Subject: [websec] Issue #58: Should we pin only SPKI, or also names

From: Yoav Nir <[email-masked]>
Date: Mon, 29 Jul 2013 15:20:37 +0000

Hi all

This issue ( http://trac.tools.ietf.org/wg/websec/trac/ticket/58 - see text below my sig ) has been raised at WGLC. Current text does not allow the new format.

This was discussed in the meeting. Two people liked the idea because it's easier for administrators to manage, others didn't like it because it's unwieldy, and because the list of "corporation_name" roots changes constantly through the issuing of new CAs and through mergers and acquisitions.

Absent a working group consensus, we will not ask the editors to modify the draft. If you feel strongly one way or the other, please reply to this thread, and tell what we should do. At this stage, general silence will be interpreted as assent, so if you want those names in, please speak up within the next two weeks.

Tobias and Yoav
====================
Issue #58 text:

It has been suggested that instead or in addition to pinning to a has of the SPKI, we should also be able to pin to a certificate vendor. So in addition to the current pins, like 

   Public-Key-Pins: max-age=2592000;
       pin-sha1="4n972HfV354KP560yw4uqe/baXc=";
       pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

We will also be able to specify something like this:

   Public-Key-Pins: max-age=2592000;
       pin-name="comodo"