1007986 - Remove 1024 bit roots from mozilla pin list

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Camilo Viecco (:cviecco)]

Currently the mozilla pin list contains 7 pins that are 1024 bit. We should remove these from our pinning set.

Comment 1

[Camilo Viecco (:cviecco)]

Attachment: remove-1024-roots-from-pinset

Comment 2

[Camilo Viecco (:cviecco)]

I talked with keeler, he agreed that you can r+ this one (once you think is ok)

Comment 3

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8419794 [details] [diff] [review]
remove-1024-roots-from-pinset

Review of attachment 8419794 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/manager/tools/PreloadedHPKPins.json
@@ +33,5 @@
>        // In that same bug we also notice that our cdn sites use Verisign and
>        // Baltimore
>        "name": "mozilla",
>        "static_spki_hashes": [
> +        // 1024 bit "GTE CyberTrust Global Root",

Can you just remove these? I don't think they add much being in the comments. You can instead just add a single comment that says this list omits 1024-bit certificates.

Comment 4

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8419794 [details] [diff] [review]
remove-1024-roots-from-pinset

Review of attachment 8419794 [details] [diff] [review]:
-----------------------------------------------------------------

Please fix before checking in.

Comment 5

[Camilo Viecco (:cviecco)]

Attachment: remove-1024-roots-from-pinset

keeping r+ from mmc

Comment 6

[Camilo Viecco (:cviecco)]

 https://tbpl.mozilla.org/?tree=Try&rev=228849d14426

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/03d54c37d264

Comment 8

[Daniel Veditz [:dveditz]]

Aren't we going to remove 1024 bit roots from our root store soon anyway?