[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #9167 [Flashproxy]: Find a more stable key pinning scheme for www.google.com
#9167: Find a more stable key pinning scheme for www.google.com
------------------------+---------------------------------------------------
Reporter: dcf | Owner: dcf
Type: defect | Status: new
Priority: normal | Milestone:
Component: Flashproxy | Version:
Keywords: | Parent:
Points: | Actualpoints:
------------------------+---------------------------------------------------
Comment(by dcf):
It looks like we are hashing the right thing (`pubkey_der`). What it looks
like we're doing wrong is we need to also check intermediate certificates'
keys.
Do
{{{
openssl s_client -connect www.google.com:443 -showcerts
}}}
Running the leaf certificate through [https://tools.ietf.org/html/draft-
ietf-websec-key-pinning-06#appendix-A these OpenSSL commands] gives
{{{
1e3f66cfa0eb03136297fdb238ad6619c30ff375 p1.key
}}}
which is what we have pinned in flashproxy-reg-appspot. But doing the same
with the intermediate certificate gives
{{{
40c5401d6f8cbaf08b00edefb1ee87d005b3b9cd p2.key
}}}
which is the same as a Chromium digest:
{{{
static const char kSPKIHash_Google1024[] =
"\x40\xc5\x40\x1d\x6f\x8c\xba\xf0\x8b\x00"
"\xed\xef\xb1\xee\x87\xd0\x05\xb3\xb9\xcd";
}}}
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9167#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs