Contents

• Examples of signed pages
• Tools
• Vendors
• Other sources of information

Examples of signed pages

These are signed Java applets I know of that are publicly available on the Web. If you know of other examples please let me know.

I wrote a set of signed applets for The Analytical Engine Online, a Computer Science textbook and web site. Each applet allows the user to save/load their work to/from their local hard disk, and are signed for both Internet Explorer and Communicator/Navigator. (Before you ask, I can't give out the source code for these.)

• Main page for The Analytical Engine Online: <http://www.pws.com/aeonline.html> (will forward to <http://www.brookscole.com/compsci_d/templates/student_resources/0534953654_deckerhirchfield/aeonline/course/index.html>)
• Logic Simulator applet: in lab 7.2
• Expression parser applet: in lab 6.2
• CPU Simulator applet: in lab 7.5

The signtool code signing tool's download page: <http://developer.netscape.com/software/signedobj/jarpack.html>. signtool for Windows 95 (as of 3/7/03) is at <http://developer.netscape.com/software/signedobj/signtool13/signtool13WIN95.zip>.

Signing Software with Netscape Signing Tool 1.1 (as of 3/7/03): <http://developer.netscape.com/docs/manuals/signedobj/signtool/index.htm>

The Microsoft Java SDK 2.02, which contains cabarc.exe, signcode.exe, chktrust.exe, signer.dll and javasign.dll (as of 9/3/99): <http://www.microsoft.com/java/download.htm>

Vendors

VeriSign, at <http://www.verisign.com/>, is a full-service on-line vendor of software signing IDs. They also provide their customers with a timestamping service at <http://timestamp.verisign.com/scripts/timstamp.dll> (this URL can only be used by signcode as shown above). Now that they've stopped issuing $20 Class 2 certificates they're a bit pricey ($400 times two if you want to support both Navigator and Explorer). Other useful VeriSign pages:

• About Digital IDs(includes information on timestamping): <http://digitalid.verisign.com/developer/help/softpub_intro.htm>
• General Information about Digital IDs for Software Publishing: <http://digitalid.verisign.com/developer/help/aboutdid.htm>
• Software Developer Digital IDs for Netscape Object Signing: <http://www.verisign.com/library/guide/developer/signing/index.html>

Thawte Certification, at <http://www.thawte.com/>, is a recently established CA. Their (latest) claim to fame is that you only need one $200 (as of 9/3/99) certificate for both Netscape Object Signing and Microsoft Authenticode. For more info on this, see <http://www.thawte.com/certs/developer/diffapps.html>. They have a number of other useful pages:

• Free test developer certificates: <https://www.thawte.com/cgi/server/test.exe>
• Developer Certificates: <http://www.thawte.com/certs/developer/contents.html>
• About Code Signing: <http://www.thawte.com/certs/developer/about.html>
• General Crypto FAQs: <https://www.thawte.com/support/crypto/contents.html>

SECUDE is a new certificate authority; when last I checked they didn't seem to provide certificates for signing software: <http://www.secude.com/trustfactory/>

Belsign is a new CA which apparently can generate software signing certificates for Navigator; they're at <http://www.belsign.com/> (I don't know anything more about them).

Other CAs:

• Entrust: <http://www.entrust.com/>
• Entropia CA: <http://www.entropia.com/ca/>

Microsoft has a number of useful web pages:

• General developer web site: <http://msdn.microsoft.com/default.asp>
• Software development kits: <http://msdn.microsoft.com/developer/sdk/>
• Java information: <http://www.microsoft.com/java/>
• Microsoft SDK for Java 3.2 Documentation: <http://www.microsoft.com/java/sdk/32/start/jsdk_start_page.htm>
• Signing a Cabinet File with Java Permissions using Signcode: <http://www.microsoft.com/Java/sdk/32/pg/pg_pkgdist_signcode_4.htm>
• SecurityExceptionEx Exception Running a Java Applet:<http://support.microsoft.com/support/kb/articles/q175/6/22.asp>
• Microsoft security classes overview: <http://www.microsoft.com/Java/sdk/32/packages/ref_security_package_o.htm>
• Trust-Based Security for Java: <http://www.microsoft.com/Java/sdk/32/pg/pg_secty_javasec.htm>

Netscape also has a number of good pages:

• Signing Software with Netscape Signing Tool 1.1: <http://developer.netscape.com/library/documentation/signedobj/signtool/index.htm>
• Java Capabilities API talks about the code you'll need to add to your applet to request privileges under Netscape: <http://developer.netscape.com/library/documentation/signedobj/capsapi.html>
• The JAR Format: <http://developer.netscape.com/library/documentation/signedobj/jarfile/jar.htm>
• Using JAR Installation Manager for SmartUpdate: <http://developer.netscape.com/library/documentation/communicator/jarman/index.htm>
• Object Signing FAQ: <http://developer.netscape.com/support/faqs/objfaq.html>
• Object Signing Resources: <http://developer.netscape.com/software/signedobj/index.html>
• Security - Frequently Asked Questions: <http://developer.netscape.com/support/faqs/champions/security.html>
• Netscape Object Signing: Establishing Trust for Downloaded Software: <http://developer.netscape.com/library/documentation/signedobj/trust/owp.htm>
• Netscape System Targets: <http://developer.netscape.com/docs/manuals/signedobj/targets/index.htm>
• Activating Codebase Principals: <http://developer.netscape.com/library/technote/security/sectn2.html>
• Extending the Validity Period of a CA Certificate: <http://help.netscape.com/products/server/certificate/cacertdoc/>
• Security Preferences for Communicator: <http://developer.netscape.com/docs/technote/security/sectn3.html>
• Java Support in Netscape Navigator and Communicator (table giving Navigator's support for various Java features on different operating systems): <http://developer.netscape.com/docs/manuals/communicator/javajdk.html>
• Java Support in Netscape Navigator and Communicator (somewhat different version of same document): <http://developer.netscape.com/source/oji.html>
• Generating Test Object-Signing Certificates: <http://developer.netscape.com/docs/manuals/signedobj/signtool/signcert.htm>.

And of course, there's always Sun:

• Main Java site: <http://java.sun.com/>
• Java Security API: <http://java.sun.com/security/>
• Frequently Asked Questions - Applet Security: <http://java.sun.com/sfaq/>
• JDK 1.1.x - Signed Applet Example (this shows Sun's applet signing technology): <http://java.sun.com/security/signExample/>
• Signed Applets, Browsers, and File Access is an article on JDK 1.2 security: <http://developer.java.sun.com/developer/technicalArticles//Security/Signed/index.html>
• Sun Java Plugin page: <http://www.javasoft.com/products/plugin/index.html>
• Using Signed Applets with the Java Plugin: <http://www.javasoft.com/products/plugin/1.1.1/docs/signed.html>
• javakey - The Java Security Tool: <http://www.javasoft.com/products/jdk/1.1/docs/tooldocs/solaris/javakey.html>
• Using Javakey: <http://www.javasoft.com/security/usingJavakey.html>

Articles and FAQs

For a good overview of this process, along with information on Netscape's Capabilities API, see Joe Bowbeer's article Signing Applets for Internet Explorer and Netscape Navigator: <http://ourworld.compuserve.com/homepages/jozart/article/index.html>. (Note: this article was in the June 1997 issue of JavaUniverse, which has since gone the way of all flesh. The author has reposted it on his own site.)

Other articles:

• The WWW Security FAQ at <http://www.w3.org/Security/Faq/>
• Derrick Oswald has an article on Java and browser security at <http://www.capitalnet.com/~oswald/Derrick/>
• Ted Landry maintains the Java Signing FAQ at <http://www.fastlane.net/~tlandry/javafaq.txt>
• Outsource Laboratories has a page on signing applets for Navigator at <http://www.olabs.com/java/security/netscape/index.html>
• Jett Marks at Daugherty Systems has an overview article on signing applets at <http://speedy.daugherty.com/~marksj/TrustedApplets.html>
• Samizdat Productions has a list of Java system properties (useful for cross-platform development) at <http://www.tolstoy.com/samizdat/sysprops.html>