Slashdot Mirror
Researchers Looking at Alternatives to Palladium
An anonymous reader writes "Some folks at Stanford have been looking at an alternative architecture for doing trusted computing (ala Palladium) based on using Virtual Machines. They presented a brief paper describing their work a couple weeks ago at the USENIX Workshop on Hot Topics in Operating Systems . In their paper they also discuss a bunch of non-DRM applications of Trusted Computing such as distributed firewalls, improving P2P security, preventing DDOS, and even strengthening civil liberty protections."
Anybody from trusting anybody else now. We could create distrib-firewalls if we wanted to.
The fact is DRM takes away the PEOPLES' rights to choose who to trust.
One good example is the google puzzle contest I'm sure many tried. You downloaded the .pdf before, and got a password when the time started. While nobody should go to jail for cracking the password, it was an example of a good (not evil) use of DRM.
-Libertarian secular transhumanist
Rather this alternative to Palladium does or doesn't work at the fact that OTHER companies are looking into creating this kind of system makes the future of Palladium-esque systems look a lot better. Competition is a Good Thing and handing the reigns to microsoft with out look bad is a bad thing, microsoft or not a company should not have that much power. If this market becomes more diversified we will see better products, rather from microsoft or not, and people will start listening to the peanut gallery ranting for a better system.
transmission_err
One is proposed by some folks in Stanford, the other is proposed by Microsoft and Intel.
Guess which one is going to matter?
"Much work is lost, for the lack of a little more." -Edward H. Harriman
1) A safeguard, especially one viewed as a guarantee of the integrity of social institutions: the Bill of Rights, palladium of American civil liberties.
2) A sacred object that was believed to have the power to preserve a city or state possessing it.
I believe that city is called Microsoft.
"Bill of Rights"... whaaaahahaha.
---
At any rate, I have only one more word to say about Palladium. You can read all about that word here
Moreso, would it be possible to fake out Palladium-dependent software by running it in an emulator that simulates the undelying Palladium subsystem?
What does a program REALLY KNOW about where it lives?
Wow, This is JUST like "The Matrix".
"Lawyers are for sucks."
- Doug McKenzie
I'd be happy with Trusted computing as long as I got to be the one who did the trusting, not some outside entity.
autopr0n is like, down and stuff.
With all the security patches MS has each week, I must admit I found it rather amusing that they were propsing a secure computing standard with Paladium.
Personally, I don't think they can pull it off. But with Stanford looking into an alternative now, this means we'll at least have choices down the line. And I'm sure that both sides will look at what each other does and rip off the good ideas.
Security is important and a verifiable identity is as well. Not just for e-commerce applications, either. Even such simple issues as banning some nimrod that wants to post stupidity on your board can be solved by a solid identity model.
Hopefully, one of em will pull it off.
What misleading terms they are. How can Palladium have anything to do with "trust" when they violate trust and anything else by intruding into my computer and controlling my content?
How can DRM "protect rights" when it denies basic rights of fair use?
Don't blame Durga. I voted for Centauri.
So from MS we get Trusted Computing where "trusted" means trusted by big corporations who want to sell you stuff without any chance of copying.
From these guys we get Trusted Computing where trusted means trusted by the guys building the network.
So, which would you choose?
Do you mind, your karma has just run over my dogma.
Why is it called "trusted computing" after all, when it violates trust?
The problem is we are looking at the wrong definition of trust. Most of us have in mind the primary definition: "Firm reliance on the integrity, ability, or character of a person or thing" or "Custody; care"
You have to look down the list to find the definition of "trust" that fits perfectly with Microsoft, RIAA/MPAA and the Palladium idea:
"A combination of firms or corporations for the purpose of reducing competition and controlling prices throughout a business or an industry."
Might as well called it "monopolized computing". Means the same thing.
Don't blame Durga. I voted for Centauri.
"Computers started out simplistic, under the user's complete control..."
No, they started out controlled by men in white coats in clean rooms.
The microcomputer and PC revolution changed all this.
The regressive trend back to "Master Control" started with Scott McNelly of Sun Microsystems. I remember when he first laid out his grand vision of returning everything to central control via the Internet. Java was part of this. Microsoft copied the rhetoric, announcing a time when your Word app and even your Word docs would all be on Microsoft's central servers.
Don't blame Durga. I voted for Centauri.
I find this branch of research and publication somewhat disturbing. As legitimate, morally appealing, uses for this technology appear, the opposition should become less vehemently opposed to the technology. It's the rational reaction for rational people. If you still oppose it, you're probably irrational.
We're capitalists, however. Civil liberties have not been terribly profitable products in the past. The old-world investors will not invest in end-point civil liberties protection technologies, and will continue to put on blinders to the true value in information networks--their end-points.
However, perhaps one or two capitalists out there has realized that (1) networks have no inherent value or use on their own, and (2) people are terrified of being ruled by any network. There's a fucking market for civil liberty weapons: tools to defend end-points, tools to protect individual's rights to connect and communicate with any other end-points, tools to insure security and authenticity between any two or more individuals. Justin Frankel's "Waste" is a beautiful start.
On a related, but off-topic tangent, I've got a new buzz-word: Intellectual Macro-Economics, a way to increase the value of the US dollar.
Here's how it works, in magic-bullet glory: Article 1, Section 8, of the US Constitution provides Congress with the power to increase the artists and scientific wealth of the US, providing a mechanism for doing so (limited terms). The concept is to increase the unlimited common wealth of the US (and probably Humanity), by encouraging the creation of new works. For the last 20 years our cultural wealth has been depleted by private interests, looting the cultural commons, robbing us of the creative wealth to build with. In this, the copyright law is our asset which has been mis-managed, and stopped delivering our wealth. To increase our national cultural wealth, require the creation of new works, and consequently increase foreign confidence in the US dollar, increasing its exchange value, we must repair copyright, patent, and trademark law so that the commons will resume growing, and an immediate idea-influx (through a retro-active term truncation) would have massive midterm-longterm beneficial effects.
Another aside. One side of the IP arguement sees the limited terms as the promotion of progress. The other side (ours, and the one that wrote the damned Constitution) sees the progress as the effect of limited terms: an increase in common intellectual wealth, with a "necessary evil" to promote the production of those works. Bleh. Communications barriers. And you thought it was so fucking obvious, didn't you?
I'm as mimsy as the next borogove but your mome raths are completely outgrabe.
... not to use any DRM at all ...
Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your ass tomorrow.
"If the Riaa and Mpaa do not trust people with the media, why show it? They, in effect, release the idea to everybody when they put some show/song in mass media."
Not only that, but the MPAA commonly encourages piracy.
Let's say I want to see "The Two Towers". It is no longer in theatres, can't go there. It is a LONG time before they sell a DVD; so I can't pay them that way by buying a DVD. The only alternative is to obtain somehow a pirated DVD copy of "The Two Towers".
No way should they whine about money-loss to piracy when they aren't selling it in the first place! There is a demand for their product, and in this example, they refuse to meet it in any way.
Don't blame Durga. I voted for Centauri.
So they build their network apps, we build our network apps. Ours are more fun and now can't be spammed, DDOSed, or any of the other nasty things they try.
Not any scarier, just more polarized.
I naively thought that Microsoft's main operating system was Windows - you know, that thing that runs on 90-something percent of desktops worldwide?
Wasn't Bob basically Clippy the first?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
I did RTFA and what this boils down to is what it says near the end: "Note that our threat model excludes compromise of the underlying tamper-resistant hardware...". Palladium has the same trouble.
Security through obscurity-and-a-bunch-of-hard-work-to-break-it. Basically, the first time anyone skilled figures out the algorithms for the hardware, they can help someone make an emulator.
Then, all you need is the key any "trusted" computer uses. So, you brute force crack your own computer's key by having it encrypt or sign some communique to some "trusted" server out there. Then, you intercept the communique. Since you know the algorithms, you try encrypting or signing the communique with different keys until you find a key that results in a match.
Once you have your key and your emulator, you can look at what any program on your computer is doing, change whatever the hell you want, and cause whatever "mischief" you want. Want a DRMed MP3 unDRMed so that everyone on the Internet can have a copy ? Go right ahead. You could probably make a program to automate the process. Want to change something a "trusted" program is sending to a server ? Go right ahead.
Let me keep it short :
Palladium emulator + the cracked private key for my machine = sharable data
Send both to a friend. Send him whatever data you want. Through the miracle of trusted computing, you can trust that he can read the data.
The problem is that the trusted layer *must* be small so that it can be completely verified. Applications can't be so easily verified and it would still be possible to compromise Outlook, for example to send unwanted EMail. All the signature does is to say that the software hasn't been modified, but we know that applications don't need bad code to misbehave, they only need the right kind of bad data. Once the code has been signed, it must be signed again verey time it is patched. A far from simple logistical problem.
OTOH, smaller code may be more easily verified - so a driver for a Smart Card reader could be protected, as could SSL. However a programmer can still make a mistake and allow the code to be compromised.
See my journal, I write things there