Subject: [Tools-discuss] Fwd: [websec] I-D Action: draft-ietf-websec-key-pinning-12.txt

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 01 May 2014 10:01:20 -0400

Hi IETF tools folks--

The attached announcement has two legacy http URLs in it that should be
https.

Again, i think Henrik said he'd fixed some of the URLs in the submission
workflow in a recent commit a few weeks ago, but i don't know if these
announcement messages were part of those that were fixed, or if the fix
is supposed to be live by now or not.  On the chance that the fix is
supposed to be live already, i'm reporting these as extra places that
need https-ifying.

Thanks,

	--dkg

Subject: [websec] I-D Action: draft-ietf-websec-key-pinning-12.txt
From: [email-masked]
To: [email-masked]
Cc: [email-masked]
Date: Mon, 28 Apr 2014 16:10:41 -0700
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Web Security Working Group of the IETF.

        Title           : Public Key Pinning Extension for HTTP
        Authors         : Chris Evans
                          Chris Palmer
                          Ryan Sleevi
	Filename        : draft-ietf-websec-key-pinning-12.txt
	Pages           : 25
	Date            : 2014-04-28

Abstract:
   This memo describes an extension to the HTTP protocol allowing web
   host operators to instruct user agents (UAs) to remember ("pin") the
   hosts' cryptographic identities for a given period of time.  During
   that time, UAs will require that the host present a certificate chain
   including at least one Subject Public Key Info structure whose
   fingerprint matches one of the pinned fingerprints for that host.  By
   effectively reducing the number of authorities who can authenticate
   the domain during the lifetime of the pin, pinning may reduce the
   incidence of man-in-the-middle attacks due to compromised
   Certification Authorities.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-websec-key-pinning/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-websec-key-pinning-12

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-websec-key-pinning-12

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
websec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/websec

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 01 May 2014 21:36:40 +0200

Hi Daniel,

> supposed to be live already, i'm reporting these as extra places that

The ones I fixed were in the regular template directory for the data-
tracker.  Having this specific message to go by, I realized that there
is another separate template directory for the /secr/ part of the data-
tracker, which used to be a separate codebase.  I've identified and fixed
up a number of http:// urls to be https:// just now.  They will be part
of the next release, which should happen within roughly a week.

Best regards,

	Henrik