Unverified50% confidenceFactExact time
Rejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/20/2026
First Seen
Valid until: 1/18/2027
Sources
Related Entities
Related Claims
UnverifiedTrust policies typically use a hash of the SPKI (such as SHA-256) as a fixed identifier for the public key, a technique known as "public key pinning".72% similarUnverifiedCertificate pinning can defend against man-in-the-middle attacks: even if an attacker holds a valid certificate issued by a trusted CA, the connection is still rejected as long as the public key hash does not match the pinned value.70% similarUnverifiedWhen validating a certificate chain, Go's crypto/x509 package computes the SPKI hash of each certificate in the chain and compares it against a built-in blacklist, terminating validation upon a match.67% similarUnverifiedA rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.66% similarUnverifiedSPKI is a standard field in X.509 certificates that follows the ASN.1 SubjectPublicKeyInfo structure and contains the public key algorithm identifier and the public key itself.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1073191API
curl https://kongchang.com/api/v1/knowledge/claims/1073191MCP
get_claim(id=1073191)