Subject: [saag] Pining and PKI

From: Daniel Migault <[email-masked]>
Date: Thu, 30 Jul 2020 15:27:11 -0400

Regarding the pinning discussion at saag [1], it seemed to me that pinning
was mostly seen to come with manual configuration, limited to CA or end
entity key.  In addition, pinning was also seen as not compatible with PKI.

One reason for pinning is to restrict the possibilities for terminating
your session to a place you do not believe it is.
If you assume that your first connection is terminating to the right place,
pinning can be viewed as providing means to be connected to the same place
as my first session.

Trusting the initial session based on PKI enables to automate the
configuration of the pin. Pining session rather than any configuration
parameter prevents to interfere with these parameters - such as CA change
or server key updates.
Using pining as a second factor authentication also avoids any interference
with PKI authentication.

These are some of the motivations that initiated the design of RFC8672 [2].

Yours,
Daniel

[1]
https://www.ietf.org/proceedings/108/slides/slides-108-saag-chair-slides-pkipinning-bcp-72-00
[2] https://tools.ietf.org/html/rfc8672

-- 
Daniel Migault
Ericsson