Re: [websec] #58: Should we pin only SPKI, or also names

[Gervase Markham <[e-mail]>]

On 11/08/13 05:25, Trevor Perrin wrote:
> Could we just say:
>  - The holder of a domain name is responsible for specifying the SPKIs
> that it maps to.
>  - How the domain holder communicates this to the UA is out of scope.

In other words "Don't set up a registry; just punt the problem and hope
something works itself out organically"?

> So it seems best to separate this from HPKP, and advance HPKP now in a
> way that lets us experiment with named pinning.  The hard work of
> building a scaleable system for CA<->key mapping can be postponed
> until it's necessary and we have a better understanding of
> requirements.

I think there will be problems with people not being protected who
expect to be, if you allow this sort of pinning into the spec but leave
entirely undefined the mechanisms for communicating what it actually
should mean when someone pins to a name.

Gerv