HTTP Public Key Pinning (HPKP) is an obsolete

Internet security Internet security is a branch of computer security. It encompasses the Internet, browser security, web site security, and network security as it applies to other applications or operating systems as a whole. Its objective is to establish rules ...

mechanism delivered via an

HTTP The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide We ...

header which allows

HTTPS Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It is used for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is enc ...

websites to resist

impersonation An impersonator is someone who imitates or copies the behavior or actions of another. There are many reasons for impersonating someone: *Entertainment: An entertainer impersonates a celebrity, generally for entertainment, and makes fun of ...

by attackers using misissued or otherwise fraudulent

digital certificates Digital usually refers to something using discrete digits, often binary digits. Technology and computing Hardware *Digital electronics, electronic circuits which operate using digital signals **Digital camera, which captures and stores digital i ...

. A server uses it to deliver to the

client Client(s) or The Client may refer to: * Client (business) * Client (computing), hardware or software that accesses a remote service on another computer * Customer or client, a recipient of goods or services in return for monetary or other valuabl ...

(e.g.

web browser A web browser is application software for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's screen. Browsers are used o ...

) a set of hashes of

public key Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic al ...

s that must appear in the certificate chain of future connections to the same

domain name A domain name is a string that identifies a realm of administrative autonomy, authority or control within the Internet. Domain names are often used to identify services provided through the Internet, such as websites, email services and more. As ...

. For example, attackers might compromise a

certificate authority In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. Thi ...

, and then mis-issue certificates for a web origin. To combat this risk, the HTTPS web server serves a list of “pinned” public key hashes valid for a given time; on subsequent connections, during that validity time, clients expect the server to use one or more of those public keys in its certificate chain. If it does not, an error message is shown, which cannot be (easily) bypassed by the user. The technique does not pin certificates, but

hashes. This means that one can use the

key pair Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic alg ...

to get a certificate from any certificate authority, when one has access to the private key. Also the user can pin public keys of

root In vascular plants, the roots are the organs of a plant that are modified to provide anchorage for the plant and take in water and nutrients into the plant body, which allows plants to grow taller and faster. They are most often below the su ...

or intermediate certificates (created by certificate authorities), restricting site to certificates issued by the said certificate authority. Due to HPKP mechanism complexity and possibility of accidental misuse, browsers deprecated and removed HPKP support in favor of

Certificate Transparency Certificate Transparency (CT) is an Internet security standard for monitoring and auditing the issuance of digital certificates. The standard creates a system of public logs that seek to eventually record all certificates issued by publicly trus ...

and its Expect-CT header. Certificate Authority Authorization can also be used to restrict which certificate authorities can issue certificates for a particular domain, thus reducing chance of certificate issue errors.

Mechanism

The server communicates the HPKP policy to the user agent via an

response header field named Public-Key-Pins (or Public-Key-Pins-Report-Only for reporting-only purposes). The HPKP policy specifies hashes of the subject public key info of one of the certificates in the website's authentic X.509 public key certificate chain (and at least one backup key) in pin-sha256 directives, and a period of time during which the user agent shall enforce public key pinning in max-age directive, optional includeSubDomains directive to include all subdomains (of the domain that sent the header) in pinning policy and optional report-uri directive with URL where to send pinning violation reports. At least one of the public keys of the certificates in the certificate chain needs to match a pinned public key in order for the chain to be considered valid by the user agent. At the time of publishing, only allowed the

SHA-256 SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compressi ...

hash algorithm.
Appendix A. of RFC 7469
mentions some tools and required arguments that can be used to produce hashes for HPKP policies.) A website operator can choose to either pin the

root certificate In cryptography and computer security, a root certificate is a public key certificate that identifies a root certificate authority (CA). Root certificates are self-signed (and it is possible for a certificate to have multiple trust paths, say if ...

public key of a particular root certificate authority, allowing only that certificate authority (and all intermediate authorities signed by its key) to issue valid certificates for the website's domain, and/or to pin the key(s) of one or more intermediate issuing certificates, or to pin the end-entity public key. At least one backup key must be pinned, in case the current pinned key needs to be replaced. The HPKP is not valid without this backup key (a backup key is defined as a public key not present in the current certificate chain). HPKP is standardized in RFC 7469. It expands on static

certificate pinning HTTP Public Key Pinning (HPKP) is an obsolete Internet security mechanism delivered via an HTTP header which allows HTTPS websites to resist impersonation by attackers using misissued or otherwise fraudulent digital certificates. A server uses it ...

, which hardcodes public key hashes of well-known websites or services within web browsers and applications. Most browsers disable pinning for certificate chains with private

s to enable various corporate content inspection scanners and web debugging tools (such as mitmproxy or

Fiddler A fiddle is a bowed string musical instrument, most often a violin. It is a colloquial term for the violin, used by players in all genres, including classical music. Although in many cases violins and fiddles are essentially synonymous, the ...

). The RFC 7469 standard recommends disabling pinning violation reports for "user-defined" root certificates, where it is "acceptable" for the browser to disable pin validation.

Reporting

If the user agent performs pin validation and fails to find a valid SPKI fingerprint in the served certificate chain, it will POST a JSON formatted violation report to the host specified in the report-uri directive containing details of the violation. This URI may be served via

; however, the user agent cannot send HPKP violation reports to an HTTPS URI in the same domain as the domain for which it is reporting the violation. Hosts may either use HTTP for the report-uri, use an alternative domain, or use a reporting service. Some browsers also support the Public-Key-Pins-Report-Only, which only triggers this reporting while not showing an error to the user.

Criticism and decline

During its peak adaptation, HPKP was reported to be used by 3,500 of top 1 million internet sites, a figure that declined to 650 around the end of 2019. Criticism and concern revolved around malicious or human error scenarios known as HPKP Suicide and RansomPKP. In such scenarios, a website owner would have their ability to publish new contents to their domain severely hampered by either losing access to their own keys or having new keys announced by a malicious attacker.

Browser support and deprecation

References

{{SSL/TLS Hypertext Transfer Protocol headers Web security exploits Transport Layer Security

Mechanism

Reporting

Criticism and decline

Browser support and deprecation

See also

References