Subject: Re: [websec] the (old) LockFoo ideas: LockCA, LockEV (was: handling STS header field extendability)

From: =JeffH <[email-masked]>
Date: Fri, 10 Aug 2012 19:52:50 -0700

> On Thu, Aug 9, 2012 at 3:09 PM, =JeffH <[email-masked]> wrote:
 >
 >> The only extensions we'd discussed in the past were the CertPinning,
 >> LockCA, LockEV. We've decided that cert pinning is an intersecting but
 >> orthogonal policy to HSTS, and thus best handled at this point via a
 >> separate header field. Also, the various LockFoo notions should be
 >> addressed in a cert pinning policy context (i mentioned this in the WG
 >> session at IETF-82 Taipei).
 >
 > Please forgive my ignorance,

no worries, these were nascent ideas we discussed in the past in the context of 
HSTS, mostly just at past websec wg sessions.

 > but do LockCA and/or LockEV offer any
 > functionality that you can't already get with public key pinning as
 > currently specified?

probably not (they were mostly off-the-cuff ideas)

 > You can pin to a given CA's public key(s),

Yes, which provides essentially what we were imagining as LockCA functionality

 >  and you can pin to any given EV issuers' public keys.

yep.

I didn't mean to imply that these LockFoo notions would necessarily pose new use 
cases for draft-ietf-websec-key-pinning -- the latter I-D probably already 
addresses them.

HTH,

=JeffH