IETF Logo Mail Archive

Re: [websec] draft-ietf-websec-key-pinning

Trevor Perrin <trevp@trevp.net> Wed, 27 August 2014 00:46 UTC

Return-Path: <trevp@trevp.net>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B0DD1A02CB for <websec@ietfa.amsl.com>; Tue, 26 Aug 2014 17:46:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.978
X-Spam-Level:
X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 48_3k9Bm6khL for <websec@ietfa.amsl.com>; Tue, 26 Aug 2014 17:46:31 -0700 (PDT)
Received: from mail-ie0-f173.google.com (mail-ie0-f173.google.com [209.85.223.173]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89BFA1A02A2 for <websec@ietf.org>; Tue, 26 Aug 2014 17:46:31 -0700 (PDT)
Received: by mail-ie0-f173.google.com with SMTP id tr6so12471361ieb.4 for <websec@ietf.org>; Tue, 26 Aug 2014 17:46:31 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=bOx1AdD5+WvhQ+rOiU5xePMAGJZLOSjJ5oFCHEU29AE=; b=VJJbrZeZjjXUf37AkI21kqQDv+VzZCkJIRFUtV+2oE8xvVrpS2R1/5BWg+mWvJgjNN ldL+7lVNyCwmDb09Pk5/U6epasoRPANhu7hbbcUH4VbKGGm/tXwo4LYZna/sxzXBkqkr szCphD4lOvcaPFJClpnqUSouycX9tRYrhvJX1WBPgkgGHODnso02CPPEkncGerZw1oJZ GdFGxogrOzDYn51ATA7BSxrAeX//ZV16EIt4XvxJe3v+0MPmLRjCydpgMmg0Yd879pkN 0az9e8qEuqQQ3iXL8eiWyL7XKq4NS+BYFVPm/55C5xw1O+XH/MPn5EpwsZLklAuE+XUz mahA==
X-Gm-Message-State: ALoCoQnqLiCInhMsg86BqdSm0UWEdQWHAeD6dR0arhMnkUPfJQZavbDVO3xizVjMQMynmmEiojom
MIME-Version: 1.0
X-Received: by 10.43.127.9 with SMTP id gy9mr4902565icc.71.1409100390871; Tue, 26 Aug 2014 17:46:30 -0700 (PDT)
Received: by 10.107.133.154 with HTTP; Tue, 26 Aug 2014 17:46:30 -0700 (PDT)
X-Originating-IP: [50.1.57.236]
In-Reply-To: <CAOe4Uim9ZC7MdY1tXhLWFwNxzxorh00bJ3PBsco_H-KxpYh-Dg@mail.gmail.com>
References: <BAY169-DS62B5941BF0A9024964BB0AEEE0@phx.gbl> <CACvaWvYHAmpX0f9_m-sckhWz9tcyWA-sxVR4vP-A5UcAQmnYXA@mail.gmail.com> <BAY169-DS45F1C5036AB09CA44D0BC7AEDF0@phx.gbl> <CA+cU71k-pLD315dzfd_c74QM51c7V2VQkZ26PiXUTqntmESD=A@mail.gmail.com> <CAOuvq20mZkScvPDKjsa1eZ6rdoHxf_+oF=gpaOcvkOTaYhyj6Q@mail.gmail.com> <CA+cU71mW47OvqRNTbw-H7u-F_k6hMv4xr0XcMYAS_V6eE8brwA@mail.gmail.com> <CAOuvq20C+T9Ejf_KUsfPRtUWL7ggCF0UWJZkGr5xGBEkERXeRQ@mail.gmail.com> <BAY169-DS45D73636AA204DEEABC876AEDC0@phx.gbl> <CAOuvq20kCKk=jcXsy_d8C-4Fn-f0zshP6YUPn5N8hsKt7KO7dw@mail.gmail.com> <CAGZ8ZG3KUPAbePp-_GCztj4RSLd8MuNo1iDz=ua+BEjQVzJc7Q@mail.gmail.com> <CA+cU71=A6vFXZrG8mcqj4uC-z2VdJfFOutqcq9MPTYs+uhpa9Q@mail.gmail.com> <CAOuvq22QgGVpsxrsZswqspiP-rgNE6B3vp_6bYDTE5-MrLZdVg@mail.gmail.com> <CA+cU71nN-=TjWZZovMUcTrXMF1gBcYFppnfnsaP7hKw+6AUCLQ@mail.gmail.com> <CAOe4Uim9ZC7MdY1tXhLWFwNxzxorh00bJ3PBsco_H-KxpYh-Dg@mail.gmail.com>
Date: Tue, 26 Aug 2014 17:46:30 -0700
Message-ID: <CAGZ8ZG3xoA1w1oEx9F8MuH1PARe5ALU9A1CEXqDXM-JSh_niGg@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: Joseph Bonneau <jbonneau@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/astwKciiwalRtSPMRxL6yn_SdXo
Cc: "draft-ietf-websec-key-pinning@tools.ietf.org" <draft-ietf-websec-key-pinning@tools.ietf.org>, Eric Lawrence <ericlaw1979@hotmail.com>, Ryan Sleevi <sleevi@google.com>, IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] draft-ietf-websec-key-pinning
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec/>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Aug 2014 00:46:33 -0000

On Tue, Aug 26, 2014 at 5:15 PM, Joseph Bonneau <jbonneau@gmail.com> wrote:
>>
>> I'd like PKP-RO to be cached like PKP and applied the same way, absent
>> the connection termination (preference). After I realized the
>> includeSubdomains issue (concern), I want it even more for testing a
>> deployment than I want it for my prior attack detection arguments
>> (preference).
>
>
> My email wasn't very clear but I would also prefer this policy

I'd prefer this as well.  To be even clearer, I think the browser
should treat PKP and PKP-RO headers independently.  I.e., the browser
should maintain separate stores for PKP and PKP-RO data.  PKP headers
only affect the PKP store, and PKP-RO headers only affect the PKP-RO
store.

(For example, PKP max-age=0 doesn't clear PKP-RO, and vice versa).

A browser implementing this probably already has separate stores for
HSTS and HPKP, so this is just adding a third for HPKP-RO, which seems
reasonable to implement.

Trevor

v2.23.0 | Report a Bug | By Email