liveBook · Manning

Public key pinning

As explained in Real-World Cryptography

Public key pinning is a client-side validation technique that accepts a server only when its certificate contains a specifically expected public key.

A trusted certificate authority can still become a weak link: if it signs a certificate for your domain with an attacker-controlled key, a man-in-the-middle attack may impersonate your server. Public key pinning gives a client a fixed expectation instead of trusting any otherwise valid certificate. section 9.3

The client-side check works in a short sequence:

  • Hardcode a specific server certificate, usually its hash, or the server’s expected long-term public key. section 9.3
  • Connect through TLS and inspect the certificate presented during the handshake’s authentication phase. section 9.3 section 9.6
  • Continue only when the certificate or contained public key matches the pinned value; otherwise abort the connection. section 9.3

Pinning is especially practical for mobile applications, which know their expected server in advance. It is harder for browsers serving arbitrary sites, and it can make certificate or key changes difficult. Certificate revocation and certificate monitoring provide other defenses against compromised certificates or certificate authorities. section 9.3 section 9.6

How Real-World Cryptography covers it

How deep it goes
Explains hardcoded certificate or key checks and handshake aborts, without descending into implementation details.
Examples
Uses mobile applications as the practical setting and contrasts them with browsers serving many different sites.
What it assumes
Builds on TLS handshakes, server certificates, public keys, and certificate authorities.
What you can do after
Apply public key pinning when controlling the client and knowing the server’s expected certificate or public key.
How it connects
Connects TLS with certificates, public key infrastructure, certificate revocation, and certificate monitoring.
Cover of Real-World Cryptography
liveBookmanning.com
Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.