Pinning Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:20:59Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T13:21:37Z

Migration to GitHub

Nabla.c0d3: Remove comment about random.org - seems irrelevant

2017-12-27T19:35:56Z

Remove comment about random.org - seems irrelevant

Nabla.c0d3: Update iOS and Android sections

2017-12-27T19:34:29Z

Update iOS and Android sections

Neil Smithline: revert HPKP deprecation message

2017-10-31T15:03:04Z

revert HPKP deprecation message

Neil Smithline: warn that HPKP is being removed from browsers

2017-10-31T14:36:30Z

warn that HPKP is being removed from browsers

Jmanico: /* Other Cheatsheets */

2017-09-11T06:09:47Z

‎Other Cheatsheets

Jmanico: /* Authors and Editors */

2017-09-11T06:09:40Z

‎Authors and Editors

Digihash: /* How Do You Pin? */

2017-01-19T15:09:47Z

‎How Do You Pin?

Michael Hendrickx: fixing typos

2016-07-06T22:54:53Z

fixing typos

← Older revision		Revision as of 14:20, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Pinning_Cheat_Sheet.md Pinning Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Pinning_Cheat_Sheet.html Pinning Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 2: / Line 2: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
-{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
+The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
-A verbose article is available at [[Certificate_and_Public_Key_Pinning|Certificate and Public Key Pinning]]. The article includes additional topics, such as Alternatives to Pinning, Ephemeral Keys, Pinning Gaps, Revocation, and X509 Validation.
+Please visit [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Pinning_Cheat_Sheet.md Pinning Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 63: / Line 63: @@
 == Examples of Pinning ==
-This section discusses certificate and public key pinning in Android Java, iOS, .Net, and OpenSSL. Code has been omitted for brevity, but the key points for the platform are highlighted. All programs attempt to connect to [https://www.random.org random.org] and fetch bytes (Dr. Mads Haahr participates in AOSP's pinning program, so the site should have a static key). The programs enjoy a pre-existing relationship with the site (more correctly, ''a priori'' knowledge), so they include a copy of the site's public key and pin the identity on the key.
+This section discusses certificate and public key pinning in Android Java, iOS, .Net, and OpenSSL. Code has been omitted for brevity, but the key points for the platform are highlighted.
 === Android ===

@@ Line 67: / Line 67: @@
 === Android ===
-This example is using the concept from [https://developer.android.com/training/articles/security-ssl.html#UnknownCa developer.android.com unknown CA implementation document]. Basically you can teach HttpsURLConnection to trust a specific set of CAs.
+Since Android N, the preferred way for implementing pinning is by leveraging Android's [https://developer.android.com/training/articles/security-config.html Network Security Configuration] feature, which lets apps customize their network security settings in a safe, declarative configuration file without modifying app code.
-Download: [https://github.com/riramar/pubkey-pin-android Android app pubkey-pin-android]
+To enable pinning, [https://developer.android.com/training/articles/security-config.html#CertificatePinning the `<pin-set>` configuration setting] can be used.
 === iOS ===
-An open-source SSL pinning library for iOS and OS X was released at Black Hat 2015, which provides an easy-to-use API for deploying pinning within an App: https://github.com/datatheorem/TrustKit .
+TrustKit, an open-source SSL pinning library for iOS and macOS is available at https://github.com/datatheorem/TrustKit. It provides an easy-to-use API for implementing pinning, and has been deployed in many apps.
-Download: [[Media:pubkey-pin-ios.zip|iOS sample program]].
+Otherwise, more details regarding how SSL validation can be customized on iOS (in order to implement pinning) are available in the "HTTPS Server Trust Evaluation" technical note at https://developer.apple.com/library/content/technotes/tn2232/_index.html. However, implementing pinning validation from scratch should be avoided, as implementation mistakes are extremely likely and usually lead to severe vulnerabilities.
 === .Net ===
@@ Line 92: / Line 94: @@
 Download: [[Media:pubkey-pin-openssl.zip|OpenSSL sample program]].
 == References ==

@@ Line 5: / Line 5: @@
 | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 = Introduction  =
   __TOC__{{TOC hidden}}

@@ Line 118: / Line 118: @@
 * Ricardo Iramar - ricardo.iramar@gmail.com
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}

@@ Line 110: / Line 110: @@
 * RSA Laboratories [http://www.rsa.com/rsalabs/node.asp?id=2128 PKCS#6, Extended-Certificate Syntax Standard]
-== Authors and Editors  ==
+= Authors and Editors  =
 * Jeffrey Walton - jeffrey, owasp.org

@@ Line 33: / Line 33: @@
 The idea is to re-use the exiting protocols and infrastructure, but use them in a hardened manner. For re-use, a program would keep doing the things it used to do when establishing a secure connection.
-To harden the channel, the program would would take advantage of the <tt>OnConnect</tt> callback offered by a library, framework or platform. In the callback, the program would verify the remote host's identity by validating its certificate or public key.
+To harden the channel, the program would take advantage of the <tt>OnConnect</tt> callback offered by a library, framework or platform. In the callback, the program would verify the remote host's identity by validating its certificate or public key.
 == What Should Be Pinned? ==

@@ Line 51: / Line 51: @@
 [[File:pin-pubkey.png|thumb|right|100px|Public Key]] Public key pinning is more flexible but a little trickier due to the extra steps necessary to extract the public key from a certificate. As with a certificate, the program checks the extracted public key with its embedded copy of the public key.
-There are two downsides two public key pinning. First, its harder to work with keys (versus certificates) since you must extract the key from the certificate. Extraction is a minor inconvenience in Java and .Net, buts its uncomfortable in Cocoa/CocoaTouch and OpenSSL. Second, the key is static and may violate key rotation policies.
+There are two downsides to public key pinning. First, it's harder to work with keys (versus certificates) since you must extract the key from the certificate. Extraction is a minor inconvenience in Java and .Net, buts it's uncomfortable in Cocoa/CocoaTouch and OpenSSL. Second, the key is static and may violate key rotation policies.
 === Hashing ===