comparison with other stored security state mechanisms [was: Re: Sharing Trust Policy between Crypto Libraries]

[Daniel Kahn Gillmor]

On 12/20/2012 12:38 PM, Stef Walter wrote:
> http://p11-glue.freedesktop.org/doc/sharing-trust-policy/

In addition to the list of alternate extension mechanisms reviewed in
this document, It might be useful to compare chromium's internal
blacklist/security state mechanism:

 https://src.chromium.org/viewvc/chrome/trunk/src/net/base/transport_security_state_static.json

This is related to (among other things) the "key pinning" concept
currently advanced in the websec working group:

 https://tools.ietf.org/html/draft-ietf-websec-key-pinning

(see also my recent e-mail on this list 'Different meanings of "Pinning"?').

Similarly to websec-key-pinning, HSTS and TACK are examples of per-peer
secure communications policy that would ideally be shared across
applications:

 HSTS:
   https://tools.ietf.org/html/rfc6797

 TACK:
   http://tack.io
   https://tools.ietf.org/html/draft-perrin-tls-tack

I don't think the current draft can support any of these mechanisms, and
perhaps they're out of scope; but maybe there are parts of them that
shouldn't be out of scope?

	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1027 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freedesktop.org/archives/p11-glue/attachments/20130103/4edc1f64/attachment.pgp>