Would iOS AFNetwork SSL Pinning mode provide additional security bonus if valid certificate deployed

Question

As per my understanding, SSL Pinning is to compare the public key or certification of a server with the copies bundled in the client beforehand.

I saw in Stackoverflow that many developers use SSL Pinning by AFNetwork libraries, but most of them use it along with a self-signed certificate.

I have bought a valid certificate from a CA and passed the test to verify it worked fine. I mean, I set the following and it worked

    ...
    _sharedHttpsInstance.securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeNone];
    _sharedHttpsInstance.securityPolicy.allowInvalidCertificates = NO;
    ...

What I am wondering is that if set the Pinning mode to AFSSLPinningModePulicKey, my application would be more secure in communication with the server in addition to what the valid certificate have provided?

thanks a lot.

Noseband

Yes, pinning is more secure than not pinning. Consider: when Diginotar was breached, the attacker issued fake certificates for Google, Hotmail, Yahoo, etc. Naive clients accepted them as legitimate because Diginotar was a CA in the trusted store. If you want to see an iOS example, look at how in-app purchases were broken by the same attack. See Apple’s “in-app purchase” service for iOS bypassed by Russian hacker. Apple should be pinning in their Store Kit framework, but they a too f**king arrogant or stupid. – Disinter

Answer 1

I'm don't know the exact implementation of SSL pinning in iOS, but in principle pinning provides definitely more security than the default verification against a set of builtin certificate agencies. By default systems trust more than 100 different CA from all over the world and each of the CA has the ability to issue any certificate it wants, even if another CA has already issued the same or a similar certificate. So if any of these 100+ CAs gets compromised they can issue a certificate for your domain, which would pass the checks in your application unless you use certificate pinning. Such compromises happened in 2011 with DigiNotar (no longer existent because of that) and Comodo (was too big to fail).

Probably the most prominent user of certificate pinning is Google Chrome, where it is used for the google domains and this helped to detect the compromises of DigiNotar and Comodo.

A downside of certificate pinning might be, that the application will stop working inside networks which do SSL interception for security reasons. Google Chrome seems to deal with this situation by accepting the certificate if it is signed by a CA explicitly added by the user (i.e. no builtin) alternatively to the pinning checks.

Another question which might be interesting is if SSL pinning is secure 'ENOUTH' for 'Most' of the application, even if working along with self-signed certification?

Checking against a fixed certificate or public key (e.g. certificate pinning with or without self-signed) is more secure than only checking if the certificate is signed by any of the 100s CAs trusted by the system. And as long as the developer has full control about both sides (e.g. application and server) it also scales well. The only advantage of additionally using the usual infrastructure is the use of the certificate revocation mechanism. But because the developer has control of the application (s)he could just replace the appplication in case the certificate gets compromised. So yes, in most cases it is secure enough do do SSL pinning with a self-signed certificate and it is more secure than using the standard certificate validation without pinning.

Verditer

Another question which might be interesting is if SSL pinning is secure 'ENOUTH' for 'Most' of the application, even if working along with self-signed certification? – Noseband

@firebear: Good question. I've added and replied to it in my answer. – Verditer

Understanding by comparing @Steffen & Bruno's replies, it seems to me that using valid/invalid certificate, SSL Pinning or not, somehow is a balance of risk, cost and efficiency. I would choose SSL Pinning with self-signed certificate for normal HTTPS connection, choose valid certificate for web, and for our AAA system, I intend to combine SSL Pinning and valid certificate and to protect my private key carefully. thanks a lot – Noseband

Answer 2

It's very difficult to say categorically whether pinning is better or worse, since it shifts the risk to a different party.

Pinning will essentially protect you better against a potential breach in any of the CA you trust. If a CA is compromised and made to issue a certificate for the host you're trying to contact, pinning will protect you against that because you will compare with the specific reference you've pinned, instead of going through the CA.

The downside is that it will prevent you from using the mechanisms in place at the CA to deal with a compromised host: certificate revocation. If the host's private key is compromised, going through the PKI verification mechanism should allow you to check for revocation, and be warned that such a problem happen. In contrast, you won't be able to know that with pinning, since you're not going through the CA to check the certificate at all.

Of course, you could combine both approaches, but this could cause additional problems (you'd need a strategy to deal with conflicting outcomes in both evaluations, otherwise a compromised CA revoking a valid cert could cause a DoS).

I don't know whethet AFNetworking's pinning mechanism replaces the PKI validation or complements it.

In general, choosing between using pinning or PKI validation depends on whether you think that particular host's private key is more or less likely to be compromised than the CAs you trust.

Another downside of pinning is that you need to update the application (or let the user "re-pin") every time the server certificate (or at least the key-pair, depending on what you've pinned) is changed legitimately. It's probably not a bad idea to re-key once in a while.

(To be clear, I'm not saying that CAs are better, just that pinning changes the set of problems.)

Coly

see my understanding and choice in the comment to @Steffen. Thanks – Noseband