Re: [websec] #58: Should we pin only SPKI, or also names

[Trevor Perrin <[e-mail]>]

On Sun, Aug 11, 2013 at 2:21 PM, Yoav Nir <[e-mail]> wrote:
> There is a third party here. The web site administrators need to set one of those strings in the key pinning data, so they should be able to obtain the correct strings. There may be only 3 browsers and half a dozen CAs that would want to experiment with this, but there may be a lot more web sites. The CAs could add it to their websites: "use 'ca.example.com' for RFC 7xxx key pinning".

Sure, the CAs would tell their website customers what to use.


> Experimentation is tricky.
[...]
> When the UA connects again, the new certificate is there. The first pin no longer matches, so we need the browser to be able to verify that the new certificate matches ca.example.com. Once that is in some web sites, you can't stop the experiment. You'd have to go to each and every website that uses this pin and remove it.

It's easy to stop.  A browser that doesn't want to support named pins
could ignore any HPKP headers containing them.  If all browsers do
this, then HPKP is back to pure-SPKI pinning.


>> If named pinning proves useful and lots of other CAs and browsers want
>> to sign up, a more scaleable process can be designed then.
>
> If I was assigned to do the SecDir review on this, I would push back on this.

Why?


Trevor