Re: [websec] #58: Should we pin only SPKI, or also names

[Yoav Nir <[e-mail]>]

On Aug 8, 2013, at 11:18 PM, Tobias Gondrom <[e-mail]>
 wrote:

> Hi,
> 
> <no hats>
> 
> On 08/08/13 04:38, Trevor Perrin wrote:
>> On Wed, Aug 7, 2013 at 8:53 AM, Yoav Nir <[e-mail]> wrote:
>>> On Aug 7, 2013, at 1:14 PM, Trevor Perrin <[e-mail]> wrote:
>>>> Only CAs which had "opted-in" and provided the requisite info to
>>>> browsers would be in the table.
>>> I'm only wondering where I get a copy of that table and who maintains it.
>> CAs and Browsers would have to work that out.  I don't know what their
>> preferred coordination method would be.
>> 
> 
> Hm, I did expect we could do the name pinning - if we want to do it -
> without additional coordination at all for this. If you pin to the name
> in the cert, this would only allow certs from this CA to be trusted for
> this specific domain. As in the repository of the browsers as it is
> today already. What did I miss here?

If you go to https://www.iana.org, you get the following certificate chain:
 - *.iana.org
 - Go Daddy Secure Certification Authority
 - Go Daddy Class 2 Certification Authority

So without any registry, you can pin to "Go Daddy Class 2 Certification Authority". But the next time IANA needs to get a certificate (August 2016), even if they get it from Go Daddy, they might get it from the other root CA ("Go Daddy Root Certificate Authority - G2"), which signs with SHA-256, and who knows, by then they might have a new one, perhaps with ECDSA. As a customer, you talk to a vendor. Most customers don't know which TA is actually going to be used. In some cases (Symantec) there are very many of them.

Someone needs to map "Symantec" to a list of pins, and IMO that someone is neither the IETF nor IANA.

Yoav