Subject: Re: [websec] HSTS: pinning certs, other changes to TLS server authentication
From: Adam Barth <[email-masked]>
To: Matt McCutchen <[email-masked]>
Cc: [email-masked]
Date: Wed, 23 Mar 2011 20:36:32 -0700
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>

On Wed, Mar 23, 2011 at 8:31 PM, Matt McCutchen <[email-masked]> wrote:
> The following observations were made on EFF's SSL Observatory list
> (https://mail1.eff.org/pipermail/observatory/2011-March/000086.html):
>
> On Wed, 2011-03-23 at 12:56 -0400, Matt McCutchen wrote:
>> HTTP Strict Transport Security does not pin the cert (it only
>> prevents the user from accepting bad certs), so it is exposed to CA
>> compromises.  SSH is not.
>
> On Wed, 2011-03-23 at 12:00 -0600, Hodges, Jeff wrote:
>> Yes, as presently specified and implemented in it's _draft_ form.
>>
>> This could change. [...]
>>
>> Also, HSTS is arguably an intermediate-term (and specific-to-http)
>> approach to the more general issue of network application
>> advertisement of security policy. I.e. future work may supplant it.
>
> On Wed, 2011-03-23 at 14:08 -0400, Matt McCutchen wrote:
>> Understood.  But I wouldn't propose to change that.  HSTS is the wrong
>> place to fundamentally change the TLS server authentication model.
>
> On Wed, 2011-03-23 at 12:24 -0600, Hodges, Jeff wrote:
>> I nominally disagree with the latter for various reasons, but we
>> should discuss on websec@
>
> Jeff, if you had something more to say, I invite you to say it.

Thanks for forwarding the thread.  There have been a bunch of people
asking for the ability to pin a certificate (or a CA certificate)
using HSTS.  In light of recent events, that's sounding more and more
like something we should consider.

Adam