Sagewire Logo

Signed Applets and different JVMs

2 Message(s) by 2 Author(s) originally posted in java security


From: phil Date:   Monday, October 30, 2006
Folks,

Apologies in advance if I'm asking stupid questions here but JAVA is
way outside my area of expertise and I really need some help.

We provide web-based applications that, in a few cases include a small,
signed JAVA applet to allow information to be posted across domains.
The applet code is really quite simple (even for me!) but one of our
clients is asking us to guarantee that the applet will work across The
Mircosoft JVM and Sun JVMs 13., 1.4 and 1.5 - I'm really not sure if we
can say this and am trying to avoid having to go through the pain of
testing it on all environments.

We've signed the applet using jarsigner for Sun (a .jar file ) and
using signcode for Microsoft (a .cab file) but I'm not sure if this
enough to do the trick.

Spedific questions:

* When did the JAVA Plug-in switch from the JDK 1.1 security model to
JDK 2.0 security model?
* Will the signed .jar file work in all of these version s of the Sun
JVM?
* If not, can we ude JAVAScript to determine which version of the
pulg-in is being used and then include a different applet tag for each
version?

I'm really a bit at a loss here so any information at all on how to do
all this'd be greatly appreciated.

Thanks, in advance for your help,

Phil (JAVA newbie!)


From: Ben_ Date:   Monday, October 30, 2006
one of our
clients is asking us to guarantee that the applet will work across The
Mircosoft JVM and Sun JVMs 13., 1.4 and 1.5 - I'm really not sure if we
can say this and am trying to avoid having to go through the pain of
testing it on all environments.



How do you intend to assure you customer it works without testing ?

We have signed the applet using jarsigner for Sun (a .jar file) and
using signcode for Microsoft (a .cab file) but I'm not sure if this
enough to do the trick.



Microsoft VM will be out of support by the end of 2007
(http://www.microsoft.com/mscorp/JAVA/), so you will probably want to limit
investment on this technology.
For discussion of Authenticode vs. JAVA signature , see the "Potential
Upgrade Issues" at
http://JAVA.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/upgrade-guide/index.html.

Spedific questions:
* When did the JAVA Plug-in switch from the JDK 1.1 security model to
JDK 2.0 security model?



The product archive is here: http://JAVA.sun.com/products/archive/.
The readme of 1.1.1_006 says it's designed for JDK 1.1 and 1.2. So I assume
using one or the other specification depends on what the developer
advertises as JVM requirement in its page.

* Will the signed .jar file work in all of these versions of the Sun
JVM?



I assume signature verification'd work. That the applet'd work is
another story: if the developer uses features only present in a certain
release , then it won't. So, ask the developer to assess this.

* If not, can we ude JAVAScript to determine which version of the
pulg-in is being used and then include a different applet tag for each
version?



The developer advertises its requirements in the HTML page and the JAVA
Plug-in can download and install a newer release if necessary.
See object/embed tag usage in
http://JAVA.sun.com/j2se/1.5.0/docs/guide/plugin/developer_guide/using_tags.html.

I'm really a bit at a loss here so any information at all on how to do
all this'd be greatly appreciated.



I think the JAVA Plug-in FAQs answers all questions above and much more:
http://JAVA.sun.com/products/plugin/reference/faqs/index.html.
Microsoft's Transition Guide will also prove helpful
(http://www.microsoft.com/mscorp/JAVA).

Thanks, in advance for your help,
Phil (JAVA newbie!)


>



Next Message: JCE 1.2.2 - "Cannot set up certs for trusted CAs"


Blogs related to Signed Applets and different JVMs

j2me for beginers
a configuration specifies a jvm and some set of core apis for a specific family ... several different profiles are being developed under the java community ... known for its ability to safely run downloaded code like applets. this is a ...

1 Frimaire CCXV
Well, I finally got around to doing it -- I signed up for an i-name on 2idi. ... and Java applet support in Netscape made the first round of rich client ... It kept the entire thing really fun and refreshing -- different parts of your ...

JNI Interview Questions - Part2
5)What is necessary to have an applet call a native method? ... using JNI (call C/C++ code from java, embed jvm in C/C++ code) and ways to. ... EJBs are supposed to be portable between different app servers who comply with the Sun's ...

Java/J2ee Interview Companion
In the last 5 years of contracting, I have worked for 5 different organisations ... locally within the same JVM using Java’s form of pass-by-reference, ... A signed applet can become a trusted applet, which can work outside the sandbox. ...

SCJP Question & Answer
Component; Panel; java.applet.Applet; Dialog; Frame; MenuComponent ... Believe me, certification exam is completely different from a real project experience. ... The programmer cannot force the JVM to free the memory used by an object. ...

Java FAQ
Here are a few tips on some of the sticky points of signing applets. ... I run 2 different Java Programs on one machine at the same time, both of ... Obviously you would need a different JVM or Hotspot. Java never lets you discover how ...


Programming | Sports | Autos

copyright 2006
Valid XHTML 1.0 Transitional