Re: [websec] #58: Should we pin only SPKI, or also names

[Trevor Perrin <[e-mail]>]

On Tue, Aug 6, 2013 at 11:19 PM, Yoav Nir <[e-mail]> wrote:
>
> So far, only Phil and Jeremy have been in favor of making this change.

I'm in favor.

This is relevant to the .well-known URI vs HTTP Header discussion.
Pinning CA names would reduce HPKP size, making frequent sending of
headers more palatable.

More importantly, maintaining a list of key hashes for a set of CAs is
a complex undertaking.  I think many potential adopters will be scared
away, or will do it incorrectly (pinning keys they shouldn't, omitting
keys they should, not keeping the list current, and so on).

Consider that Google has offered preloaded key pins in Chrome since
May 2011 [1].  Since then it looks like ~100 organizations (apart from
Google) have signed up for preloaded HSTS.  Only 3 have signed up for
preloaded key pins.  That suggests we need to do more to make pinning
attractive.

Of those 3, one is a major website with a number of subdomains and
some content served over CDN.  It's pinning two sets of keys, one with
36 keys, one with 19.  The WG seems eager to dismiss this as a zany
"outlier" case.  I think that's a cavalier attitude towards one of the
best data points we have.  It's entirely possible that many websites
would have to construct lists of similar size and complexity (or
worse).

--

Finally, let's look into our hearts.  Imagine you had to construct an
HPKP header that includes a few popular CAs (Symantec, Comodo, and
GoDaddy, for instance).

You of course want to exclude irrelevant roots (like code-signing).
And revoked, expired, or soon-to-be-expired roots.  And
cryptographically weak roots (e.g. 1024-bit RSA).  And you'd need to
include enough root or intermediate keys to cover all cert paths all
browsers might construct for all certs these businesses might issue to
you over the pin timeframe.  (Taking into account the vagaries of root
ownership, cross-certification, AIA chasing, etc.)

And once you've figured that out, you've got to track it over time.
Keys could get revoked, expire, change hands, acquire or issue new
certificates, and get added or removed from root stores.

To me, this sounds difficult even for web PKI experts, and close to
unmanageable for anyone who isn't.

--

Anyways, I hope HPKP can offer websites a safe and easy route to
declaring CA pins.  I think that means improving usability.

If people think I'm wildly exaggerating the usability issues, or have
other proposals / explanations of how to solve them, I'd like to hear
that...


Trevor


[1] https://www.imperialviolet.org/2011/05/04/pinning.html