Re: [websec] HSTS: pinning certs, other changes to TLS server authentication

[Adam Barth <[e-mail]>]

On Thu, Mar 24, 2011 at 5:03 AM, Thomas Roessler <[e-mail]> wrote:
> On 24 Mar 2011, at 04:54, Matt McCutchen wrote:
>> On Wed, 2011-03-23 at 20:36 -0700, Adam Barth wrote:
>>> Thanks for forwarding the thread.  There have been a bunch of people
>>> asking for the ability to pin a certificate (or a CA certificate)
>>> using HSTS.  In light of recent events, that's sounding more and more
>>> like something we should consider.
>>
>> Maybe.  Pinning certs is a stopgap; it obviously doesn't work on the
>> first connection, and it places potentially significant operational
>> constraints on the web site.  I have a hard time seeing it as a step
>> toward a coherent server authentication scheme that solves the problems
>> we are facing today.
>
> Stephen Farrell looked at parts of the problem a while ago and came up with a mechanism for cert switch-overs that he documented in RFC 5697.  Perhaps useful here.

Thanks for pointing out this RFC.  Unfortunately, this approach
doesn't work in the "rouge CA" threat model because the CA is
responsible for verifying that the old and new certificates were
issued to the same entity.  My understanding is that the rouge CA
threat model is of paramount importance to the folks interested in
certificate pinning, making this approach non-viable for our purposes.

Adam