From: jim@bilbo.suite.com (Jim Miller)
Date: Mon, 18 Dec 95 20:02:48 PST
To: cypherpunks@toad.com
Subject: Java and timing info - second attempt
Message-ID: <9512190402.AA12992@bilbo.suite.com>
MIME-Version: 1.0
Content-Type: text/plain



I asked about using Java scripts to capture remote timing info before and  
got no response.  I assume everyone thought it was a stupid question.   
Therefore, I'll ask it again.

The thing that makes Java a big deal is that you execute other people's  
code on your machine.  You browse a Java-enhanced Web page, click on  
something interesting, suck across an applet, and execute it on your  
machine.  This setup enables a bunch of nifty interactive Web stuff.

Turn the picture around:  You setup a Java-enhanced Web page, include some  
interesting buttons to click, write some clever applet, and people around  
the world suck your applet onto their machine and execute it.

Combine this with some a standard crypto API for doing Web-based digital  
signatures or authentication or encryption and you may begin to see some  
possibilities.

Would it be possible to create a Java applet that causes the client  
machine to sign or encrypt something with their private key, and then send  
back timing info?

For the answer to be YES a few things need to be true.  There needs to be  
some sort of standard crypto API in use that can be accessed by a Java  
script, and Java scripts need to be able to capture and send back timing  
info.  Does anyone on this list know enough about Java to know if it can  
do any of these things?

Jim_Miller@suite.com