Re: [websec] HSTS: pinning certs, other changes to TLS server authentication
Matt McCutchen <matt@mattmccutchen.net> Thu, 24 March 2011 03:53 UTC
Return-Path: <matt@mattmccutchen.net>
X-Original-To: websec@core3.amsl.com
Delivered-To: websec@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 47FE83A67E9 for <websec@core3.amsl.com>; Wed, 23 Mar 2011 20:53:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6nxAUUz0fheT for <websec@core3.amsl.com>; Wed, 23 Mar 2011 20:53:17 -0700 (PDT)
Received: from homiemail-a2.g.dreamhost.com (caiajhbdcahe.dreamhost.com [208.97.132.74]) by core3.amsl.com (Postfix) with ESMTP id 547443A67DF for <websec@ietf.org>; Wed, 23 Mar 2011 20:53:17 -0700 (PDT)
Received: from homiemail-a2.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a2.g.dreamhost.com (Postfix) with ESMTP id D9504280071; Wed, 23 Mar 2011 20:54:51 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=mattmccutchen.net; h=subject:from :to:cc:in-reply-to:references:content-type:date:message-id :mime-version:content-transfer-encoding; q=dns; s= mattmccutchen.net; b=J8OdfEBE6JXozfO+b8Mf+MkgYbc9mRvKh7lCU2I0OqM zO9jOCf5WlfM954oFqtD8F75uAlJNp2gOmrfk1ky4ISU+X52NEnyNuK4/XaE/eAr QlSEjjYk2F4HgX5qnQXLcC8g8YIPUQ/TSYHw4+pzYvK8+BlIhSoQXrPtgIoo7Bsk =
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=mattmccutchen.net; h= subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:content-transfer-encoding; s= mattmccutchen.net; bh=c6j7h7DE0R31xv5s7XpCrsbchPA=; b=kf/oabWXyB qN9N0TpwnmA5XvT/YNkQzAKKwe9ooAJULfYGeLFw8bZrycKd263B0uOswEJ9loRe 8t5q6s601uIBqXg10TXf7B7DDqE6/txPzMKLayf3GAvpMxrEXDEqBlTG6WpSp54l iWjDXJrnRven/krzEWSd99uN7aoqgOxcg=
Received: from [192.168.1.40] (pool-96-231-2-98.washdc.east.verizon.net [96.231.2.98]) (Authenticated sender: matt@mattmccutchen.net) by homiemail-a2.g.dreamhost.com (Postfix) with ESMTPA id 4C58B280069; Wed, 23 Mar 2011 20:54:51 -0700 (PDT)
From: Matt McCutchen <matt@mattmccutchen.net>
To: Adam Barth <ietf@adambarth.com>
In-Reply-To: <AANLkTikdUn8sfLs18oUmBk4oeB13MLstn+Fgi5BbSRNM@mail.gmail.com>
References: <1300937463.2117.224.camel@localhost> <AANLkTikdUn8sfLs18oUmBk4oeB13MLstn+Fgi5BbSRNM@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Date: Wed, 23 Mar 2011 23:54:49 -0400
Message-ID: <1300938889.2117.239.camel@localhost>
Mime-Version: 1.0
X-Mailer: Evolution 2.32.3
Content-Transfer-Encoding: 7bit
Cc: websec@ietf.org
Subject: Re: [websec] HSTS: pinning certs, other changes to TLS server authentication
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Mar 2011 03:53:18 -0000
On Wed, 2011-03-23 at 20:36 -0700, Adam Barth wrote: > Thanks for forwarding the thread. There have been a bunch of people > asking for the ability to pin a certificate (or a CA certificate) > using HSTS. In light of recent events, that's sounding more and more > like something we should consider. Maybe. Pinning certs is a stopgap; it obviously doesn't work on the first connection, and it places potentially significant operational constraints on the web site. I have a hard time seeing it as a step toward a coherent server authentication scheme that solves the problems we are facing today. But it may be a useful thing to do in light of the typical temporal and spatial scope of MITM attacks. (Can anyone comment on this?) -- Matt
- [websec] HSTS: pinning certs, other changes to TL… Matt McCutchen
- Re: [websec] HSTS: pinning certs, other changes t… Adam Barth
- Re: [websec] HSTS: pinning certs, other changes t… Matt McCutchen
- Re: [websec] HSTS: pinning certs, other changes t… Thomas Roessler
- Re: [websec] HSTS: pinning certs, other changes t… Tobias Gondrom
- Re: [websec] HSTS: pinning certs, other changes t… Adam Barth
- Re: [websec] HSTS: pinning certs, other changes t… =JeffH
- Re: [websec] HSTS: pinning certs, other changes t… Thomas Roessler
- Re: [websec] HSTS: pinning certs, other changes t… Adam Barth
- Re: [websec] HSTS: pinning certs, other changes t… =JeffH