The DMZ

« first day (2086 days earlier) ← previous day next day → last day (3092 days later) »

Tinned_Tuna

13:39

Very quick question: If I enable HSTS, then lose access to the private key, what happens to clients? Do I just need to provision a new key on the same domain, or do clients pin the key?

Aria

14:14

@Tinned_Tuna My guess is provision the new key

Almost always this is the case when the key is lost

As normally there's no way to recover it, and no 3rd party stores it

Tinned_Tuna

@Aria That's fine, but HSTS doesn't imply any form of key pinning, right?

That is, clients aren't going to freak out seeing a different key.

Aria

OK so if you do not have private key then you can't run the any encyption at all so you always need some sort of private key

and then when you re-issue the cert which is similar (e.g. same authority, same signing etc), then it should work no issues

And for HSTS you will need also a backup key as well so they are both pinned

This is the case when the hash of your cert is hardcoded into the browser for example

I think HSTS would protect against MITM where real certificate is issued

I mean the key pinning would protect

the backup is for the reason of being able to quickly recover the service if the key is lost or unusable

developer.mozilla.org/en-US/docs/Web/Security/…

Note: The current specification requires including a second pin for a backup key which isn't yet used in production. This allows for changing the server's public key without breaking accessibility for clients that have already noted the pins. This is important for example when the former key gets compromised.

So the solution is to use two keys... and if both are lost, then the website is not working ;-)

Tinned_Tuna

14:44

Isn't that HPKP, not HSTS?

Aria

HSTS says that no HTTP is permitted

Tinned_Tuna

This is partly why I'm a little confused, my reading of the specs indicates that HSTS and HPKP are separate. HSTS just makes sure that the connection is over TLS, where as HPKP makes sure that an expected public key is seen. However, a few places seem to use HSTS and pinning as if you can't get one without the other.

Aria

HPKP prevents MITM attacks

Tinned_Tuna

So, one could reasonably deploy HSTS without HPKP and not require a back up/offline key in case of loss or compromise?

Aria

@Tinned_Tuna HPKP would not be 100% safe if client could be presented with plain HTTP

For example consider following attack:

Server -> Hacker with Fake Cert but valid -> Browser - HPKP will prevent this because Fake Cert is not matching pinned one

That would be rather this

Server -> TLS -> Hacker with Face Cert but valid -> TLS -> Browser - so HPKP prevents MITM

But also this would be possible without HSTS

Server -> TLS -> Hacker -> Browser - stripping out the TLS