Re: [websec] #58: Should we pin only SPKI, or also names

[Chris Palmer <[e-mail]>]

On Mon, Jul 29, 2013 at 9:13 AM, Phillip Hallam-Baker <[e-mail]> wrote:

> If we have a diginotar type situation again (FSM forefend), we want the pins
> to a root to be broken at the same time the root is unloaded, yes?

If the root of a site's cert chain --- really, any signer --- is
blacklisted or even just removed from the trust anchor store, pins and
Pin Validation are irrelevant since the chain won't validate. Pin
Validation happens only *after* all other certificate chain checks are
performed.

> The trust anchor data structures are outside the PKIX model but they browser
> providers do need to track them regardless. I would rather tie pins to the
> actual entity we want to pin to (the CA) rather than attempt pinning to some
> sort of proxy.

Allowing sites to pin to any point in the certificate chain is a
feature, not a bug. However, it will almost always make the most sense
to pin to one or more CAs. Thus, making that easy is a good goal.

> There are CAs that are not represented in CABForum but CABForum is a place
> where we can get a requirement of the form 'every CA must pick a DNS name as
> a unique identifier for their service and report it to the browser
> providers'. And that requirement will quickly become universal.
>
> While we could choose a different string, Paul H.'s argument for using DNS
> names in CAA was a good one and I can't see any advantage to inconsistency.
> It also makes it much easier to make any scheme work with a private CA.

Agreed.