Dazo-org/zerovm — Issue #11: Prevalidation 
Author: camuel
Created: 2011-11-29 23:17:13+00:00
State: open
Labels: DESIGN, FEATURE, MAJOR, RESEARCH

Validating NEXE is long and resource consuming process that can take up to a few seconds for a large NEXE. Many NEXEs will be reused numerous times and hence there is no point re-validating them each time prolonging latency. So the idea of prevalidating repetitious NEXE just once and then just to run it without validation.

Naive approach would be to run ZeroVM in validation mode and let it mark the NEXE as validated (for example by custom file attribute) and then when ZeroVM gets NEXE to execute it will check the attribute and if marked as validated then skip validation check. However, this approach is too fragile and prone to human error, for example it could be possible that file attributes could be easily manipulated by someone untrusted for validation decision. Such capability could be blocked or may be even absent now but could be added/broken/forgotten in future. Hence more robust mechanism is needed.

I suggest using RSA signature for the marking (it is in fact signing). ZeroVM will contain an embedded private key generated by build or deployment script, then ZeroVM will sign NEXE with signature going into attribute. Every NEXE contains MD5 hash as its etag value, so it would be easy to detect tampering with valid signature. OpenSSL could be used as cryp-algorithms-library.

On separate note Swift will take care to prevent any access of ordinary users to signature as a second line of defense.

What you think? Any other suggestions?