# Re: Integrity of the Java Virtual Machine

Li Gong (gong@games.eng.sun.com)
Mon, 27 Apr 1998 18:00:20 -0700

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: loannet: "Guaranteed Loans By Mail. Regardless of Credit!"
- Previous message: Jan Luehe: "Re: Instantiating PrivateKey .."
- Maybe in reply to: Doug Bunting: "Integrity of the Java Virtual Machine"

    Date: Mon, 27 Apr 1998 18:00:20 -0700

    Message-Id: <199804280100.SAA02497@games.eng.sun.com>

    From: Li Gong <gong@games.eng.sun.com>

    To: Doug Bunting <dougb@intuit.com>

    Subject: Re: Integrity of the Java Virtual Machine

    In-Reply-To: Doug Bunting's mail of Mon, 27 April, 1998

There is a chicken and egg problem. For the downloaded applet to do
any verification, it has to run on a JVM, so this JVM must be trusted.
So unless there is some way to get a minimal trusted JVM to run the
applet first, there is no way for the applet to verify anything
really about the underlying platform.

Li

    --

    Doug Bunting writes:
    > Hello,
    >
    > It seems that the Java Security team is hard at work adding Java
    > features to extend the sandbox and to provide more secure communication
    > back to a web server.  But, I've seen nothing which addresses a more
    > general problem.
    >
    > How would a downloaded applet confirm it's running in a Virtual Machine
    > which has not been corrupted?  In a world containing malicious Active X
    > and virus programs, an applet should have some way to know its
    > environment is secure.  With the new Java Activator / plug in
    > initiatives, JavaSoft seems to be in a prime position to provide
    > something here.
    >
    > Examples I've thought about include using signed Jar files for the local
    > (trusted) class files, maintaining a checksum for any executable files
    > used in the installation and checks for rogue threads still running from
    > an earlier web page.
    >
    > thanx,
    > 	doug
    >

- Next message: loannet: "Guaranteed Loans By Mail. Regardless of Credit!"
- Previous message: Jan Luehe: "Re: Instantiating PrivateKey .."
- Maybe in reply to: Doug Bunting: "Integrity of the Java Virtual Machine"