Digital Signature Inititiative

Good afternoon,

I am the program manager at Microsoft responsible for putting the
digital signature program in place.   I am sending this mail in response
to a recent mail string sent to these aliases appearing at the bottom. 

To summarize some important points of the program:

*  The program creates a certificate authority infrastructure which
consists of thrid party non-software affiliated companies such as
VeriSign and GTE who will act to grant certificates to allow code to be
signed.   The policies defining who can be a certificate authority and
what it means to be a trusted software publisher will be a matter of
public policy(standard).  The point being that Microsoft does NOT
control who can/cannot sign code.

*  This approach solves the problem of identity and integrity, and is
viewed by MS as complementary to the sandboxing approach used by Java
scripting, which we view to be incomplete and unsatisfactory by itself. 
We believe that Java needs to sign platform dependent Java classes in
addition to their sandboxing scheme.  

*  The W3C is creating a working group in this area to develop standards
around the policies mentioned in the first point, and the formats of the
certificate and signature formats.  Microsoft is committed to making
this a open, industry, x-platform standard...

* regarding the mac question - there already is a  version of Internet
Explorer for the Macintosh, available for download at
www.microsoft.com/ie. Microsoft is has already announced its committment
to building cross-platform internet products.

I would be happy to answer more questions you may have about this
program, inluding proving more information.

Stuart Theodore
Program Manager
Microsoft Corporation
Stuartt@microsoft.com



>I recieved a copy of "Microsoft Interactive Developer" today in the
>mail.
>In it, it has a preview of Microsoft Explorer 3.0. (Flux by David
>Boling on
>page 120.)
>
>Of interest to Cypherpunks is this paragraph (in the section on OLE
>support
>in web browsers):
>
>"Since OLE controls could potentially pose a security problem,
>Microsoft is
>studying how to create an infrastructure to certify them.  The idea is
>that,
>once certified, an OLE control would contain an RSA security signature
>indicating that it has passed muster -- the OLE eqivelent if the Good
>Housekeeping Seal of Approval! Users of Internet Explorer 3.0 could
>specify
>whether or not noncertified OLE controls should be loaded and executed
>by
>the browser."
>
>As a web developer, I have some problems with this scheme.  Giving
>Microsoft
>access to virtually every OLE control on the Web does not make me more
>secure.  Sounds like a way to rip off ideas from the rest of the
>development
>world.  If someone has a control that might compete with a Microsoft
>product, it could be shelved and/or delayed for "further security
>testing".
>
>Java has a decentralized mechanism for security.  No one group controls
>what
>is a "certified" control and what is not.  You write the code and
>compile it
>and that is that. Furthermore, you are not stuck with Microsoft
>approved
>platforms.  (I wonder if there will ever be a version of Explorer for
>the
>Mac.)
>
>I expect the Microsoft plan to garner a bit of resistance from the Web
>development community over this one...
>
>I do not expect to see many OLE crypto apps for the web with this plan.
>
>---
>Alan Olsen -- alano@teleport.com -- Contract Web Design & Instruction
>        `finger -l alano@teleport.com` for PGP 2.6.2 key
>                http://www.teleport.com/~alano/
>  "We had to destroy the Internet in order to save it." - Sen. Exon
>
>
>
>
>
>
>

On Fri, 22 Mar 1996, Stuart Theodore wrote:

<snip>

> * regarding the mac question - there already is a  version of Internet
> Explorer for the Macintosh, available for download at
> www.microsoft.com/ie. Microsoft is has already announced its committment
> to building cross-platform internet products.

If this is the case, then why did you discontinue Mac support for your 
own MAPI standard?  While the ability exists to bind cryptographic 
protocols onto your MS Mail a/o Exchange via MAPI (as we have done), you 
trashed MS Mail for the Mac.  Star Nine doesn't even have the ability to 
port MAPI onto the Mac, even though you sold them the rights to MS Mail 
server software for that platform.  You have crippled the 
interoperability of your so-called messaging standard between the Mac and 
Windows platform, thus preventing third party developers (such as myself) 
from being able to incorporate the use of different cryptographic engines 
seamlessly across your product line.

Now you say, "Microsoft is [sic] has already announced its committment      
 to building cross-platform internet products."  Excuse me, but this is 
exactly the same thing you used to say about cross-platform messaging 
products (before you woke up to the Internet).

Now, whenever I have to put together a messaging system or O/A 
environment that requires cryptographic protections, I tell my clients to 
avoid MS like the plague.  Hell, I'd rather work in VIM than deal with 
this "MS commitment" that turns out to be empty lies and marketing hype.

Forgive me if I, and any number of other people, assign no merit 
whatsoever to any so-called "commitment" from MS, particularly in regard 
to security and standards issues.

------------------------------------------------------------------------- 
|      Liberty is truly dead              |Mark Aldrich                 | 
|    when the slaves are willing          |GRCI INFOSEC Engineering     | 
|     to forge their own chains.          |maldrich@grci.com            | 
|        STOP THE CDA NOW!                |MAldrich@dockmaster.ncsc.mil | 
|_______________________________________________________________________| 
|The author is PGP Empowered.  Public key at:  finger maldrich@grci.com |
|    The opinions expressed herein are strictly those of the author     | 
|         and my employer gets no credit for them whatsoever.           | 
-------------------------------------------------------------------------