On Aug 6, 2014, at 10:23 PM, Richard Barnes <[email protected]> wrote: > Section 2.5. "at least one Pin that does NOT refer to an SPKI in the > certificate chain" > > I understand the motivation for this, but this doesn't actually force the > site to have a backup pin -- they can just make up a pin value. It seems > like it would be more effective to make the recommendation in Section 4.3 > stronger.
I don’t think we can force a site to do thing securely with any protocol. TLS and the like require "32 bytes generated by a secure RNG” here and “nonce” there, yet the peer has no way of checking whether an implementation uses a 64-bit LFSR for the former and a hard-coded value for the latter. We’re hoping this requirement will steer them in the right direction, but there are no guarantees. > But if the WG thinks the requirement for a backup pin is worth the effort, it > is specified interoperably, so I'm not going to stand in the way. It does. Besides, generating a real key is as easy as generating a fake one: openssl genrsa -out private 2048 openssl rsa -in private -putout -outform DER -out public openssl dgst -sha256 -binary public | base64 > Section 4. "Security Considerations" > > Most of these seem more like "Operational Considerations" or > "How-To-Not-Brick-Your-Site Considerations". :) We felt that not bricking your site was very important. And it is security-relevant. If you don’t do these things, then a key compromise is augmented by a long-lasting DoS. If you don’t follow the advice, then this security mechanism actually makes the attacks worse. Yoav _______________________________________________ websec mailing list [email protected] https://www.ietf.org/mailman/listinfo/websec
