Re: [websec] #58: Should we pin only SPKI, or also names

[Gervase Markham <[e-mail]>]

Hi Jeremy,

On 07/08/13 14:24, Jeremy Rowley wrote:
> For pinning to a specific CA, the end user doesn't care which root they are
> trusting.  They are indicating trust in an entire PKI.  In this case, I
> think they expect the set of certificates to change, but have delegated this
> trust to a set entity.  This is important for two reasons: 1) CAs can partly
> mitigate the "too big to fail" routinely cited as a major weakness in the
> industry by liming the number of certs signed to each intermediate/root and
> 2) enterprises utilizing a completely managed PKI solution can gain the
> benefits of pinning, increasing the potential for adoption and use of
> pinning.

My apologies, but I am having difficulty tying your points (from "This
is important..." onwards) to what I was saying. Can you elaborate?

Gerv

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Gervase Markham
> Sent: Wednesday, August 07, 2013 6:11 AM
> To: Trevor Perrin
> Cc: websec
> Subject: Re: [websec] #58: Should we pin only SPKI, or also names
> 
> On 07/08/13 12:12, Trevor Perrin wrote:
>> Hmm..  Not sure what you mean, specifically.
> 
> I mean, I think people who want to use pinning will expect the set of
> certificates (and associated security practices) they are pinning to not to
> change under their feet. This scheme means that they will. They might also
> expect to define a pin and have it work everywhere HPKP is supported, in
> exactly the same way. This scheme (due to client version
> skew) means that it may not.
> 
> Gerv
> _______________________________________________
> websec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/websec
> 
> _______________________________________________
> websec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/websec
>