SPKIPinning

SPKI pinning, short for Subject Public Key Info pinning, is a form of certificate pinning used in Transport Layer Security to bind a domain to a specific public key. In SPKI pinning, a cryptographic hash of the SubjectPublicKeyInfo from a server certificate is stored as the pin for that domain. Clients that implement SPKI pinning keep one or more pins for a host and, during a TLS handshake, verify that the server’s certificate SPKI matches one of the pins. If there is no match, the connection is rejected or a warning is issued.

Pins are typically based on a SHA-256 hash of the SPKI, and multiple pins may be configured to support key rotation. A pin often covers the current key and one or more anticipated next keys (backup pins) so that a certificate rollover does not immediately break client connections.

The main purpose of SPKI pinning is to protect against misuse or mis-issuance of certificates by compromised certificate authorities, by ensuring that only certificates with the expected public key are trusted for a given domain. It can be more robust across certificate renewals than pinning to a specific certificate, since the public key may remain the same across renewals.

Implementation and considerations: SPKI pinning requires careful key management. If a domain changes its public key and pins are not updated, legitimate connections may be blocked. Conversely, if the private key corresponding to a pinned SPKI is compromised, the pinning provides limited protection. SPKI pinning is commonly employed in mobile and desktop applications via libraries or platform security configurations; it is one approach within the broader certificate-pinning landscape, alongside or in contrast with HTTP Public Key Pinning (HPKP), which has seen limited use due to deployment risks.