HTTP Public Key Pinning (HPKP)

HTTP Public Key Pinning (HPKP) is a security mechanism that allows website operators to specify which SSL/TLS certificates are valid for their domain. It is a command available in the HTTP response header that instructs the browser to remember which public key(s) correspond to a given web server. This creates a form of trust between the browser and the server, ensuring that the browser only accepts valid SSL/TLS certificates from the same web server for a specified period of time.

Purpose of HPKP

HPKP was created to protect against certificate forgery attacks, which occur when a hacker creates a fake SSL/TLS certificate and presents it to the user’s browser as if it were real. This is a serious security threat because it allows the attacker to intercept and modify data that is supposed to be encrypted and secure, such as login credentials or credit card information.

By implementing HPKP, website operators can ensure that users only connect to their website using SSL/TLS certificates that they have explicitly authorized. This prevents attackers from using fake certificates to impersonate the website and trick users into divulging sensitive information.

How HPKP Works

HPKP works by specifying a list of public key fingerprints in the HTTP response header of a website. These fingerprints are a unique identifier for the SSL/TLS certificate used by the web server. The browser stores these fingerprints in its cache and uses them to verify the authenticity of subsequent SSL/TLS certificates presented by the same web server.

When a user visits a website that has implemented HPKP, their browser will check the list of public key fingerprints in the HTTP response header. If the SSL/TLS certificate presented by the web server matches one of the fingerprints in the list, then the browser will trust the certificate and establish a secure connection to the website.

If the SSL/TLS certificate presented by the web server does not match any of the fingerprints in the list, then the browser will display an error message and prevent the user from accessing the website. This ensures that users are only able to connect to the website using SSL/TLS certificates that have been explicitly authorized by the website operator.

HPKP Configuration

Configuring HPKP requires careful consideration and planning because it can potentially cause serious issues if done incorrectly. Website operators must ensure that they have the correct SSL/TLS certificates and that they have accurately calculated the public key fingerprints.

The HPKP header is a strict-transport-security (STS) header, which means that once it is set, the browser will always enforce the policy, even if the website operator attempts to remove or change the header. This means that website operators must ensure that they have a backup plan in case they need to revoke or update their SSL/TLS certificates.

The HPKP header also requires a backup public key, which is used in case the primary SSL/TLS certificate is revoked or expires. The backup public key should be stored separately from the primary SSL/TLS certificate to ensure that it is available in case of an emergency.

HPKP Issues and Considerations

While HPKP can provide additional security to a website, it is not without its drawbacks and considerations. Here are some things to keep in mind when implementing HPKP:

1. Potential for Outages

If a website operator’s SSL/TLS certificate expires or needs to be replaced, and they have not configured their backup public key correctly, then users will be unable to access the website until the issue is resolved.

2. Complexity

Configuring HPKP can be a complex process, requiring careful planning and consideration. Website operators must ensure that they have the correct SSL/TLS certificates and that they have accurately calculated the public key fingerprints.

3. Browser Compatibility

Not all browsers support HPKP, and some may not handle it correctly. This means that website operators must test their HPKP configuration thoroughly to ensure that it works as expected in all major browsers.

4. Risk of Lock-Out

If a website operator misconfigures their HPKP header, they risk locking users out of their website until the issue is resolved. This can result in lost revenue and a damaged reputation.