[websec] PKP-RO (was Re: I-D Action: draft-ietf-websec-key-pinning-12.txt)

Trevor Perrin <trevp@trevp.net> Thu, 05 June 2014 00:49 UTC

MIME-Version: 1.0
Date: Wed, 04 Jun 2014 17:48:51 -0700
Message-ID: <CAGZ8ZG1L3nKKv41=GLW62pUA+MeFXvhWn28d=rOXtJmxydG7wQ@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: Chris Palmer <palmer@google.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/yYnltxEdL97VMX43CUJlO1oMTHM
Cc: IETF WebSec WG <websec@ietf.org>
Subject: [websec] PKP-RO (was Re: I-D Action: draft-ietf-websec-key-pinning-12.txt)
Precedence: list

Anyone have comments on below?  Is there agreement on what PKP-RO should do yet?


On Mon, May 19, 2014 at 11:28 PM, Trevor Perrin <trevp@trevp.net> wrote:
> On Tue, May 13, 2014 at 2:09 PM, Chris Palmer <palmer@google.com> wrote:
>>
>> PKP vs. PKP-RO:
>> https://code.google.com/p/key-pinning-draft/source/detail?r=994a00dc31bf2cca6f3edea29871a6a4f18090f9
>
> The new text about PKP-RO in 2.5 (quoted below) seems to say that a
> PKP-RO header is only evaluated against the current connection, not
> stored as a pin.  I thought we decided the opposite (which is what I
> think 2.3.2 is saying):
>
> 2.3.2 (existing text):
>   If a Host sets both the Public-Key-Pins header and the Public-Key-
>    Pins-Report-Only header, the UA MUST note and enforce Pin Validation
>    as specified by the Public-Key-Pins header, and SHOULD note the Pins
>    and directives given in the Public-Key-Pins-Report-Only header.
>
> 2.5 (new text):
>     The UA SHOULD NOT note any pins or other policy expressed in the PKP-
>     RO response header field.


Trevor

[websec] PKP-RO (was Re: I-D Action: draft-ietf-w… Trevor Perrin
Re: [websec] PKP-RO (was Re: I-D Action: draft-ie… Chris Palmer