1996-04-26 - Re: Capability Security in Java

Header Data

From: tcmay@got.net (Timothy C. May)
To: cypherpunks@toad.com
Message Hash: ba3c4fa174040580aa5aea155c3e8b3fa6749403a704b7586e0d21afcfd7db19
Message ID: <ada5a45428021004a064@[205.199.118.202]>
Reply To: N/A
UTC Datetime: 1996-04-26 10:48:46 UTC
Raw Date: Fri, 26 Apr 1996 18:48:46 +0800

Raw message

From: tcmay@got.net (Timothy C. May)
Date: Fri, 26 Apr 1996 18:48:46 +0800
To: cypherpunks@toad.com
Subject: Re: Capability Security in Java
Message-ID: <ada5a45428021004a064@[205.199.118.202]>
MIME-Version: 1.0
Content-Type: text/plain


At 12:58 AM 4/26/96, Bill Frantz wrote:
>At  4:38 PM 4/25/96 -0700, Simon Spero wrote:
>>One thing that could be retroactively added to the vm pretty easily would
>>be the ability to add capability requirements to methods, and have the
>>class loader automatically generate code to check for those requirements
>>before executing the body of the method
>
>Now there is a statement that makes me sit up and take notice.  I certainly
>havn't thought this subject thru carefully, but to start, I think I would
>like capabilities to be held by a specific object, so if I give a Java
>object permission to read a file, that permission is not automatically
>inherited by other objects, or instances of the same object which use the
>common method.
>
>There would also have to be a technique where capabilities could be passed
>from object to object to allow subcontracting.
...

There are two major security enhancements of a "fundamental nature" that
are being discussd, that I know of:

1. Sun and JavaSoft are talking about "signed classes," using full-blown
digital signatures, in a future release. Some of the Java developers talked
at a Cypherpunks meeting last June or so about this (before Java became so
hot and they would only speak at Moscone Center before crowds of 1000 and
up).

2. Electric Communities has developed a superset of Java called E,
available for downloading and whatnot at http://www.communities.com/. It
offers a set of capability-based security features which are quite
interesting.

(Several Cypherpunks work at EC, of course.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









Thread