IETF Logo Mail Archive

Re: [websec] #58: Should we pin only SPKI, or also names

Phillip Hallam-Baker <hallam@gmail.com> Thu, 01 August 2013 16:43 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 571A521E81FE for <websec@ietfa.amsl.com>; Thu, 1 Aug 2013 09:43:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.516
X-Spam-Level:
X-Spam-Status: No, score=-2.516 tagged_above=-999 required=5 tests=[AWL=0.083, BAYES_00=-2.599, HTML_MESSAGE=0.001, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EvDM38MSaH7J for <websec@ietfa.amsl.com>; Thu, 1 Aug 2013 09:43:03 -0700 (PDT)
Received: from mail-we0-x22f.google.com (mail-we0-x22f.google.com [IPv6:2a00:1450:400c:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id DC1E421E815C for <websec@ietf.org>; Thu, 1 Aug 2013 09:43:02 -0700 (PDT)
Received: by mail-we0-f175.google.com with SMTP id q58so1910901wes.20 for <websec@ietf.org>; Thu, 01 Aug 2013 09:43:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=ndtluZJaygNZWXWYCEpoOigo1y+NZO+Ld/nOP1ZPkYQ=; b=Jp4CcGD8E231QJ/DbOIQQ9RpWuE61KXubNvDh9SWM8ModOcPVAN+ZPCceKnePJ6tuC W1nJakt99hdxrocTmYkl3OF0/tibzcGmbvVaDal3j0+d242tPgWJec4TSBZnArYivl60 6cBCBc8+gnjJs4gZahT8Rh9hvKL4gK+V89c1ldGa4pbuFsHe0kbcsniXKLn36Du8OHZL 3kCxfAYfi4qbssvVd0e/J4cbSjCszxKfafoH3vWg5iq7PY22JuQzLVZ/l4u+I7fMGgqg NnKTRbiJamBVxsrpW2CwnYw0gKoNtJ3IsZw4BO6pzl0h6hwe/R7vrrtvIUBQ51tM9F8t XD9w==
MIME-Version: 1.0
X-Received: by 10.180.182.229 with SMTP id eh5mr1787265wic.63.1375375381743; Thu, 01 Aug 2013 09:43:01 -0700 (PDT)
Received: by 10.194.6.67 with HTTP; Thu, 1 Aug 2013 09:43:01 -0700 (PDT)
In-Reply-To: <CAOuvq200e9HnPX1w9sZ+e7ipBmdgZdPL5xzKDgcaDpSxz1N=gg@mail.gmail.com>
References: <060.be9b0009dc0350ca543f553042673944@trac.tools.ietf.org> <073501ce8c6e$f6c17d90$e44478b0$@digicert.com> <CAMm+LwjdGJC4FHCJ_OAYGRqCGGc0Nz1pLV=yVGK9M9E7drfujQ@mail.gmail.com> <CAOuvq200e9HnPX1w9sZ+e7ipBmdgZdPL5xzKDgcaDpSxz1N=gg@mail.gmail.com>
Date: Thu, 01 Aug 2013 12:43:01 -0400
Message-ID: <CAMm+Lwh384YBMXw-BDoxJw+AN4qv8x6GQpF9YK4PW1gQRnadpg@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: Chris Palmer <palmer@google.com>
Content-Type: multipart/alternative; boundary="089e0163491e0fd25704e2e58977"
Cc: websec <websec@ietf.org>
Subject: Re: [websec] #58: Should we pin only SPKI, or also names
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Aug 2013 16:43:04 -0000

On Thu, Aug 1, 2013 at 12:30 PM, Chris Palmer <palmer@google.com> wrote:

> On Mon, Jul 29, 2013 at 9:13 AM, Phillip Hallam-Baker <hallam@gmail.com>
> wrote:
>
> > If we have a diginotar type situation again (FSM forefend), we want the
> pins
> > to a root to be broken at the same time the root is unloaded, yes?
>
> If the root of a site's cert chain --- really, any signer --- is
> blacklisted or even just removed from the trust anchor store, pins and
> Pin Validation are irrelevant since the chain won't validate. Pin
> Validation happens only *after* all other certificate chain checks are
> performed.


My point is that the people who were customers of Diginotar had to get new
certs quickly. The Dutch government has complained in several forums about
the way in which the Diginotar root was revoked. They had an entire
national port unable to function as a result.

If the root is revoked, the pins have to become inoperable and allow a user
to get a cert from any vendor.


Continuity of business is an issue here.


-- 
Website: http://hallambaker.com/

v2.23.0 | Report a Bug | By Email