Subject: [websec] Issue 56 - specify includeSubDomains for key pinning

From: "Ryan Sleevi" <[email-masked]>
Date: Mon, 4 Mar 2013 16:58:14 -0800

With Key Pinning being split out from HTTP Strict Transport Security, one
aspect that was lost was the includeSubDomains directive. This was raised
as Issue 56 - http://trac.tools.ietf.org/wg/websec/trac/ticket/56 -
against draft-03

draft-04 introduces the same directive, and with the same semantics, in
Section 2.1.2 -
http://tools.ietf.org/html/draft-ietf-websec-key-pinning-04#section-2.1.2

Is the added language acceptable? Are there any concerns with the
validation/processing model that would prevent us from closing out this
issue?

---

From: Tom Ritter <[email-masked]>
Date: Tue, 5 Mar 2013 21:55:27 -0500

> validation/processing model that would prevent us from closing out this

It took me a while to get it (so maybe a clarification appendix would
be good?), but I think I do and I think it works.

Although, I suppose there's no real support for a mechanism where
exmaple.com has includeSubdomains that applies to a, b, c.example but
d.example says "max-age=0".  D will wind up being pinned regardless.
I think that's okay, just noting it.

As an aside, Section 2.3.1 says
"Note the host as a Known HSTS Host if it is not already so noted"

I think that should be "Known Pinned Host"?  I thought we were
separating Require-SSL from Require-These-Keys.

-tom