Dr. Dobb's Journal - October 2008 - (Page 30)

D10gold_p6as 8/15/08 9:07 AM Page 30 Core Technology by Oliver Goldman Code Signing in Adobe AIR Securely enabling the creation of desktop applications with web technologies Adobe AIR, Adobe’s platform for building desktop applications from web technologies, Oliver is a senior computer scientist at Adobe Systems. He can be reached at goldman@ ieee.org. requires that all AIR-based applications be signed to secure delivery. By signing an application, the application’s publisher securely associates their identity with the application. For example, eBay signs its AIR-based eBay Desktop application before making it available for download. When users install the application, AIR uses the signature to confirm eBay’s identity as the publisher and to confirm that the application has not been tampered with in transit. This confirmed identity is displayed to the user as part of the installation process. Using signatures only to detect tampering, without also establishing a trusted identity, is not an interesting guarantee. If you don’t know who signed an application, you can’t be sure the application hasn’t been tampered with, even if the signature is valid. The attacker might have simply resigned the application after tampering with it. But while Adobe AIR application signatures can tell you who published an application, they don’t tell you whether you should trust that publisher. Signatures also do not in any way make the application safer to run. A signed application published by “Evil Intruder, LLC” is just as likely to be malicious as an unsigned application from the same publisher and is just as capable of doing harm to your computer. to them. If you trust the certification authority, you implicitly trust their validation process. Implementation of Trusted Identity Although it might be surprising at first glance, a certificate claims to establish an identity by simply including the name of that entity in the certificate. That’s right: Anyone with access to a computer and a modicum of know-how can produce a perfectly valid certificate that claims it belongs to you. Establishing trust in an identity is about determining whether to believe what a certificate says. Trust in a certificate is established by linking the certificate in the AIR file to a list of trusted certificates maintained by the operating system. On a typical computer, this certificate store comes populated with the certificates of various certification authorities that the operating-system publisher has decided should be trusted. For example, this certificate store typically includes a certificate for Verisign that lets your computer—without additional setup—establish a trusted identity for many of the secure websites that you visit. You can modify this list of certificates, although most users don’t. Adobe AIR considers a certificate to be trusted if either the same certificate is stored in the system certificate store as a trusted certificate, or if it is possible to establish a certificate chain from the signing certificate to some trusted certificate in the system store. In a certificate chain, each certificate is signed by another certificate, which is in turned signed by another certificate, until you reach a trusted root certificate. Typical chains contain only three certificates: the publisher’s certificate, one intermediate, and the root. So long as the root is trusted by the system, the intermediate and the publisher are also trusted. Trusted Identity A signature is said to be “trusted” when that signature accurately declares the identity of the publisher. This is not the same as trusting the application. There are two ways in which trust in a signature may be established. • First, I might trust a signature because the publisher has, in some secure way, given me a copy of his certificate. This is best done in person, where identity can be established, and by physically exchanging the certificate—perhaps on a USB drive. This mechanism doesn’t scale well, as it requires establishing trust for each publisher on an individual basis. • The alternative is to trust an intermediary who can vouch for the identity of the publisher. There is more than one way to go about this, but the most common is to trust a certification authority to vouch for others. A certification authority validates publisher’s identities and issues certificates 30 Dr. Dobb’s Journal l www.ddj.com l October 2008 http://www.ddj.com

Table of Contents Feed for the Digital Edition of Dr. Dobb's Journal - October 2008

Dr. Dobb's Journal - October 2008 Contents Friday Night Fish Fry Alia Vox Developer Diaries Developer’s Notebook Is Your Next Language COBOL? Conversations Safe Coding Practices Code Signing in Adobe AIR OpenID Single Sign-On The Book Cipher Algorithm Indexing and Searching Image files Extending Continuous Integration Into ALM The Agile Edge Effective Concurrency Swaine’s Flames

Dr. Dobb's Journal - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.