Subject: [websec] First Connection Active Attack in HPKP

From: Tom Ritter <[email-masked]>
Date: Mon, 7 Apr 2014 09:29:36 -0400

Sorry to be second guessing you Chris, but wanted to ask about this change:
https://code.google.com/p/key-pinning-draft/source/detail?r=5810662a42e56938272d9db4b2e5373914b266f4

Let's say an active attacker does MITM on a client.  (That's the scenario
you reference, right?)  The client can have pins for the server or not.

If the client does have pins, the active attack fails and generates a
report event.  The attacker knows the attack fails because a) perhaps they
observe metadata about the report event being sent right away but more
concretely b) because their attack fails.

If the client doesn't have pins, the active attack succeeds.  The attacker
knows the attack succeeded and that the pinning wasn't effective because...
it succeeded.  Whether or not a report event is generated the attacker
knows it succeeded.  Furthermore, if an attacker is attacking the client
and wants to learn if it supports pinning or not, it can look at the User
Agent header, TLS handshake fingerprinting, or active javascript injection.

If the attack succeeds, and the attack already knows about it succeeding, I
don't understand the harm in generating a report event. Maybe the attack
will block it (and know it was generated), but maybe they won't and it will
get out.  Maybe the report will be held for some time and sent later.

-tom

---

From: Chris Palmer <[email-masked]>
Date: Mon, 28 Apr 2014 16:51:46 -0700

I see your point... is the attack so marginal that it doesn't matter
either way? I'm not sure I feel strongly any more on this topic.

On Mon, Apr 7, 2014 at 6:29 AM, Tom Ritter <[email-masked]> wrote:
> If the client does have pins, the active attack fails and generates a report
> event.  The attacker knows the attack fails because a) perhaps they observe
> metadata about the report event being sent right away but more concretely b)
> because their attack fails.
>
> it succeeded.  Whether or not a report event is generated the attacker knows
> it succeeded.  Furthermore, if an attacker is attacking the client and wants
> to learn if it supports pinning or not, it can look at the User Agent
> header, TLS handshake fingerprinting, or active javascript injection.
>

---

From: Tom Ritter <[email-masked]>
Date: Tue, 29 Apr 2014 07:28:45 -0400

> either way? I'm not sure I feel strongly any more on this topic.

I would call the difference marginal only if the we never envision the
report having anything done with it except immediate sending.  If it's
stored for later, logged, a browser extension collects them all and
sends them out through Tor or some other mechanism... then I would say
it's not marginal.  And since those are possibilities, I would say it
would be better to remove the paragraph and not have different
behavior. It would also probably make the code simpler, too.

-tom