Re: [websec] #58: Should we pin only SPKI, or also names

[Yoav Nir <[e-mail]>]

On Aug 8, 2013, at 6:38 AM, Trevor Perrin <[e-mail]> wrote:

> On Wed, Aug 7, 2013 at 8:53 AM, Yoav Nir <[e-mail]> wrote:
>> 
>> On Aug 7, 2013, at 1:14 PM, Trevor Perrin <[e-mail]> wrote:
>>> 
>>> Only CAs which had "opted-in" and provided the requisite info to
>>> browsers would be in the table.
>> 
>> I'm only wondering where I get a copy of that table and who maintains it.
> 
> CAs and Browsers would have to work that out.  I don't know what their
> preferred coordination method would be.

Yes. But they haven't so far. Since it's something that the CAs and browsers should work out, the obvious candidate organization is the CA/Browser forum. However, that organization contains neither all CAs not all browsers. It's easy to think that the set of browsers is {Chrome, IE, Firefox, Safari, Opera}, but there are dozens more. Relying on each one of them (including the small ones) getting information about labels from all CAs doesn't scale. Even more, the web server administrators need access to that list of labels and what it means.

So I suggest we don't include this now. Instead we make sure that whatever the result of #60 is, that HPKP is extensible. Later, when/if the CA/BF can get us a stable link to a list of labels, we can do a quick update document and add it then.

Objections?

Yoav