Microsoft releases security source code

Posted on 25 Jun 2002 at 17:51

Microsoft has said it will publish the source code for a new security system, currently titled Palladium, which will be introduced into a future version of Windows, possibly as early as 2004.

The reason behind this, according to product manager Mario Juarez, is one of trust. 'We will be publishing the source code because people will need to trust this,' he said. 'We are trying to be transparent in all this,' commented Microsoft's Jim Allchin. To this end, the encryption algorithm used in Palladium was published from the outset, precisely so that it could be seen to be trustworthy.

All this seems a far cry from the antitrust case, in which Microsoft is staunchly defending itself against demands from the nine non-settling states: that it should reveal source code for Windows. The same Jim Allchin argued that this would make sensitive information available to hackers and virus writers. 'Providing such information just makes it a little easier to compromise the security mechanisms in Windows,' he said. However, professor Andrew Appel of Princeton University retorted that the idea of 'security through obscurity' is a fallacy.

Palladium is a combination of both hardware and software technologies that sees Microsoft walking its talk of taking security seriously. Processor manufacturers Intel and AMD have signed up to the project to produce 'security' chips that will in turn mean new motherboards and even new PCs that incorporate the technology. This could mean more expensive PCs, but the benefits that Palladium is designed to offer include the prevention of unauthorised programs executing themselves (protection from worms and viruses), spam filtering, digital rights management (as well as publishers being able to control the use of their copyright media, individuals could prevent emails they send being copied or forwarded by others, or set 'expiry' dates for their documents), the ability to secure your data both on your own PC and externally with secure 'agents' and the ability to know where data sent to you was created and by whom.

Author: Matt Whipp