You say read this:

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

I have read it. I have also read the TCPA specification. I have also read Seth Schoen's notes at

http://vitanuova.loyalty.org/2002-07-05.html

My conclusion from that reading is that Anderson needs to go back to the TCPA spec and read it again. Schoen is better informed and is clear about something that seems to confuse others "Palladium is distinct from TCPA and has technical differences from TCPA."

Many people seem to be repeating information that is of dubious accuracy. There may be an excuse for that where Palladium is concerned since Microsoft has not revealed full details, but the TCPA specification has been published and is available on the web, so there is no excuse for making incorrect statements about TCPA. Anderson has severely damaged his credibility as far as I am concerned, the so-called "TCPA/Palladium FAQ" is far below the quality I would expect from a serious security researcher.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/96/15779#15779