proposed Standard (draft-ietf-websec-key-pinning-21.txt)

"Hodges, Jeff" <jeff.hodges@paypal.com> Fri, 17 October 2014 00:23 UTC

DomainKey-Signature: s=paypalcorp; d=paypal.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:Received: From:To:Subject:Thread-Topic:Thread-Index:Date:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:user-agent: x-originating-ip:Content-Type:Content-ID: Content-Transfer-Encoding:MIME-Version:Return-Path: X-CFilter-Loop; b=mevNYe2r5Se7KJyVruoYJa1M7bi82Wb1hXTDihr2gyi8goaIj/+UVNpr +uS4TkTIfkt8VSCLIWKQrwT5zMAR1iVHb0EpwH2KC2u8TyF4O0r6YRxRa m25TXxHeFkDJ2uBL2JVvQgY36Lb+jd9Oc65dPlakJQ7fNV7VwBH2B9Vy6 M=;
From: "Hodges, Jeff" <jeff.hodges@paypal.com>
To: websec mailing list <websec@ietf.org>
Thread-Topic: [websec] Protocol Action: 'Public Key Pinning Extension for HTTP' to Proposed Standard (draft-ietf-websec-key-pinning-21.txt)
Thread-Index: AQHP5vg6hMXUwww250Wr23cuaxm8xpwzYx8A
Date: Fri, 17 Oct 2014 00:23:56 +0000
Message-ID: <D065AFF1.25476%jeff.hodges@paypal.com>
References: <20141013151302.18153.31235.idtracker@ietfa.amsl.com>
In-Reply-To: <20141013151302.18153.31235.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/14.4.2.140509
Content-Type: text/plain; charset="utf-8"
Content-ID: <5464E149D9683A45833188D6C083B1B4@corp.ebay.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/-pjzW_IF3TGJlnP4rw9D6FF2dWg
Subject: Re: [websec] Protocol Action: 'Public Key Pinning Extension for HTTP' to Proposed Standard (draft-ietf-websec-key-pinning-21.txt)
Precedence: list

Congats!!


On 10/13/14, 8:13 AM, "The IESG" <iesg-secretary@ietf.org> wrote:

>The IESG has approved the following document:
>- 'Public Key Pinning Extension for HTTP'
>  (draft-ietf-websec-key-pinning-21.txt) as Proposed Standard
>
>This document is the product of the Web Security Working Group.
>
>The IESG contact persons are Barry Leiba and Pete Resnick.
>
>A URL of this Internet Draft is:
>http://datatracker.ietf.org/doc/draft-ietf-websec-key-pinning/
>
>
>
>
>
>Technical Summary
>
>This spec describes an extension to the HTTP protocol allowing web
>host operators to instruct user agents to remember ("pin") the hosts'
>cryptographic identities for a given period of time.  During that
>time, UAs will require that the host present a certificate chain
>including at least one Subject Public Key Info structure whose
>fingerprint matches one of the pinned fingerprints for that host.  By
>effectively reducing the number of authorities who can authenticate
>the domain during the lifetime of the pin, pinning may reduce the
>incidence of man-in-the-middle attacks due to compromised
>Certification Authorities.
>
>Review and Consensus
>
>Previous versions of this document received useful reviews on the
>mailing list. Many changes were introduced due to working group
>consensus, including to pin format, an includeSubdomains directive,
>and interaction with private trust anchors.
>
>Some changes were proposed and rejected by the working group,
>most notably named pins, a "strict" directive, and hard limits on the
>max-age directive. The consensus on these involved a long and hard
>discussion, but as chairs, Tobias and I believe that it is a regular
>rather than rough consensus.
>
>Two issues that were left for last were the interaction of pre-loaded
>pins with noted pins, and the processing of report-only pins. There
>was a lot of controversy and a lot of back-and-forth about these
>issues. We believe that the current drafts represents the working
>group's consensus, although at least one participant would have
>preferred a different outcome.
>
>Personnel
>
>Yoav Nir is the document shepherd. Barry Leiba is the responsible
>Area Director.
>
>_______________________________________________
>websec mailing list
>websec@ietf.org
>https://www.ietf.org/mailman/listinfo/websec
>

[websec] Protocol Action: 'Public Key Pinning Ext… The IESG
Re: [websec] Protocol Action: 'Public Key Pinning… Hodges, Jeff