Subject: Re: [websec] Certificate Pinning via HSTS

From: =JeffH <[email-masked]>
Date: Mon, 12 Sep 2011 18:42:43 -0700

[email-masked] said:
 >
 > This seems like a useful near-term approach, but also probably something that
 > might want to migrate to DANE over time.

sure, tho it's going to take a while (eg before browsers hard-fail on 
assurances sourced via Secure DNS). See..

[dane] A browser's myopic view
https://www.ietf.org/mail-archive/web/dane/current/msg02354.html

 > Is there any particular reason you're using key fingerprints instead of cert
 > fingerprints?  It seems like the latter might be slightly easier to
 > implement, since you don't have to parse the cert.

I assume it's because the certificates public keys are embedded within, in 
practice, can change without the key pairs themselves changing.

The rationale ought to of course be noted in the spec.

=JeffH

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 12 Sep 2011 21:45:24 -0400

> I assume it's because the certificates public keys are embedded within, in practice, can change without the key pairs themselves changing.
> 

Public keys can change too, of course.  And it's often the cases where keys need to change that are the most important!  

In general, it seems like these "pinning" strategies do need some sort of provision for rollover.

--Richard