Legal Disclaimer

"...For Dummies" is a registered trademark of Wiley Publishing, Inc. Wiley has not given authorization for this title, nor is it associated in any way with the Wiley (nee IDG Books, nee Hungry Minds) series "... for Dummies."

June 21, 2007

Web2.0 and the Digital Signature

I've been doing some network security/PKI related stuff at work lately, and something is bothering me. It's how PKI user-space tools are done, and how web applications are pretty much messing up our trust metrics.

We've spent a lot of time and money developing these desktop tools for PKI use -- Mail clients with the ability to use certificates, browsers with the ability to use certificates, cryptoprograms with the ability to use certificates. Troubling now is the advent of the webapp.

Typically web applications "trust" the web browser and more particularly the web server. For client certification, a browser sends out a certificate request, gets a response, does whatever verification and lookup that it has to (OCSP/CRL), and then passes the token off to the web application. The web application has no way of re-verifying the certificate, or even verifying it in the first place (it has to rely on the certificate string that the web server passes to it).

Companies like Gradkell make signing applications. Applications could also be done in Java, but really who wants to run these kinds of things inside their browser? Java still feels too heavy. I feel like Javascript itself needs some way to interface with key management systems, though. Hm...

Post a comment










Please enter the number above into the box below.









Further back...

Archives