Re: [websec] #58: Should we pin only SPKI, or also names

[Trevor Perrin <[e-mail]>]

On Thu, Aug 8, 2013 at 1:26 PM, Chris Palmer <[e-mail]> wrote:
> On Tue, Aug 6, 2013 at 11:19 PM, Yoav Nir <[e-mail]> wrote:
>
>> That is not to say we must not do this, but we must not do this without a registry for CA strings.
[...]
>
> With such a registry, I'd support it.


Do we need to do this now?

Could we just say:
 - The holder of a domain name is responsible for specifying the SPKIs
that it maps to.
 - How the domain holder communicates this to the UA is out of scope.

In the short term CAs and browser vendors could coordinate manually.
If this type of pinning becomes popular, more scalable mechanisms can
be evolved.

These mechanisms might be complex.  For example, CAs might publish
their key lists somewhere browser vendors could scan for them, and
there might be timing rules requiring changes be published X days in
advance, and requiring browser vendors to rescan for changes every Y
days.

But maybe it would be totally different.  Maybe we'd have to
experiment with multiple mechanisms.  And maybe named pinning won't
take off, so none of this is necessary.

So it seems best to separate this from HPKP, and advance HPKP now in a
way that lets us experiment with named pinning.  The hard work of
building a scaleable system for CA<->key mapping can be postponed
until it's necessary and we have a better understanding of
requirements.


Trevor