Re: [websec] #58: Should we pin only SPKI, or also names

[Yoav Nir <[e-mail]>]

[with chair hat on]

Hi

So far, only Phil and Jeremy have been in favor of making this change. I don't think we have consensus for this change.

Even if others chime in now and say that they do want this change, I think we can't just ask administrators to list random names in headers or resources. For example, what string do you use for the bunch of trust anchors formerly known as "Verisign"?  Do you call it "Verisign"?  "VERISIGN"? "Symantec"? Are the Thawte public keys covered by the "Symantec" label? the "Verisign" label?  A wrong choice by an administrator (like getting your next certificate from a Thawte brand CA and expecting it to be covered by your "Symantec" pin) could lead to bricking the site.

That is not to say we must not do this, but we must not do this without a registry for CA strings. The go to body for registries at the IETF is IANA, but I don't think we've ever had an IANA registry for brand names. So unless we can get some body (the CA/Browser Forum ?) to create such a registry and provide a stable link that we can reference, I think this is a non-starter. Even with such a registry, I don't see consensus for this.

Yoav