Re: [websec] #58: Should we pin only SPKI, or also names

I suppose it wasn't directly related to your point.  I was simply emphasizing why pinning to a CA is an important option.  There are current CA-customer relationships that would benefit and use a pin to a CA over a root certificate.

-----Original Message-----
From: Gervase Markham [mailto:gerv@mozilla.org] 
Sent: Wednesday, August 07, 2013 7:27 AM
To: jeremy.rowley@digicert.com
Cc: 'websec'
Subject: Re: [websec] #58: Should we pin only SPKI, or also names

Hi Jeremy,

On 07/08/13 14:24, Jeremy Rowley wrote:
> For pinning to a specific CA, the end user doesn't care which root 
> they are trusting.  They are indicating trust in an entire PKI.  In 
> this case, I think they expect the set of certificates to change, but 
> have delegated this trust to a set entity.  This is important for two 
> reasons: 1) CAs can partly mitigate the "too big to fail" routinely 
> cited as a major weakness in the industry by liming the number of 
> certs signed to each intermediate/root and
> 2) enterprises utilizing a completely managed PKI solution can gain 
> the benefits of pinning, increasing the potential for adoption and use 
> of pinning.

My apologies, but I am having difficulty tying your points (from "This is important..." onwards) to what I was saying. Can you elaborate?

Gerv

> -----Original Message-----
> From: websec-bounces@ietf.org [mailto:websec-bounces@ietf.org] On 
> Behalf Of Gervase Markham
> Sent: Wednesday, August 07, 2013 6:11 AM
> To: Trevor Perrin
> Cc: websec
> Subject: Re: [websec] #58: Should we pin only SPKI, or also names
> 
> On 07/08/13 12:12, Trevor Perrin wrote:
>> Hmm..  Not sure what you mean, specifically.
> 
> I mean, I think people who want to use pinning will expect the set of 
> certificates (and associated security practices) they are pinning to 
> not to change under their feet. This scheme means that they will. They 
> might also expect to define a pin and have it work everywhere HPKP is 
> supported, in exactly the same way. This scheme (due to client version
> skew) means that it may not.
> 
> Gerv
> _______________________________________________
> websec mailing list
> websec@ietf.org
> https://www.ietf.org/mailman/listinfo/websec
> 
> _______________________________________________
> websec mailing list
> websec@ietf.org
> https://www.ietf.org/mailman/listinfo/websec
> 