1

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. But

  • Can we use the Subject Key Identifier for "certificate" pinning ?
  • Is it secure to rely only on the SKI ?
  • Are there other fields that we could use for pinning securely (e.g. Certificate hash) ?

Thanks

1

Can we use the Subject Key Identifier for "certificate" pinning ? Is it secure to rely only on the SKI?

The Subject Key Identifier (SKI) is a field (X509v3 extension) contained in the certificate. Even though it is typically derived from the subject and public key it does not need to be.

This means that an attacker could easily create a certificate which contains a specific SKI which would get accepted if pinning is done against the SKI. This of course makes it unusable for secure certificate pinning.

Are there other fields that we could use for pinning securely (e.g. Certificate hash) ?

The certificate hash is no field of the certificate but it is simply a hash over the certificate. Provided that a secure hash is used (i.e. SHA-256) it is usable for certificate pinning. One could of course also store the full certificate for comparison instead of only a hash of it.

Useful for pinning is also the public key or a secure hash of the public key. This makes it possible to accept multiple variants of the same certificate with different expiration times as long as the public key stays the same when reissueing the certificate. But this is usually called public key pinning, not certificate pinning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.