Subject: [saag] Fwd: [widgets] New WD of Widgets 1.0: Digital Signatures spec published on March 31

From: Thomas Roessler <[email-masked]>
Date: Thu, 2 Apr 2009 18:57:01 +0200

FYI.

Note that the document is referencing an upcoming version of XML  
Signature, which is currently in Working Draft status.

There is an expectation that this profile (not the base spec) might  
undergo a W3C last call relatively soon, so this would be a good time  
to review the specification.

--
Thomas Roessler, W3C  <[email-masked]>

Begin forwarded message:

> From: Arthur Barstow <[email-masked]>
> Date: 2 April 2009 18:21:19 GMT+02:00
> To: public-webapps <[email-masked]>
> Subject: [widgets] New WD of Widgets 1.0: Digital Signatures spec  
> published on March 31
> Archived-At: <http://www.w3.org/mid/[email-masked] 
> >
>
> On March 31 a new WD of the Widgets 1.0 Digital Signature spec was  
> published and announced on the W3C's home page:
>
> [[
> 2009-03-31: The Web Applications Working Group has published a  
> Working Draft of Widgets 1.0: Digital Signatures. This document  
> defines a profile of the XML Signature Syntax and Processing 1.1  
> specification to allow a widget package to be digitally signed.  
> Widget authors and distributors can digitally sign widgets as a  
> trust and quality assurance mechanism. Prior to instantiation, a  
> user agent can use the digital signature to verify the integrity of  
> the widget package and perform source authentication. This document  
> specifies conformance requirements on both widget packages and user  
> agents.
> ]]
>
> Please review this new WD as soon as possible, preferably within the  
> next two weeks:
>
> <http://www.w3.org/TR/2009/WD-widgets-digsig-20090331/>
>
> -Regards, Art Barstow
>

---

From: Ben Laurie <[email-masked]>
Date: Mon, 6 Apr 2009 14:08:53 +0100

2009/4/2 Thomas Roessler <[email-masked]>:
> FYI.
> Note that the document is referencing an upcoming version of XML Signature,
> which is currently in Working Draft status.
> There is an expectation that this profile (not the base spec) might undergo
> a W3C last call relatively soon, so this would be a good time to review the
> specification.

I find it pretty annoying that signing widgets is described as a
"trust and quality assurance mechanism".

> Subject: [widgets] New WD of Widgets 1.0: Digital Signatures spec published
> on March 31
> Archived-At:
> <http://www.w3.org/mid/[email-masked]>
> On March 31 a new WD of the Widgets 1.0 Digital Signature spec was published
> and announced on the W3C's home page:
>
> [[
> 2009-03-31: The Web Applications Working Group has published a Working Draft
> of Widgets 1.0: Digital Signatures. This document defines a profile of the
> XML Signature Syntax and Processing 1.1 specification to allow a widget
> package to be digitally signed. Widget authors and distributors can
> digitally sign widgets as a trust and quality assurance mechanism. Prior to
> instantiation, a user agent can use the digital signature to verify the
> integrity of the widget package and perform source authentication. This
> document specifies conformance requirements on both widget packages and user
> agents.
> ]]
>
> Please review this new WD as soon as possible, preferably within the next
> two weeks:
>
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>
>

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 07 Apr 2009 01:47:35 +1200

Ben Laurie <[email-masked]> writes:

>I find it pretty annoying that signing widgets is described as a "trust and
>quality assurance mechanism".

It's a valid comment though.  A large-scale study (from Microsoft's malware
research group) has shown that the majority of CA-certified signed malware is
in the "severe" or "high-risk" category.  So seeing a signature on malware
provides a high level of trust that this is the high-quality stuff you're
seeing and not some cheap knockoff.

Peter.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 6 Apr 2009 15:14:54 +0100

> seeing and not some cheap knockoff.

Awesome! Link?

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 07 Apr 2009 03:07:22 +1200

Ben Laurie <[email-masked]> writes:
>> It's a valid comment though. =A0A large-scale study (from Microsoft's malware
>> in the "severe" or "high-risk" category. =A0So seeing a signature on malware

http://blogs.technet.com/mmpc/archive/2008/11/06/malware-and-signed-code.aspx
(this was what motivated my "Asking the drunk whether he's drunk" post on the
cryptography list a few months back).

As a general comment, signed malware has been out there for some years now,
but this is the first large-scale (I mean seriously large-scale) study of it.
1.78M signed non-malicious files, 173K signed malware files, so one in ten
signed files on a PC is genuine CA-certified signed malware (and that's a
lower bound based on what's detectable by the MMPC scan, any decently-infected
machine will have scanning disabled or subverted so it won't register).  From
the report:

  Of signed detected files, severity of the threats tended to be high or severe,
  with low and moderate threats comprising a much smaller number of files:

  Severe  50819
  High    73677
  Moderate 42308
  Low     1099

So there you go, signing definitely does provide a "trust and quality
assurance mechanism".  If it's a CA-certified signed rootkit or worm, you know
you've been infected by the good stuff.

Peter.