The objectives of "TrustWeb - Security in the WWW, mutual impact of ETS and WWW" are to review World Wide Web (WWW) security status with respect to the European Trusted Services (ETS); assess impact of new WWW-relevant technologies on security developments; and investigate impact of ETS on the WWW and also the reverse impact.
Investigation of risks, vulnerabilities and shortcomings in the WWW tools was undertaken in the first stage of the research, which was then followed by an assessment of approaches for attack prevention, detection, and reporting mechanisms. We have provided some of the results from the first stage in the second deliverable, whereas the global summary is provided in this final report, namely its first section. Yet we believe that such reports can provide a useful guidance only for about a year after their publication, due to the fast development in the field. Although there definitively is a need for such summarising reports, we are of the opinion that development of a regular service for a WWW incident reporting mechanism should be the ultimate target in this area. Therefore a WWW-specific incident reporting scheme - BEWARE (Brisk European Web Alert REporter) - was suggested in our first report, following our analysis in first stages of our research. However, we have to note that we only offered a high-level assessment of possible means and alternatives for the implementation of such a scheme with pros and cons of various scenarios as a detailed analysis was out of this project's scope.
The second delivery reflected the third, and partly also fourth, stage of our research. One of the points made here is that one has to take reasonable precautions in securing a workstation and using a security services-aware WWW browser in order to be able to rely on security services available for and on the WWW. WWW security is crucial to the success of ETS services, primarily from the customers' point-of-view. ETS might be in some aspects very beneficial to the WWW security, but hardly anyone will rely on ETS if WWW insecurity compromises the service. Aspects of WWW client and server vulnerabilities, and maybe also partly of protocols' vulnerabilities, should be solved primarily by introducing a WWW-specific incident reporting system. Our second report provides a critical review of WWW browsers' security features and implementation of public-key cryptography use. We examined the security problems related to the use of WWW as a user interface to access to ETS services. We then discussed whether one really has to rely on the cryptographic software in the browser in order to access WWW securely (e.g., for the access to ETS). This is important, because cryptographic functions often need to be separated from both the user interface and the communications routines. ETS could possibly provide security functionality independently of the large software manufacturers. We discussed the operations of one such service implemented with Java applets. A part of the second report reviews potential TTP (ETS) operations that would be useful to securing WWW and information communicated via WWW. It is still sometimes incorrectly understood that the only business of a TTP is key certification as in the role of a CA. However, there are other services in the support of security that a third party can provide. We discuss those that we assessed as relevant to WWW applications in more detail, and this discussion is further extended in this final report.
The final report starts with a comprehensive section dedicated to a brief summary of research and investigation on WWW security aspects, primarily on those relevant to Trusted Third Parties (TTP). We discuss relevant WWW security issues in this section in some depth, as their comprehension is essential to reviewing further research results. We introduce a basic classification of WWW security issues, which then serves as a basis for undertaking more detailed discussions on individual issues. These start with a review of webserver security aspects, followed by a review of two protocols most relevant to our research topic, the Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols. Code-downloading problem in general and problem with proprietary solutions in WWW browsers are then discussed (while the core of discussions on browser issues is in the second report). Mobile code problems are discussed in some depth, from an overall conceptual point-of-view, followed by an overview of Java, JavaScript and ActiveX. This section is concluded by a review of the Authenticode technology.
While the third section briefly reviews our suggestions for the WWW-specific incident reporting scheme (BEWARE), the fourth section partly follows the discussion of some extended ETS services on WWW from our second report. It focusses on the applicability of ETS services as such (e.g., archiving-related services like the Data Certification Service and the Notary Archiving Service) and also some suggestions for WWW services that could benefit from using ETS services, such as non-repudiation of WWW posting or of origin/delivery for filled forms. However, this section also outlines the potential for and concept of security tags in HTML, application of the public-key certificate management to the Internet/WWW environment, as well as other issues.
The fifth section undertakes a bit more focussed assessment in one of the areas discussed in media quite often - payments in the electronic commerce. This is also supplemented by a comprehensive discussion of the relevant issues in the appendix A - PKI in Electronic Commerce - Position Paper.
Some of the other relevant issues are discussed in the sixth section of the report. This reviews, e.g., the need for an assurance of the WWW clients' (browsers') conformance to the WYSIWYS (What You See Is What You Sign) property, applicability of the Microsoft CryptoAPI to the relevant WWW-ETS problems, security issues in the Hypertext Markup Language (HTML) version 4.0, metadata association, new generation of the Internet Protocol, etc.
Appendices to this report are the above mentioned position paper on the Public-Key Infrastructure issues in the Electronic Commerce (Appendix A), a brief overview of Public-Key Cryptography Standards (PKCS) relevant to our research topic in the Appendix B, followed by a list of acronyms used throughout this report in the Appendix C.
We have discussed ETS operations/services that we assessed as particularly useful for securing WWW itself and also the data communicated over WWW. While pointing out only the relevant services, we believe that we have shown that there is much more to TTP functionality than just key certification or even broader key management services. Our research has revealed the breadth of the security issues in the WWW technologies, and we emphasise our belief that there is a serious need for a WWW incident reporting mechanism of the BEWARE (Brisk European Web Alert REporter) type.
While investigating the mutual impact of WWW technologies and ETS, the picture that became much clearer to us is: WWW security has many problems, out of which only some can be solved with the use of ETS. On the other hand, ETS can greatly benefit from the developments of the WWW, where only secure WWW can provide useful interface and communication means for ETS services.