Why Linux must embrace trustworthy computing

The GPLv3 debate continues.

At this point the debate is framed as a simple question: are you for or against DRM? But as Linus has been trying to point out with characteristic reasonableness, there is much more to the issue than RMS makes out..

As a security specialist I see the issues from a somewhat different perspective. Whether justified or not a large part of the Linux brand image rests on its reputation for security. Trustworthy computing represents the next generation of security technology. If Linux adopts license terms that forclose support for trustworthy computing it is almost certain to be overtaken in key markets by platforms that do.

While DRM and 'trusted computing' are often treated as if they were synonymous they are in fact very different. Strong DRM requires trustworthy hardware but trustworthy hardware is good for much more than DRM.

Take the perenial problem of how to store private keys for an SSL server for example. A typical Apache server configuration is to store the private key in a file on disk. This means that anyone with access to the backup tape can read the private key value. The file can be password encrypted but that only postpones the problem: how do we protect the password?

The best answer to this problem today is to use SSL accelerator hardware that provides built in hardware protection for private keys. But this is an expensive solution if you only need security and not extra speed.

A trustworthy computing platform would provide the ability to lock down the private key so that it could only be accessed by the Apache executable and could not be exported off the machine in any circumstance.

So what you might say, Linux is used for more than just Web servers? And here is the bigger point: in the future every major server application is going to involve cryptography and thus the need for key management. Email is going to be signed with DKIM, synchronous protocols secured with SIP and at some point even DNSSEC will get deployed. And this before we even get started on Web services.

As the use of cryptography becomes ubiquitous the number of private keys begins to proliferate. And as cryptographic based security controls are used to defeat professional Internet crime a whole new set of incentives for stealing private key files is going to be created.

Securing private keys is just one example of a situation where trustworthy computing is invaluable. Another example is the famous question posed by Ken Thompson in his Turing Award speech: how do we know if the system has been compromised or not? The problem of rootkits is not unique to Windows, it began on Unix. If a system has a rootkit installed it is impossible to tell that it has been compromised. Without a trustworthy computing base to work from even programs like tripwire can be fooled. Tripwire can only verify the file system as it is visible to tripwire. If a rootkit has been installed that view may have been corrupted.

Yet another example is document level security. Traditional operating system security schemes control access to the file storage system rather than the documents stored in the file storage system. This allows Alice to set the permissions on her home directory to stop Bob reading her confidential files. But once Alice sends a copy of a file to Carol she is now depending on Carol to protect it correctly. The computer systems used by the military to protect access to classified information take a more robust approach. The security classification (label) is applied to the document itself. Encrytion is used to ensure that the classified document can only be read on approved computers running approved applications that enforce the access restrictions placed on that document. When Alice sends this document to Alice the access restrictions follow the document.

This type of system will become a regulatory requirement in an increasing number of applications and jurisdictions. HIPPA already requires healthcare providers to control access to confidential patient data. Sarbanes-Oxley requires companies to attest that the information systems used to prepare their accounts were trustworthy.

This type of system is also identical to a DRM system.

Security is the journey, not a destination. Microsoft is spending several billion dollars a year on security. Over the past five years they have hired many of the most prominent names in the field. That is not in itself a guarantee of success: the Yankees spent a squillion dollars on its team last year and had little to show for it. But their opponents would have done much worse if they had decided to leave their heavyiest hitters on the bench because of a theological dispute.

And a theological dispute is unfortunately what the GPLv3 issue is likely to become. Even though the target is DRM the scope of the clause arguably covers every form of trustworthy computing and quite possibly more.

It does not help matters here that the discussion seems to be largely between RMS and Linus. Some of RMS's early salvos look to me as if they might be aimed more at trying to peel off Linux developers from the Linus camp and rally them to what RMS beleives is the true, pure cause. Fine tatics for a political activist, a lousy way to help promote the cause of developing an open source operating system with state of the art security.

And these are the real stakes: if we want to secure the Internet the race must remain competative. If Linux is forced to keep its heavy hitters on the bench there will be less incentive for the opposition to field their A team and the supporters of both sides will lose.