Contents
Why is http public key pinning no longer supported?
HTTP Public Key Pinning ( HPKP) was a security feature that used to tell a web client to associate a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates. It has been removed in modern browsers and is no longer supported.
What do you mean by public key pinning?
HTTP Public Key Pinning: You’re doing it wrong! HTTP Public Key Pinning (HPKP) is a security feature that can prevent fraudulently issued TLS certificates from being used to impersonate existing secure websites.
When do you need to Cache Public Key Pins?
To prevent sites from inadvertently locking out all of their visitors, and to force the use of backup pins, browsers should only cache a site’s pinned public keys if the Public-Key-Pins header contains two or more hashes.
How are public key pins specified in HPKP?
Each pinned public key must be specified via a separate pin-sha256 directive, and each value must be a SHA256 hash; but more than 1% of servers that try to use HPKP fail to specify these pins correctly. For example, the Department of Technology at Aichi University of Education exhibits the following header on https://www.auetech.aichi-edu.ac.jp:
Which is the standard for public key pinning?
HPKP is standardized in RFC 7469. It expands on static certificate pinning, which hardcodes public key hashes of well-known websites or services within web browsers and applications.
How to report violation of public key pins?
Instead of using a Public-Key-Pins header you can also use a Public-Key-Pins-Report-Only header. This header only sends reports to the report-uri specified in the header and does still allow browsers to connect to the webserver even if the pinning is violated.
What should I do if I find an unknown public key?
When the client visits the server again, it expects at least one certificate in the certificate chain to contain a public key whose fingerprint is already known via HPKP. If the server delivers an unknown public key, the client should present a warning to the user.