IETF Logo Mail Archive

Re: [websec] #58: Should we pin only SPKI, or also names

Yoav Nir <ynir@checkpoint.com> Mon, 12 August 2013 03:58 UTC

Return-Path: <ynir@checkpoint.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BB9421F9DB2 for <websec@ietfa.amsl.com>; Sun, 11 Aug 2013 20:58:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.517
X-Spam-Level:
X-Spam-Status: No, score=-10.517 tagged_above=-999 required=5 tests=[AWL=0.082, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mpeIhGU8P0oG for <websec@ietfa.amsl.com>; Sun, 11 Aug 2013 20:58:37 -0700 (PDT)
Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 7813021F9C72 for <websec@ietf.org>; Sun, 11 Aug 2013 20:52:18 -0700 (PDT)
Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id r7C3qFuR020163; Mon, 12 Aug 2013 06:52:15 +0300
X-CheckPoint: {52085BEF-0-1B221DC2-1FFFF}
Received: from IL-EX10.ad.checkpoint.com ([169.254.2.105]) by DAG-EX10.ad.checkpoint.com ([169.254.3.223]) with mapi id 14.02.0342.003; Mon, 12 Aug 2013 06:52:14 +0300
From: Yoav Nir <ynir@checkpoint.com>
To: Trevor Perrin <trevp@trevp.net>
Thread-Topic: [websec] #58: Should we pin only SPKI, or also names
Thread-Index: AQHOjHagv3/BmvZ4wU6WrbkIw+Bd/ZmAXZOAgAADk4CAAHu6gIAIRDGAgAJ+5gCAA6qMgIAAd7oAgABIiACAACPEgIAAAuAAgAALc4CAAAwRAIAAHX2AgAAE7wCAAGgggA==
Date: Mon, 12 Aug 2013 03:52:14 +0000
Message-ID: <1A99AD15-D0D3-4EFB-9365-58BC0EDAD54E@checkpoint.com>
References: <060.be9b0009dc0350ca543f553042673944@trac.tools.ietf.org> <073501ce8c6e$f6c17d90$e44478b0$@digicert.com> <CAMm+LwjdGJC4FHCJ_OAYGRqCGGc0Nz1pLV=yVGK9M9E7drfujQ@mail.gmail.com> <CAOuvq200e9HnPX1w9sZ+e7ipBmdgZdPL5xzKDgcaDpSxz1N=gg@mail.gmail.com> <CAMm+Lwh384YBMXw-BDoxJw+AN4qv8x6GQpF9YK4PW1gQRnadpg@mail.gmail.com> <6125A841-6C85-4858-B37F-C021067F0CFA@checkpoint.com> <2035FF99-A079-4F2F-B4DE-962FE1C1B964@checkpoint.com> <CAOuvq20O9bqHGR-5eKPmasNnWEuNW7ACL7PxM09yoTmmyt1UUg@mail.gmail.com> <CAGZ8ZG2C4uB=4vgH325TWeNW89ne4E_DN0j9ZV0t2AKa1o+x9g@mail.gmail.com> <520776C0.9080202@gondrom.org> <CAGZ8ZG1s2gCUZiYaj4q=+S_9M8apRPPura5YU_n8aiW9QcoQZQ@mail.gmail.com> <5207D199.9000207@gondrom.org> <CAGZ8ZG3vnt4LZR01Gnj6oofRB3AOEjcT7OCULMVG0O4W=9HDbA@mail.gmail.com> <9B14206B-5B73-4F91-9F54-3A2F651F768F@checkpoint.com> <CAGZ8ZG3qo5MhwPRfcy+POPZE7rpFG2qH2def_tgSwap+QvAf=g@mail.gmail.com> <E0BA0FA1-8792-4F3D-BCB2-A8F0B8CEE6CD@checkpoint.com> <CAGZ8ZG19M3343op1OQMo63_RBaW-F5FtVCtBsAGzOta2oPS+QQ@mail.gmail.com>
In-Reply-To: <CAGZ8ZG19M3343op1OQMo63_RBaW-F5FtVCtBsAGzOta2oPS+QQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [172.31.21.253]
x-kse-antivirus-interceptor-info: scan successful
x-kse-antivirus-info: Clean
x-cpdlp: 11a288213a60724dca2faef22ecc8abd1262ecca37
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <F43D929B3484A045A8BFEE100A242D7C@ad.checkpoint.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] #58: Should we pin only SPKI, or also names
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Aug 2013 03:58:43 -0000

On Aug 12, 2013, at 12:39 AM, Trevor Perrin <trevp@trevp.net> wrote:
> 
>>> If named pinning proves useful and lots of other CAs and browsers want
>>> to sign up, a more scaleable process can be designed then.
>> 
>> If I was assigned to do the SecDir review on this, I would push back on this.
> 
> Why?

Because that leave a part of the protocol that can't be implemented unless something happens that we don't specify.
Because only the big name browsers, who can get information directly from CAs will be able to implement this.
Because the list of acceptable strings would need to be updated often, and absent a registry, this means software update, and we shouldn't rely on those.
Because the chances of a misconfiguration resulting in a blocked site seem to me to be too high.

Yoav

v2.23.0 | Report a Bug | By Email