Re: [websec] #58: Should we pin only SPKI, or also names

[Chris Palmer <[e-mail]>]

On Thu, Aug 8, 2013 at 1:42 PM, Yoav Nir <[e-mail]> wrote:

> If you go to https://www.iana.org, you get the following certificate chain:
>  - *.iana.org
>  - Go Daddy Secure Certification Authority
>  - Go Daddy Class 2 Certification Authority
>
> So without any registry, you can pin to "Go Daddy Class 2 Certification Authority". But the next time IANA needs to get a certificate (August 2016), even if they get it from Go Daddy, they might get it from the other root CA ("Go Daddy Root Certificate Authority - G2"), which signs with SHA-256, and who knows, by then they might have a new one, perhaps with ECDSA. As a customer, you talk to a vendor. Most customers don't know which TA is actually going to be used. In some cases (Symantec) there are very many of them.
>
> Someone needs to map "Symantec" to a list of pins, and IMO that someone is neither the IETF nor IANA.

Insane idea (yes, I know it is insane): What if we chose not to have a
registry, and let people use substrings of issuer certificate
CNs/OUs/whatevers as trust anchor set names?

Obvious problems:

* character set encoding in the HTTP header vs. in the X.509
certificate: Welcome To Fun-Land, Where Fun Is Not Very Fun(TM)
* silly substrings, like "Go" matching both "...Go Daddy..." and
"...Google Internet Authority..." and "...Evil Bad People (Goats)..."
* substitution characters: should "Securite" match "...Sécurité Réseau..." ?

I'm sure we can all think of more problems...