Re: [websec] Issue 56 - specify includeSubDomains for key pinning

Tom Ritter <tom@ritter.vg> Wed, 06 March 2013 02:55 UTC

MIME-Version: 1.0
In-Reply-To: <7c236f42fda755021433a4fd0ee04721.squirrel@webmail.dreamhost.com>
References: <7c236f42fda755021433a4fd0ee04721.squirrel@webmail.dreamhost.com>
From: Tom Ritter <tom@ritter.vg>
Date: Tue, 05 Mar 2013 21:55:27 -0500
Message-ID: <CA+cU71kJ9+aSk0u5Tk8Q3e0ryqv1yL+HQC=wYYukw3iKWfb=fw@mail.gmail.com>
To: ryan-ietfhasmat@sleevi.com
Content-Type: text/plain; charset="ISO-8859-1"
Cc: websec@ietf.org
Subject: Re: [websec] Issue 56 - specify includeSubDomains for key pinning
Precedence: list

On 4 March 2013 19:58, Ryan Sleevi <ryan-ietfhasmat@sleevi.com> wrote:
> Is the added language acceptable? Are there any concerns with the
> validation/processing model that would prevent us from closing out this
> issue?

It took me a while to get it (so maybe a clarification appendix would
be good?), but I think I do and I think it works.

Although, I suppose there's no real support for a mechanism where
exmaple.com has includeSubdomains that applies to a, b, c.example but
d.example says "max-age=0".  D will wind up being pinned regardless.
I think that's okay, just noting it.

As an aside, Section 2.3.1 says
"Note the host as a Known HSTS Host if it is not already so noted"

I think that should be "Known Pinned Host"?  I thought we were
separating Require-SSL from Require-These-Keys.

-tom

[websec] Issue 56 - specify includeSubDomains for… Ryan Sleevi
Re: [websec] Issue 56 - specify includeSubDomains… Tom Ritter