Re: [websec] #58: Should we pin only SPKI, or also names

["Jeremy Rowley" <[e-mail]>]

As would DigiCert.  Finding a home from the registry does not appear to be
difficult if CA pinning is supported.

Jeremy

-----Original Message-----
From: Rob Stradling [mailto:[e-mail]] 
Sent: Monday, August 12, 2013 4:13 PM
To: [e-mail]; 'Yoav Nir'
Cc: 'Trevor Perrin'; 'websec'
Subject: Re: [websec] #58: Should we pin only SPKI, or also names

Comodo would be happy to maintain this registry, if this WG decides that
it's required.

On 12/08/13 20:39, Jeremy Rowley wrote:
> There are a couple of groups, in addition to the CAB Forum,  that may 
> be interested in hosting a registrar.  Let me check with them and get 
> back to you.
>
> Many of those questions can be readily addressed once a group or once 
> several groups have expressed a willingness to participate.  The one 
> that this working group is best poised to answer is whether the 
> process details should be defined here or somewhere else.
>
> Jeremy
>
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On 
> Behalf Of Yoav Nir
> Sent: Monday, August 12, 2013 12:50 PM
> To: Trevor Perrin
> Cc: websec
> Subject: Re: [websec] #58: Should we pin only SPKI, or also names
>
>
> On Aug 12, 2013, at 7:11 PM, Trevor Perrin <[e-mail]> wrote:
>
>> On Mon, Aug 12, 2013 at 1:17 AM, Gervase Markham <[e-mail]>
wrote:
>>> On 11/08/13 05:25, Trevor Perrin wrote:
>>>> Could we just say:
>>>> - The holder of a domain name is responsible for specifying the 
>>>> SPKIs that it maps to.
>>>> - How the domain holder communicates this to the UA is out of scope.
>>>
>>> In other words "Don't set up a registry; just punt the problem and 
>>> hope something works itself out organically"?
>>
>> Yes.
>>
>> If people hate this, someone should make a proposal for a registry:
>>
>> - Who maintains it?
>> - How are requests to add or remove CA names authenticated?
>> - Does the registry map CA names to actual keys?
>>    - If so, how are change requests authenticated?
>>    - What are the timing rules to ensure changes are propagated to 
>> browsers as needed?
>> - How can the registry be monitored and double-checked to avoid it 
>> becoming a single point of failure?
>> - Should these process details be defined in the HPKP spec or 
>> somewhere
> else?
>
> As you've said, before this is for the CAs and browsers to come up 
> with such a solution (assuming they want it, and I'm not hearing this 
> from either the Mozilla people or the Google people on this list). CAs 
> and browers. Now, if only there was some forum where both of these come
together...
>
> Joking aside, The CA/Browser forum is not currently in the business of 
> running registries. IANA is, but I don't know how to specify in a 
> draft an IANA policy that would include following mergers, 
> acquisitions, and branding, and settling trademark disputes. Not do I 
> have any reason to believe that IANA would be willing to do this. So 
> unless the CA/Browser Forum agrees to take on this responsibility, and 
> provide stable link for both machine and human readable mappings, I 
> think this proposal should be shelved until we can find someone who will
answer your questions above.
>
> Yoav
>
> _______________________________________________
> websec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/websec
>
> _______________________________________________
> websec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/websec
>

--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: [phone]
Office Fax: [phone]
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690 Registered Office:
   3rd Floor, 26 Office Village, Exchange Quay,
   Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender by
replying to the e-mail containing this attachment. Replies to this email may
be monitored by COMODO for operational or business reasons. Whilst every
endeavour is taken to ensure that e-mails are free from viruses, no
liability can be accepted and the recipient is requested to use their own
virus checking software.