Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Your Rights Online

Cryptographers Find Fault With Palladium 345

Posted by timothy from the artist-formerly-known-as-palladium-that-is dept.
FrzrBrn writes "Whitfield Diffie and Ronald Rivest raised concerns about Microsoft's Next-Generation Secure Computing Base (formerly Palladium) at the RSA Conference in San Francisco on Monday. They are (naturally) concerned about vendor lock-in and having computers turned against their owners. See the story at EE Times."
This discussion has been archived. No new comments can be posted.

Cryptographers Find Fault With Palladium More

Cryptographers Find Fault With Palladium

Comments Filter:

  • In Other News... (Score:5, Funny)

    by Captain Beefheart ( 628365 ) on Tuesday April 15, 2003 @07:23PM (#5740121)
    ...Cancer researchers found fault with Marlboro brand cigarettes. More details soon.

    • Re:In Other News... (Score:2, Interesting)

      by Yankovic ( 97540 )
      Given that the researchers work for other companies it may be "Ford researchers find that Chevy's will kill your dog and run off with your girl." This stuff is so vague right now, it's hard to see anyone doing anything but fighting for the sound bite.

  • Better they find fault with it now, (Score:5, Interesting)

    by Angry White Guy ( 521337 ) <CaptainBurly[AT]goodbadmovies.com> on Tuesday April 15, 2003 @07:25PM (#5740143)
    then someone finds fault with it later.

    And now we're supposed to trust 'Trusted Computing'?

    • Re: Better they find fault with it now, (Score:5, Insightful)

      by Black Parrot ( 19622 ) on Tuesday April 15, 2003 @07:54PM (#5740323)


      > And now we're supposed to trust 'Trusted Computing'?

      "Trusted Computing" is supposed to fix it where content vendors can trust us.

      Or rather, trust our computers.

    • Platform shift (Score:5, Interesting)

      by AndroidCat ( 229562 ) on Tuesday April 15, 2003 @08:44PM (#5740623) Homepage
      Microsoft had better handle this carefully. If they don't, they could cause a platform shift. Previous shifts happened when the IBM PC/MSDOS took over from the CP/M Z80 market (and Apple II). Also when Windows 3.0 put the skids under MSDOS and OS/2. When a shift happens, any Big Name company that isn't prepared for the change can find themselves shut out of the new market.

      Going to a DRM OS will change how personal computers work. People aren't always happy with change, and if forced to, they will review their options. That would be the perfect time for a Linux distro that does a painless install/conversion for Windows users, and installs a "best of breed" set of packages that are either compatable or equivilent to MS Office and friends. (If you really want 101+ different editors, make it an option.)

      With the right package at the right time, the MS DRM "trusted" OS could be Microsoft's PS/2.

  • Privacy (Score:5, Interesting)

    by TeknoDragon ( 17295 ) on Tuesday April 15, 2003 @07:27PM (#5740153) Journal
    Diffie and Rivest have always held the idea that personal privay (and personal security) is a fundamental right. Their comments at this forum pretty much express that.

    They're cautious for a good reason. Making every PC an Xbox with push content delivery just opens up an ugly vulnerability in your system. I can't wait for the distributed Palladium cracking project!

    From accounts of Microsofts other presentations they are there primarily to advertise the future of their technology rather than to actually discuss the future of security with others.

    • Re:Privacy (Score:5, Insightful)

      by neptuneb1 ( 261497 ) on Tuesday April 15, 2003 @07:36PM (#5740218)
      "I can't wait for the distributed Palladium cracking project!"

      You're going to be waiting for a while. With M$'s army of lawyers, any attempt to organize such a project will quickly be shot down by any one of a number of current laws. Let's see how many we can name....

      • Re:Privacy (Score:5, Insightful)

        by TeknoDragon ( 17295 ) on Tuesday April 15, 2003 @07:43PM (#5740255) Journal
        For every Napster there are a dozen gnutella, hotline, audiogalaxy's... for each of those there's likely to be a clandestine effort to do the same thing.

        Besides... we all know there will be someone [nsa.gov] M$ won't be able to stop.

        • Re: (Score:2, Interesting)

          by account_deleted ( 4530225 )
          Comment removed based on user account deletion
          • hate to bust your bubble, but it was somthing more along the lines of the government (with unlimited resources) helping on a product that directly competed with a commercial market (microsoft).

            that is, rightfully, wrong.

          • _Correction_ (Score:5, Informative)

            by jstockdale ( 258118 ) on Wednesday April 16, 2003 @01:18AM (#5741960) Homepage Journal
            Ummm, exactly WHY do you think the NSA seems to have suddenly stopped contributing code to the NSA security enhanced linux project?

            I suppose the NSA stopping all development on SE Linux is the reason that they just posted updates one week ago [nsa.gov] to SE Linux, as well as in January 2003, December 2002, and October 2002, all of which took place after this article reported them dropping the project (August 2002).

            Not to flame, but just check your sources first next time ;)

      • Re:Privacy (Score:5, Insightful)

        by meowsqueak ( 599208 ) on Tuesday April 15, 2003 @10:22PM (#5741205)
        In the USA and perhaps a few other countries perhaps - the rest of the world isn't drowning itself in stupid laws quite like the USA is at the moment. Microsoft has a long legal reach but it doesn't extend over the entire planet.

        I can imagine 7 years or more down the track, when innovation has been finally eradicated from the US economic landscape, India (for example) will have observed and learned from the USA's mistakes, and become the largest economic superpower on Earth.

        Once again, it makes me feel all warm and fuzzy inside to know deep in my heart that no matter how you look at it, I don't live or work in the USA :)

        • Re:Privacy (Score:3, Interesting)

          by RzUpAnmsCwrds ( 262647 )
          Sigh...

          Yet another European/Asian/Other citizen bashing the US.

          Look, the system over here works the way it does. One of the problems with the system is that corporations have been given too much political control.

          Many European countries are already enacting their own versions of the DMCA and other rediculous laws. Europeans, don't think you're immunne.

          "India... largest economic superpower on Earth"

          Wrong. China will likely be the largest economic superpower on the planet.

          "Once again, it makes me feel a
        • In the USA and perhaps a few other countries perhaps - the rest of the world isn't drowning itself in stupid laws quite like the USA is at the moment. Microsoft has a long legal reach but it doesn't extend over the entire planet. I can imagine 7 years or more down the track, when innovation has been finally eradicated from the US economic landscape, India (for example) will have observed and learned from the USA's mistakes, and become the largest economic superpower on Earth. Once again, it makes me feel al

    • Re:Privacy (Score:3, Interesting)

      by Vellmont ( 569020 )
      I can't wait for the distributed Palladium cracking project!

      Forget about it. The XBox key is 2048 bit RSA key. You can expect that to be the minimum key length Paladium will use. Last I heard 512 bit RSA keys could be brute forced, but 2048 bit keys are far too difficult to even attempt. I'm sure people will try (as they foolishly have with the X-Box), but it's highly unlikely it'll be broken in any amount of time where the key would still be useable. Think about it for just a minute. Do you real

      • Re:Privacy (Score:3, Funny)

        by 1lus10n ( 586635 )
        " Do you really think MS is dumb enough to chose a key length that has any chance of being broken anytime soon? "

        Do you really want me to answer that ?

      • The key is not the point (Score:5, Informative)

        by xpl_the_myst ( 612106 ) on Wednesday April 16, 2003 @01:09AM (#5741922)
        The number of bits in the key is not the issue. In fact, most secure protocols like SSL use a decent size so that brute forcing is not worthwhile.

        The point actually is that any theoretical construct like a cryptographic scheme or a TCP protocol needs practical implementation in code. And this is where the bugs creep in. And with things like Microsoft, those bugs are as common as snow in Greenland. And so all these hackers/crackers out there working their fingers on their keyboards and peering into bright screens into the fading night can 'hack' Palladium.

        Microsoft has taken on itself to make errors wherever possible and remain as human as any one of us. Trust them to repeat their humanity and come up with enough holes in their Palladium implementation to let most hacks through.

      • Re:Privacy (Score:3, Insightful)

        by Steeltoe ( 98226 )
        Do you really think MS is dumb enough to chose a key length that has any chance of being broken anytime soon?

        Yes. Does that answer your question?

        All they need is the DMCA to stop it from being legitimate. With the DMCA, good security is "not necessary" to keep the masses down, just the law and a police force.

    • Re:Privacy (Score:5, Funny)

      by rupe ( 118491 ) on Tuesday April 15, 2003 @08:42PM (#5740609)
      I can't wait for the distributed Palladium cracking project!


      Neither can Microsoft .. they'll be selling you the computers and software to do it!! For the next trillion years!

    • Re:Privacy (Score:5, Interesting)

      by Alsee ( 515537 ) on Wednesday April 16, 2003 @01:34AM (#5742013) Homepage
      I can't wait for the distributed Palladium cracking project!

      Actually one of the best attacks on Palladium is a hardware hack to dig the private key out of individual chips. With one of those keys you can run a palladium emulator in software and have total control.

      The bad news is that every chip has a different key, and if you share the key with other people it will quickly be spotted and that key will be voided. You dig out one key and it's good for one person.

      The good news is that once someone with the right equipment does it he can crack chip after chip all day long. He just has to keep a low profile. Perhaps set up shop in the country of Tokelau.

      The result is that you will have a limited number of "elites" who are totaly above the system. It's the worst of both worlds - virtually everyone will be crippled under DRM, content will still be leaked onto the internet, and you still can't trust software that is running on someone else's machine.

      -
  • They are (naturally) concerned about vendor lock-in and having computers turned against their owners.

    This will give the whole "man over machine" persona to Palladium, thus making it unpopular.

    w00t!

    • Laws of Robotics? (Score:5, Interesting)

      by SHEENmaster ( 581283 ) <travis@uUUUtk.edu minus threevowels> on Tuesday April 15, 2003 @07:52PM (#5740316) Homepage Journal
      Didn't Asimov write up a list of directives for robots, and wasn't one of them that robots should always be subservient to humans?

      1. Is palladium optional for the SO? Could Linux or Winshit98 be installed on a Palladium box w/ no ill effects?
      2. Is palladium optional for developers? Can "Joe Shareware" still release his software w/out paying an evil corporation for the right to sell it?
      3. Is there any way whatsoever in which this would help Joe User or Joe Hacker(not to be confused with Joe Cracker)?
      4. Will this be integrated on Sparc and PowerPC or just PCs? Is AMD accepting this BS or just Intel?
      5. Who will be in charge of licensing keys for palladium software?

      • The alleged benefit of the CBDTPA, Pd, etc. (Score:5, Informative)

        by yerricde ( 125198 ) on Tuesday April 15, 2003 @08:20PM (#5740459) Homepage Journal

        Is there any way whatsoever in which this would help Joe User or Joe Hacker(not to be confused with Joe Cracker)?

        The excuse given for the CBDTPA, which may apply to Pd as well, is that more authors would be willing to publish works in a digital restrictions management system than in a system that grants all fair use rights by default.

        • Re:The alleged benefit of the CBDTPA, Pd, etc. (Score:5, Insightful)

          by Waffle Iron ( 339739 ) on Tuesday April 15, 2003 @10:03PM (#5741095)
          The excuse given for the CBDTPA, which may apply to Pd as well, is that more authors would be willing to publish works in a digital restrictions management system than in a system that grants all fair use rights by default.

          Many people throughout history have made great sacrifices to ensure our freedom. Now it seems there are some people willing sell everyone's freedom to use a general-purpose computing device in exchange for a few extra TV shows, video games and pop songs.

          I say if the price of freedom is fewer published works, so be it. We're already wallowing in an ocean of media crap anyway; it's not even a big price to pay.

      • 1. Yes, supposedly.
        2. Yes, almost certainly. Not even the menace of Redmond could get away with that.
        3. No.
        4. Intel and AMD.
        5. Micros~1.

      • Re:Laws of Robotics? (Score:5, Insightful)

        by archnerd ( 450052 ) <nonce+slashdot...org@@@dfranke...us> on Tuesday April 15, 2003 @08:44PM (#5740626) Homepage
        The exact laws of robotics are as follows:

        1. A robot may not injure a human being, or, through inaction, allow a human being to come to harm.
        2. A robot must obey orders given it by human beings except when such orders would conflict with the First law.
        3. A robot must protect its own existence as long as such protection does not conflict with the First or Second Law.

        Palladium violates all three. A user could be severely inconvenienced by it, it clearly will refuse to obey the user, and it tempts the user to take a sledgehammer to it.

        In the Foundation series a "zeroeth law" is introduced which states that a robot must not harm humanity, or, through inaction, allow humanity to come to harm. Palladium screws that up too.

  • Is this legal? (Score:5, Funny)

    by Sephiro444 ( 624651 ) on Tuesday April 15, 2003 @07:32PM (#5740189) Homepage
    Diffie and Rivest had better watch out! Microsoft could easily hit them with DMCA violation charges for questioning Palladium's encryption!

  • WinHEC (Score:2, Funny)

    by eegad ( 588763 )
    Yeah, I'll be getting a computer with Palladium WinHEC freezes over!
    • Yeah, I'll be getting a computer with Palladium WinHEC freezes over!

      Or when the computer is labelled as such. I am worried that the marketing guys who usually print every possible buzz word on the box will hide this in the small print.

  • I hope they're right (Score:5, Interesting)

    by MoOsEb0y ( 2177 ) on Tuesday April 15, 2003 @07:34PM (#5740204)
    From the article,
    The Microsoft approach "lends itself to market domination, lock out, and not really owning your own computer. That's going to create a fight that dwarfs the debates of the 1990's," said Diffie as part of a broad panel discussion on cryptography at the RSA Conference here Monday (April 14).
    I hope the guy is right. If he is, then the courts will (more than likely) end up voting this down, because it is way too extreme. There are far easier and less intrustive ways of making products secure.

  • You know it's comming... (Score:5, Funny)

    by Anonymous Coward on Tuesday April 15, 2003 @07:34PM (#5740208)
    News Flash: "Blue screen of death kills computer and user, details at 9" - Kent Brockman
    • > "Blue screen of death kills computer and user, details at 9"

      In other news:

      • BSOD interrupts computer and user, details at 2.
      • BSOD aborts computer and user, details at 6.
      • BSOD segfaults computer and user, details at 11.
      • BSOD terminates computer and user, details at 15.

      (hint: $ man 7 signal)

  • Sidenote about RSA (Score:5, Informative)

    by preternatural ( 322346 ) on Tuesday April 15, 2003 @07:34PM (#5740209)
    The inventors of the RSA algorithm (Ron Rivest, Adi Shamir, and Len Adleman) were awarded the Turing Award on Monday. This was announced at the opening of the RSA conference. More information can be found in this article [zdnet.co.uk].

  • This sums it up (Score:5, Informative)

    by Target Drone ( 546651 ) on Tuesday April 15, 2003 @07:36PM (#5740219)
    From the article: The Microsoft approach "lends itself to market domination..."

    Does anyone think Microsoft would have it any other way?

    • Re:This sums it up (Score:5, Insightful)

      by zurab ( 188064 ) on Tuesday April 15, 2003 @08:38PM (#5740586)
      From the article: The Microsoft approach "lends itself to market domination..."

      Does anyone think Microsoft would have it any other way?

      DOJ sues MS for violating U.S. antitrust laws. Courts whole-heartedly agree and rule that MS is guilty. Courts do virtually nothing to protect consumers and tech industry, and literally nothing to punish MS. Courts do not implement any *preventive* measures against MS - as required by the law. MS goes on breaking the same law again and again - nobody pays any attention. MS widely announces its plans (as a marketing campaign) to break the same law again in many-fold worse than before - Palladium - nobody cares.

      MS has literally and (seems) legally bribed all - legislative, executive, and judicial - branches of government in order to escape and be exempt from the law, even after it has been convicted of violating it. At some point, the government corruption needs to end, but noone knows how; in the information age where most of the "information" is spoon-fed by corporations that are part of the corruption scheme, the masses will never be on the reform side.

  • Cryptographers Find Fault With Palladium (Score:2, Insightful)

    by Anonymous Coward
    but due to DMCA laws cannot tell anyone about it, and therefore the faults will never be fixed, because the schmuckos the programmed the damn thing are too damn stuborn, and full of themselves to admit to there being faults in their code, and refuse to fix anything without proof of the faults first.

    we now return you to your catch-22 free life . . . no we don't

    • Re:Cryptographers Find Fault With Palladium (Score:5, Insightful)

      by offpath3 ( 604739 ) <offpath4@ya h o o . c o .jp> on Tuesday April 15, 2003 @08:32PM (#5740535)
      They found fault with the way the computer has more control than the user. They didn't find a crytographic fault in any of the protocols.

    • Re:Cryptographers Find Fault With Palladium (Score:5, Interesting)

      by Pharmboy ( 216950 ) on Tuesday April 15, 2003 @09:02PM (#5740724) Journal
      but due to DMCA laws cannot tell anyone about it, and therefore the faults will never be fixed, because the schmuckos the programmed the damn thing are too damn stuborn, and full of themselves to admit to there being faults in their code, and refuse to fix anything without proof of the faults first.

      Damn good point. Your comment gathers up and bundles rather nicely the hard cold facts. And of course, once MS has made this REQUIRED to use any software of any consequence, I am sure the price of Windows will jump again.

      THIS is EXACTLY why I am working very hard to learn Linux on the Desktop and hone my *nix server skills as well. It isn't a matter of 'bad old MS' to me as much as it appears that they are on the verge of imploding, and they don't realize it. Its a simple matter that I think Linux will end up overtaking MS not on merit, but by simply having less DEmerits at the same time it becomes 'as good enough as'. When the change happens, I want to be up to speed, and ready to capitalize on it. (read: make $)

      Free people don't like this kinda shit, it sounds so, well, unfree (as in speech). As the computer gets cheaper, windows gets more expensive, Linux gets better (RH9 is about as good as win95 to me, which is a compliment) it WILL put pressure on windows. Unlike others, I do NOT think that Linux will gain a percent of market share here and there. I think that it will happen in a very short period, BANG, and over 2 years, half of everyone is no longer using MS. History shows this is the most common method for change.

      This is why I am not a MS basher (Really, I use Windows). I don't have to be, they are becoming their own worst enemy, and beginning in 2 or 3 years, they are going to be very shocked in a very short period of time.
  • " They are (naturally) concerned about vendor lock-in and having computers turned against their owners."

    "In a related story, Whitfield Diffie and Ronald Rivest are spending this evening at St. Francis Memorial Hospital in San Francisco. It would appear that sometime on April 15th 2003, they were rendered blind. Though it's not obviously clear what brought on this sudden flash of blindness, they are expected to recover soon. This news comes shortly before they were each to recive honorary promotions to

  • Paladium is "Optional" (for varying definitions..) (Score:5, Interesting)

    by Strats1 ( 639064 ) on Tuesday April 15, 2003 @07:43PM (#5740259)
    Microsoft keeps countering privacy and security claims with the fact tha Paladium is optional, such as the following from the article:

    In Microsoft's NGSCB approach, users would have to consciously evoke a secure operating mode that would be turned off by default.

    Now as we all can imagine, it won't take long before various applications will not work unless Paladium's controls are in effect. Anything that accesses potentially copyrighted works are the most likely to begin with. Windows Media player, E-Books, and later Office products will be the first to require this.

    Microsoft is already pushing to get their media formats to be the default. Websites are frequently given discounted access to Windows Media creation software. Colleges and other low-budget places are frequently targets. They have to agree to use only those formats, not quicktime or MPEG, in return. This forces users to get Windows Media player to watch this content. Later MS will require these sites start saving in the newer, Paladium-only, versions, and we'll have our transition to lockout today.

    What can you do to prevent this? Stay with open formats. Ogg-Vorbis. MPEG. XML/OpenOffice.org.

    It'll be very interesting to see if this subtle push backfires or succeeds. Ten years ago, there's no doubt Microsoft would have been able to back us into any corner they wanted. But the last few has shown some strong distrust - people no longer take MS's word as law.

    Let's hope that trend continues.

    • Throw a frog into a pot of boiling water and he'll jump right out. However, if you immerse him into a pot of cool comfortable water, he will remain there. After that, you slowly raise the temperature of the water a degree at a time allowing the frog to acclimate at a comfortable pace. Over time, the frog will continue to thin the water is fine even though it has been slowly raised to the boiling point.
      • Nope it's called a slippery slope argument, and it's a logical fallacy [datanation.com].
        • It may be a logical fallacy, but the our legal system isn't built on logic. Lawyers use a system of precedents, so the slope is extremely slippery.

          For example, one reason that the Supreme Court gave for not striking down the latest Mickey Mouse copyright extension act (in Eldred v. Ashcroft) was that it had not struck down other previous copyright extensions. Give an inch and they take a mile.

  • The bit I like (Score:5, Insightful)

    by boy_of_the_hash ( 622182 ) on Tuesday April 15, 2003 @07:43PM (#5740260)
    NGSCB also requires secure channels between a keyboard and main memory and between a display interface and a graphics chip and its frame buffer.

    Which means it will only work on approved hardware - guess who profits from approving the hardware and drivers? Why would I need a secure framebuffer exactly when I'm already in full control of the code executed on my machine?

    • Approved hardware (Score:5, Insightful)

      by overshoot ( 39700 ) on Tuesday April 15, 2003 @08:14PM (#5740423)
      Why would I need a secure framebuffer exactly when I'm already in full control of the code executed on my machine?

      You missed Part Two: you can't get your hardware approved if you don't agree to keep the operational specs under lock & key. So, in order to sell display devices to the monopoly market, they have to be Microsoft-only display devices. Et cetera.

    • (display interface) and a (graphics chip and its frame buffer)

      You may be in full control of the code you execute, but whats to stop a malicous display interface displaying the number "0" when it should display the number "9".

      I could then send you a message saying please transfer "9" credits to me - you would see, please transfer "0" credits to me, and might be inclined to do it (not a great example, but you see the reason for needing secure hardware as well).

  • Unfortunately... (Score:5, Interesting)

    by Toasty16 ( 586358 ) on Tuesday April 15, 2003 @07:45PM (#5740266) Homepage
    ...No one can be told what encsub is...because they're all under NDAs.

    Seriously though, read the following:

    "The right way to look at this is you are putting a virtual set-top box inside your PC. You are essentially renting out part of your PC to people you may not trust..."

    Aren't people who download Kazaa already doing that, since Brilliant Digital's spyware is installed with the program and can use the computer's CPU cycles and hard drive space without warning? It seems that unless there is a big enough hoopla made about Palladium, unsuspecting customers will have no idea of "Trusted Computing"'s true effects and limitations on usage. Just ask a non computer geek Kazaa user if they're concerned that Brilliant Digital has so much control over their computer, and if they give you a response other than a blank stare accompanied with a "wha?" I'll give you a Gummy bear (It's warm from being in my pocket).

  • Whitfield Diffie, who holds the position of Distinguished Engineer at Sun Microsystems Laboratories is best known for his 1975 discovery of the concept of public key cryptography, for which he was awarded a Doctorate in Technical Sciences (Honoris Causa) by the Swiss Federal Institute of Technology in 1992.

    For a dozen years prior to assuming his present position in 1991, Diffie was Manager of Secure Systems Research for Northern Telecom, functioning as the center of expertise in advanced security technolog

  • It's about who "owns" your ID (Score:5, Insightful)

    by feepcreature ( 623518 ) on Tuesday April 15, 2003 @07:46PM (#5740275) Homepage
    A central objection from Diffie & Rivest seems to be that under Palladium, Microsoft will own and control your ID - or at least what can interact securely with "your" secure Palladium device.

    To understand why this is not a good thing, imagine if a commercial company had the monopoly of passport and driving license production, and were able to prevent you from using the ID they issued to verify who you were except in "microsoft approved" shops and venues (or countries).

    IDs and trust systems should be standards based, not proprietary. They should be secure, and openly peer-reviewed or audited. And the ID should be under the control of the person being identified (or at least issued by a "neutral" government body, as passports are now).

    But I've just started thinking about this... so I might change my mind some more. Would that make me a bad slashdotter?

  • what is the fault? (Score:5, Insightful)

    by shird ( 566377 ) on Tuesday April 15, 2003 @07:46PM (#5740278) Homepage Journal
    From the title, you would think there is some technical flaw in palladium, but the article just goes on about some thing about not having control of your PC etc...

    Im not saying there isnt a technical flaw, just /. spreads propaganda through misleading comments.

    • Re:what is the fault? (Score:4, Insightful)

      by Slowping ( 63788 ) on Tuesday April 15, 2003 @08:06PM (#5740390) Homepage Journal
      From the title, you would think there is some technical flaw in palladium, but the article just goes on about some thing about not having control of your PC etc...

      I'd say that the owner not having control of their own keys is a major technical flaw of "trusted computing".

    • From the title, you would think there is some technical flaw in palladium, but the article just goes on about some thing about not having control of your PC etc...

      No, I wouldn't. It says "Cryptographers Find Fault With Palladium". To me that means that they perceive a problem with it, since "to find fault" is a very common idiom for "to criticise".

      If the title had been "Cryptographers Discover Flaw In Palladium", that would have been misleading...

  • In Soviet Russia... (Score:3, Funny)

    by Glock27 ( 446276 ) on Tuesday April 15, 2003 @07:49PM (#5740290)
    your computer watches you.

    Palladium simply brings this 'innovation' (in the grand tradition of Microsoft 'innovation') to the U.S.

    Great.

  • Suprised MS isn't cyring "conflict of interest" (Score:5, Insightful)

    by pete_wilson ( 637423 ) on Tuesday April 15, 2003 @07:49PM (#5740293)
    I'm suprised that Microsoft isn't tyring to cloud the issue by talking about the associations of the persons who gave the talk.

    Wittfield Diffie is an engineer at Sun Microsystems, one of the only corporations that can be considered a Microsoft competitor. Ron Rivest is a professor as his day job, but gets quite a bit of cash from RSA, and Microsoft isn't using any of the code that RSA provides (BSAFE, etc) in Paladium, so that's a big chunk of change that won't be coming his way.

    We here on slashdot may realize that Rivest and Diffie are actually quite excellent individuals in their field, but these kinds of conflicts of interest are frequently what will be pulled out to counter an argument, rather than working from the facts themselves.

  • Misleading headline (Score:5, Insightful)

    by BlueFall ( 141123 ) on Tuesday April 15, 2003 @07:51PM (#5740301)
    The headline of this story is misleading. Some people disagree philosophically with Palladium's goals, not its technical merits. It just happens that these people are famous cryptographers. At the moment, the technical details seem sparse, so we'll just have to wait until they are released (if ever) to see if the goals that are mentioned are actually met.

    • Re:Misleading headline (Score:4, Insightful)

      by wytcld ( 179112 ) on Tuesday April 15, 2003 @08:07PM (#5740399) Homepage
      Some people disagree philosophically with Palladium's goals, not its technical merits.

      How do you separate these two? Having a car you don't hold the key to, but instead have to call some central bureau on your cellphone to unlock wouldn't just be a philosophical problem, but a technical one. It would totally suck technically if your cellphone wouldn't work, for instance - and this vulnerability would be technically more likely than if you carried your own key - a higher rate of failure at car starting. Now philosophically, you may be against always reporting to a central bureau when you'd like to start your car; but technically the scheme still sucks. Same if it's a key to your computer.
      • How do you separate these two? Having a car you don't hold the key to, but instead have to call some central bureau on your cellphone to unlock wouldn't just be a philosophical problem, but a technical one.

        No. How you drive your car if your cellphone dies is a technical problem--which, oddly enough, could be "solved" by sufficient network redundancy.

        "Technically" the system has no problems if it works as advertised. The problems the cryptographers have are "philisophical" or "marketing", not "technical

  • this just won't fly.... (Score:3, Insightful)

    by smd4985 ( 203677 ) on Tuesday April 15, 2003 @08:00PM (#5740352) Homepage

    if foreign governments are having misgivings about using Windows because it is closed source, they surely won't accept Palladium if MS has undue influence and control over the architecture.

  • Not A Crypto Fault (Score:5, Informative)

    by rsmith-mac ( 639075 ) on Tuesday April 15, 2003 @08:00PM (#5740360)
    Just as a note, contrary to what most people's initial reaction is, the article does not talk about any cryptographic flaw in the system. Diffie is arguing the merits(or lack thereof) of a system that the user doesn't hold the key to; Palladium itself hasn't been proven insecure(yet).

    • Re:Not A Crypto Fault (Score:4, Interesting)

      by cpeikert ( 9457 ) <cpeikert AT alum DOT mit DOT edu> on Tuesday April 15, 2003 @10:24PM (#5741215) Homepage
      Palladium itself hasn't been proven insecure(yet).

      That depends on what the meaning of the word "secure" is. Or to which party (i.e., user, vendor, etc.) the word "secure" applies.

      With Palladium, I won't be able to inspect the memory or other operational aspects of any program that is running in the "nexus," and which doesn't give me permission to do so. Supposing some kind of virus or, more likely, spyware starts running in the nexus layer, I have no way (short of pulling the power plug) of preventing it from running. That doesn't sound like the kind of "security" I'm interested in.

  • Not owning your computer eh? (Score:5, Insightful)

    by scourfish ( 573542 ) <scourfish@@@yahoo...com> on Tuesday April 15, 2003 @08:00PM (#5740361)
    It's not much of a change from now: you don't own your copies of windows nor do you own your XBOX

  • debates? opposition? (Score:3, Insightful)

    by Anonymous Coward on Tuesday April 15, 2003 @08:02PM (#5740375)
    "We need to understand the full implications of this architecture. This stuff may slip quietly on to people's desktops, but I suspect it will be more a case of a lot of debate," he added.

    Rivest said some experts have discussed setting up a forum in technical society for such a debate, but he was unaware of any current moves to do that. Likewise Diffie said he was not aware of any specific alternative to NGSCB in the works at Sun.

    I hate to take this stance, but the above says it all. Just like the vast majority of /. that would rather post than write to their representatives, Palladium will simply be buzzworded and adopted by the masses. Regardless of how the technical community kicks and whines, the forces of market domination will likely persevere.

  • Hmmm... (Score:2, Funny)

    by Cyno01 ( 573917 )
    Microsoft's Next-Generation Secure Computing Base (formerly Palladium)
    Thats a little lengthy methinks, can't we just come up with some freaky little symbol to stand for "The Secure Computing Initative Formerly Known as Palladium"

  • Listen folks (Score:4, Funny)

    by TerryAtWork ( 598364 ) <research@aceretail.com> on Tuesday April 15, 2003 @08:09PM (#5740406)
    Computers have been turned against thier owners for quite some time now.

    Why do you think all the latest M$ software from Bill says 'My Computer' ?

  • "No." (Score:2)

    by xtal ( 49134 )
    We need this why again? I love how there's this crisis that requires microsoft to have access to my computer's execution. What's so wrong with the current model of computing that requires something to literally shake it to it's core? Why can I not be trusted with the keys to my own computer?

    "No."

    No, I'm not going to buy a Palladium computer. Vote with your wallets on this one, and it'll sink into the historical curiosities bin with Divx. Apple, hopefully, will have nothing to do with this, but if they get
  • The fact is, there has never been enough damage to home computer systems to warrent any sort of cryptographic systems such as that which microsoft is describing. How many people could say that because of some random person on the net or in a chat room they lost all of thier data? The worst offenders in these regards are COMPANIES, spy-ware, ad-ware, crappy patchs that break the system, and yes, even DRM schemes are the cause of most of our headaches. So microsoft's proposed solution is to say that they a
  • The main thing is that this can't be something spearheaded by Microsoft but needs to be an open standard everyone has input into. I felt like puking when I heard Microsoft wants to license this. It will shut out Linux.

  • Trust (Score:2, Interesting)

    by Phishpin ( 640483 )
    I just noticed the quote I saw at the bottom of the page:

    "I'll pretend to trust you if you'll pretend to trust me."

    How eerily accurate.
  • Yes, I'm one of those lost souls who would not switch to Linux. But quite frankly, I see absolutely no reason to upgrade to anything beyond Windows 98. At a time when people I know still use Win 3.1 and WordPerfect 5, I found that Win98se with Office 2000 and a few other applications I need for normal functioning simply have everything I need. I can't even imagine further iprovement in such applications beyond some minor interface changes. There are three consoles for games, so I don't even see a reason
  • From what I have been reading this stuff is just blatant garbage... The idea of locking out the user is a totally STUPID idea.. for one, it would kill the open source movement.. because behemoth companies such as microsoft would just lock out the competition (bye bye sun). the government would even back this lunacy because its the law. so even cracking it would be illegal under the fascist DMCA. so whats next? Well, for us to combat this as a whole.. the first thing that would have to happen is all of us s

  • Monopoly (Score:4, Insightful)

    by Trevin ( 570491 ) on Tuesday April 15, 2003 @09:26PM (#5740863) Homepage
    They are (naturally) concerned about vendor lock-in
    Isn't this the real reason Microsoft started developing Palladium in the first place?

  • You might be missing a point (Score:4, Insightful)

    by Righteous Indignatio ( 666281 ) on Tuesday April 15, 2003 @10:31PM (#5741247)
    In spite of the imagined throngs of doe-eyed deer-in-the-headlights otherwise thoughtless "consumers" out there, it's going to come to pass that Microsoft and their greed will overextend itself. The lock-out we-control-your-security methodology will only work until even the more moronic people have been bitten by it. Perhaps too late for their immediate circumstances, even the most ignorant and go-with-the-flow types will realize they have to leave this Microsoft environment. I believe what we are seeing is two things (a) desperate paranoia-fueled greed and (b) the beginning of the end for anyone so foolish to be so exclusive to the world's computing community. Here on this forum, I keep hearing people talking in little boxes about Intel, Microsoft, AMD, Linux, PCs and all of this shit in this little world we have encased ourselves into. I used to be one of those people. While now I'm working much of my time in Linux (although Windows world stuff still pays some of the bills and mainframes pay the rest) I have gone to a point from being immersed in the Microsoft environments to now being largely outside of them. People? Notice that we are the majority. And we can choose whether or not to be consumer cattle thoughtlessly following the loudest noise. We can choose our own directions. But mental and philosophical freedom is hard work. Not going with the large groups of clueless cattle to slaughter means a lot of effort. If this philosophy of "security" is a bad thing, and I sincerely believe "Palladium" is a very bad thing, don't follow it. Just. Don't. It will have some nice bells and whistles, but recognize a gilded cage and a machine under perpetual remote control and remote authorization for what it is. Don't sit there whining about how Windows 98 or Linux is your favorite OS of choice--please get your egos out of this and start working on some of the deeper principles of your liberty and facility with your own data on your own computers. If it means developing GPL-equivalent hardware, open design microprocessors, and a true open and truly standard machine architecture, done somewhere in the world, then accept this as the direction. Locking people out means locking yourself from them. We have a greedy minority of producers locking out and constricting a vast majority of consumers. Linux demonstrates that we as people can produce, but most of us are in the software or user spheres. People? If they are so intent on locking us out with these obviously evil "security" schemes--let them! But don't let yourself ever be locked in. Linux and OSS is one way to freedom (like Richard Stallman's idea of Freedom as liberty--not lack of cost or price). But perhaps leaving Microsoft, Intel, "Wintel", and going to newer, more open and honest architectures is the way to go. Wintel is rotting and dying. Linux and it's philosophies of openness will succeed because they allow people freedom and the proliferation of new and open idea. Wintel is like the dinosaurs in a sense of being widespread and formidable in the small computer market. This chapter of overreaching greed is the first few pebbles of the beginning of a meteoric shift. Look for freedom and reject this and all attempts to hijack and tyrannize computing.

  • Here's a somewhat odd quote from the article. (Score:3, Interesting)

    by Anonymous Coward on Wednesday April 16, 2003 @12:39AM (#5741852)
    "In Microsoft's NGSCB approach, users would have to consciously evoke a secure operating mode that would be turned off by default. New instructions in the CPU as well as changes in the memory controller would help carve out a protected space in main memory to load a small, secure operating system kernel. "

    Correct me if I'm wrong, but hasn't *nix been doing this for oh say 30 years?

  • You'll still be able to install linux on your PC (Score:3, Funny)

    by PylonHead ( 61401 ) on Wednesday April 16, 2003 @02:26AM (#5742161) Homepage Journal
    You'll still be able to install linux on your PC. You just need to by a copy of that 007 game, modify your saved game file, flash your eprom, and you're go!

  • Nobody owns the keys (Score:5, Interesting)

    by SiliconEntity ( 448450 ) on Wednesday April 16, 2003 @02:35AM (#5742182)
    When you read that the user doesn't hold or control or own the keys to his computer, you naturally assume that someone else does. This is not true. No one owns the keys.

    The keys are generated internally in the secure hardware. They are public and private keys, and the private keys never leave the chip. Neither Microsoft nor the user nor the chip manufacturer can get at those keys.

    These keys are used by the secure hardware to lock data and to report a hash of an executing "secure" program. Because no one else has the key, neither the user nor Microsoft, no one can forge such a message (modulo the issue of breaking the hardware security).

    This is how Trusted Computing has to work. If anyone could get access to the secure keys, then they could misuse them and make false statements with them, and there would be no trust and no security. Only by embedding the keys in a well-defined piece of hardware, with predictable and known behavior, can the keys serve to transfer trust to other software.

    So when we see these complaints about the users not controlling their own keys, keep in mind that the point is not to put control in someone else's hands; it is to make it possible for the hardware to make trustworthy and believable cryptographic statements. The keys can't be owned or controlled by anyone, for this to work.

  • Who owns you? (Score:4, Insightful)

    by 0xB00F ( 655017 ) on Wednesday April 16, 2003 @03:49AM (#5742384) Homepage Journal

    From TCPA / Palladium / NGCSB / TCG Frequently Asked Questions [cam.ac.uk]:

    TCPA stands for the Trusted Computing Platform Alliance, an initiative led by Intel. Their stated goal is `a new computing platform for the next century that will provide for improved trust in the PC platform.' Palladium is software that Microsoft says it plans to incorporate in future versions of Windows; it will build on the TCPA hardware, and will add some extra features.

    This means that this whole Palladium/TCPA monstrosity requires support from both hardware and software. It is entirely up to the end-user whether or not he wants this. However, senator Fritz Hollings of South Carolina is working on getting a law that will make TCPA mandatory, see here [salon.com]. Until such time that this bill becomes the law:

    1. Don't buy the hardware. Unless there is a compelling reason to do so. Well if you are working for the military then go knock yourself out.

    2. Don't buy^H^H^H lease/rent/license/WTF the software. There is no compelling reason to do so.

    It will only be compelling to use Palladium/TCPA software and hardware only if it becomes illegal not to use it.

    Secure computing is not the aim of Palladium/TCPA. Its aim is to provide a way for software peddlers like Microsoft and content pushers like Disney to monitor what you run on your computer and assert control over your computer. In the long run, it will provide them a way to assert control over you.

    Secure computing can be achieved through a combination of secure computing practices, secure operating systems running secure applications, and plain-old common sense.

    If Intel, Microsoft and their cohorts push through with this stupidity it could spell the end for them. Just think, why in the hell would I want to run this sort of crap? Unless it's mandated by law, there's no reason for me to do so. With the recent slew of news about stupid laws being implemented in the U.S. it's a real possibility.

    0xB00F, stands in front of Bill Gates, raises hand, extends middle finger.

Slashdot Top Deals

Work is the crab grass in the lawn of life. -- Schulz

Close