Re: [websec] #58: Should we pin only SPKI, or also names

[Chris Palmer <[e-mail]>]

On Wed, Aug 7, 2013 at 3:47 AM, Gervase Markham <[e-mail]> wrote:

>> When a pinned CA wants to introduce a new root, it would need to
>> update the mapping and wait for the update to propagate before using
>> the new root to sign certs.
>
> Right - but users who were trusting "FooCA" would now be trusting a root
> they didn't know they were trusting.

The site operator had decided to trust FooCA to manage its operations
well and to issue certs well. If FooCA sets up a new root, that need
not change the operator's trust calculation. The explicit point of
this trust anchor set name mechanism is to allow site operators to not
care about the specific signing certificates FooCA uses. You seem to
be postulating a hypothetical site operator who wants to trust FooCA
generally, yet also wants to know about and trust only particular
issuing certificates that FooCA uses. That hypothetical site operator
sounds confused, to me: "Don't bother me with all these details; just
tell me everything."

> What happens if two CAs merge, and the acquiring CA wants to have all
> the roots of the acquired CA now under its brand?

Same thing. The site operator has chosen to trust FooCA. They can
trust FooCA to merge with only top-notch CAs (running their business
operations well), and continue pinning to the trust anchor set name
"FooCA". Or the operator can decide they hate the new merged business
entity, and switch to BarCA. Hopefully, they set a backup pin,
possibly to BarCA, and then they can do the switch quite quickly.
(They'll want a new backup pin, say QuuxCA, or a specific SPKI, or
whatever.)

> My concern is that this is an abstraction to make things work for people
> who don't want to think too hard about PKI, but that the abstraction is
> leaky, and will result in the violation of assumptions. I haven't spent
> too much time thinking about this and I've already thought of a few.

That's how abstractions are: The leakiness is a feature. If it weren't
leaky, it wouldn't be an abstraction. That's why we would offer
pinning to both trust anchor set names and specific SPKIs.