Return-Path: X-Original-To: websec@core3.amsl.com Delivered-To: websec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E63A128C0EE for ; Tue, 29 Mar 2011 15:23:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.322 X-Spam-Level: X-Spam-Status: No, score=-2.322 tagged_above=-999 required=5 tests=[AWL=0.277, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FUQ3+vvtomLi for ; Tue, 29 Mar 2011 15:23:55 -0700 (PDT) Received: from che.mayfirst.org (che.mayfirst.org [209.234.253.108]) by core3.amsl.com (Postfix) with ESMTP id 5A4673A695B for ; Tue, 29 Mar 2011 15:23:55 -0700 (PDT) Received: from [192.168.13.75] (lair.fifthhorseman.net [216.254.116.241]) by che.mayfirst.org (Postfix) with ESMTPSA id AF25CF975 for ; Tue, 29 Mar 2011 18:25:31 -0400 (EDT) Message-ID: <4D925C55.1070900@fifthhorseman.net> Date: Tue, 29 Mar 2011 18:25:25 -0400 From: Daniel Kahn Gillmor User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.15) Gecko/20110309 Icedove/3.1.9 MIME-Version: 1.0 To: websec@ietf.org References: <4D92317B.6020804@fifthhorseman.net> In-Reply-To: X-Enigmail-Version: 1.1.2 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="------------enigF428EBE052DF79068BC0082F" Subject: Re: [websec] Decouple HSTS's two orthogonal effects? X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: websec@ietf.org List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Mar 2011 22:23:57 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigF428EBE052DF79068BC0082F Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 03/29/2011 04:58 PM, Adam Barth wrote: > There's no coupling between HSTS and the particular algorithm a UA > uses to verify certificates. The UA is free to use whatever > verification mechanism it desires. You can remove whatever CAs you > consider sloppy from the list of trusted certificate authorities and > add in whatever other verification mechanism you like. >=20 > For example, if/when certificate verification through DNSSEC becomes > widespread, we won't need to change anything about the HSTS spec. Of > course, we'll need to change our implementations, but that's true > regardless of what the HSTS spec says. I hear what you're saying; however, i'm unaware of any HSTS-compliant User Agent that implements anything but the standard weakest-link X.509 certificate pool of trusted authorities. Perhaps an explicit mention that says HSTS is not intended to be incompatible with alternative certificate verification mechanisms would provide useful guidance to browser vendors? --dkg --------------enigF428EBE052DF79068BC0082F Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQJ8BAEBCgBmBQJNklxVXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQwRUU1QkU5NzkyODJEODBCOUY3NTQwRjFD Q0QyRUQ5NEQyMTczOUU5AAoJEMzS7ZTSFznp9XwQAJceO2BF0eP1b5r3I22R56Lx H9N532zzaCPGxgR3Z3XcmRgEvbvdVnBOceDH7FD9v5PyWg7IYGFVZtX09xNu7jPs yCHUofW5Q7uePzd/ZJ8QA11KmzMY61MHxzrULq/xc9nJuSQbYvEdA1Gq5IVemOGJ VfVdWr6DH++Fwk6iHiWgYFqLOku6767Ps4nN02VpqYbdIWczjswijc0a4weTuFjt arNJB3yV5nIVDoGmVd9QXrv+9IifGE2u4gITTViESSGR60F2sm/1ojfjRUhFsu1m 0BX3uPAj0Tr4+9GQbdZ87Ablf7GkEihRk6HAZegeb8E+3wsHimmjATCHSEvTs+cv 96JwvGRRsFBfMsSCdYFmwSbzU1WEbpGAGrzs0L5mqdcgxO2iXo8PXxUmI7LElH8B HAWx5s2d7O4uHmyDAfmcWrJEveKoK5IDkZJ/XmwpVLuydTTSFZ1eaaBpFXm7Zi+w 6jMX6TqdcBi/OULTYm+vb4KbKqSdWxkBuEdyoh5SWOh4HK00b3+qUFRE6Sx2yzl0 rnELYiR211RSMcRWRWxN/sAl/wn9Zd2KFOLAqDdEYaFCjaLDB9J4UvMO3SFQ3WYk tueTb1NXeFHdnVkX2WrtoXpQLSfAMH0qs3yZfm5YP2PdaEjhjZ+jYPhx9IDy7wNq HP8NzJyL3PsKI/FKIJ5Y =As/w -----END PGP SIGNATURE----- --------------enigF428EBE052DF79068BC0082F--