Certicom CodeSign Enables Secure Code Distribution
MISSISSAUGA, Ontario -(July 21, 2004)- Certicom Corp. (TSX: CIC), the authority for strong, efficient cryptography, today announced the release of Certicom CodeSign, a standards-based code signing application for firmware. Accessed through a web browser, CodeSign enables organizations like device manufacturers, wireless service providers and cable operators to remotely distribute over-the-air or wired network firmware updates and applications without fear of the introduction of any rogue code or viruses, thereby protecting content and revenue. In minutes, developers can quickly and easily install CodeSign to remotely provision devices, eliminating the need to upgrade software manually or replace devices.
Downloading malicious code in the process of updating code is a serious threat to organizations if users cannot verify its source or integrity. CodeSign overcomes these challenges by providing a mechanism to digitally sign firmware and then wrap both the code and the digital signature in a cryptographic envelope. CodeSign provides assurance that code has not been altered, infected or corrupted, and that it comes from a trusted source.
For some time, code signing has been used in the software arena, however CodeSign is a tool designed specifically for firmware. In developing CodeSign, Certicom drew on its extensive experience in embedding security on small devices and working with the industry’s leading manufacturers. The result is a commercially supported application that supports a wide range of platforms and standards, such as 802.16/WiMAX, PCS/SCADA and CableLabs DOCSIS, and eliminates the need for extensive integration work. Its Java-based architecture provides the flexibility to accommodate changes, even modifications of industry standards.
“The Cabir worm demonstrated that mobile phones are the next big target for hackers. The Certicom CodeSign application will help device manufacturers and wireless service providers safeguard their firmware, alleviate the risk of service interruption, and provide a secure environment for updating firmware over-the-air with mProve,” said Carla Fitzgerald, vice-president, marketing at Bitfone, the leading provider of software update solutions for mobile phones. “CodeSign is an essential component for achieving productive, efficient trust models for mobile device management.”
Although CodeSign is primarily designed for use in mobile devices and cable systems, its use extends to any application where there is a need to remotely update firmware and applications, such as in the gaming industry. For example, CodeSign could be used to enforce internal security to prevent any modifications after code has been audited and signed off.
“Certicom has years of experience developing standards-based cryptography toolkits optimized for constrained environments. With CodeSign, we’ve channeled this expertise into an application that allows developers to quickly add digital signatures,” said Roy Pereira, vice-president, marketing and product management at Certicom. “CodeSign is a sophisticated but easy-to-use tool that is an important component in trusted computing platforms. It helps systems operators, device manufacturers and other organizations protect content, and save time and money.”
CodeSign offers security and interoperability through a standards-based design:
* Standardized PKCS #10 requests for Code Verification Certifications submission to third party Certificate Authorities such as VeriSign, Thawte, GeoTrust or enterprise Certificate Authorities.
* PKCS #1, 5, 7, 8, 10, 12, X.509 v3 certifications
* IETF and ANSI
To complete the security solution, device manufacturers and network operators need to embed PKI functionality to verify the signatures. Certicom’s Security Builder PKI toolkit, in combination with Certicom CodeSign, provides that end-to-end solution.
Availability
Certicom CodeSign is available immediately and is priced with a license fee. For more information, visit http://www.certicom.com/codesign.
About Certicom
Certicom Corp. (TSX:CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the U.S. Government’s National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and XM Radio. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit www.certicom.com.