News for hackers. Stuff that matters.

A comment on What You Need to Know about HTTP Public Key Pinning (HPKP).

Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by snowwrestler on Sunday February 07, 2016 @09:50AM (#11052996)
This article suggests pinning ones own cert, and perhaps an intermediate up the chain. It seems that even pinning one root cert would be an improvement, because then that specific CA would have to compromised to MITM. As opposed to the situation now, in which compromising any trusted CA can permit MITM.

Do I have that right?

[ Parent | on HN ]
Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by sjtgraham on Sunday February 07, 2016 @10:01AM (#11053029)
If you pin to a root CA you're vulnerable to MITM if an intermediate CA that has the root in its chain of trust is compromised. Because that compromised CA would be able to sign a cert for an arbitrary domain while still satisfying your pinning directives.

By pinning to a public key you're saying "is this public key in this certificate's chain of trust?". Pinning to a root you have the most flexibility but the least amount of protection against MITM.

[ Parent | on HN ]
Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by AndyMcConachie on Sunday February 07, 2016 @10:24AM (#11053119)
From RFC7469:

"user agents (UAs) will require that the host presents a certificate chain including at least one Subject Public Key Info structure whose fingerprint matches one of the pinned fingerprints for that host."

This makes it easier to deploy. If an org repeatedly gets their certs from a single CA they can just pin that CA. It does of course open you up to being compromised if anyone compromises that CA. But, like you said it's a big improvement over nothing.

[ Parent | on HN ]
Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by rakoo on Sunday February 07, 2016 @03:51PM (#11054769)
Yes, key pinning allows a domain owner to choose who certifies them, instead of potentially accepting anyone to certify them. It's a kind of "reverse" certification.
[ Parent | on HN ]