Re: [websec] Richard Barnes' Yes on draft-ietf-websec-key-pinning-19: (with COMMENT)

[Yoav Nir <[e-mail]>]

On Aug 6, 2014, at 10:23 PM, Richard Barnes <[e-mail]> wrote:

> Section 2.5. "at least one Pin that does NOT refer to an SPKI in the
> certificate chain"
> 
> I understand the motivation for this, but this doesn't actually force the
> site to have a backup pin -- they can just make up a pin value.  It seems
> like it would be more effective to make the recommendation in Section 4.3
> stronger.

I don’t think we can force a site to do thing securely with any protocol. TLS and the like require "32 bytes generated by a secure RNG” here and “nonce” there, yet the peer has no way of checking whether an implementation uses a 64-bit LFSR for the former and a hard-coded value for the latter. We’re hoping this requirement will steer them in the right direction, but there are no guarantees.

> But if the WG thinks the requirement for a backup pin is worth the effort, it is specified interoperably, so I'm not going to stand in the way.

It does. Besides, generating a real key is as easy as generating a fake one:
  openssl genrsa -out private 2048
  openssl rsa -in private -putout -outform DER -out public
  openssl dgst -sha256 -binary public | base64


> Section 4. "Security Considerations"
> 
> Most of these seem more like "Operational Considerations" or
> "How-To-Not-Brick-Your-Site Considerations".  :)

We felt that not bricking your site was very important. And it is security-relevant. If you don’t do these things, then a key compromise is augmented by a long-lasting DoS. If you don’t follow the advice, then this security mechanism actually makes the attacks worse.

Yoav