# Trusted path

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Trusted_path
> Markdown URL: https://mediated.wiki/source/Trusted_path.md
> Source: https://en.wikipedia.org/wiki/Trusted_path
> Source revision: 1167046004
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

A **trusted path** or **trusted channel** is a mechanism that provides confidence that the [user](/source/User_(computing)) is communicating with what the user intended to communicate with, ensuring that attackers can't intercept or modify whatever information is being communicated.

The term was initially introduced by [Orange Book](/source/TCSEC).[1] As its security architecture concept, it can be implemented with any technical safeguards suitable for particular environment and risk profile.

## Examples

### Electronic signature

In [Common Criteria](/source/Common_Criteria)[2] and [European Union](/source/European_Union) [electronic signature](/source/Electronic_signature) standards *trusted path* and *trusted channel* describe techniques that prevent interception or tampering with sensitive data as it passes through various system components:

- *trusted path* — protects data from the user and a security component (e.g. PIN sent to a [smart card](/source/Smart_card) to unblock it for [digital signature](/source/Digital_signature)),
- *trusted channel* — protects data between security component and other information resources (e.g. data read from a [file](/source/Computer_file) and sent to the [smart card](/source/Smart_card) for signature).

### User login

One of popular techniques for password stealing in [Microsoft Windows](/source/Microsoft_Windows) was [login spoofing](/source/Login_spoofing), which was based on programs that simulated operating system's login prompt. When users try to log in, the fake login program can then capture user passwords for later use. As a safeguard [Windows NT](/source/Windows_NT) introduced [Ctrl-Alt-Del](/source/Ctrl-Alt-Del) sequence as [secure attention key](/source/Secure_attention_key) to escape any third party programs and invoke system login prompt.[3]

A similar problem arises in case of websites requiring authentication, where the user is expected to enter their credentials without actually knowing if the website is not [spoofed](/source/Spoofing_attack). [HTTPS](/source/HTTPS) mitigates this attack by first authenticating the server to the user (using [trust anchor](/source/Trust_anchor) and [certification path validation algorithm](/source/Certification_path_validation_algorithm)), and only then displaying the login form.

## References

1. *3.2.2.1.1 **Trusted Path**: The TCB shall support a trusted communication path between itself and user for initial login and authentication. Communications via this path shall be initiated exclusively by a user.*, [Orange Book](/source/TCSEC)

1. ISO/IEC 15408-1, *Information technology — Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model*, 2005

1. Yee, Ka-Ping (2002). "User Interaction Design for Secure Systems". pp. 278–290. [CiteSeerX 10.1.1.65.5837](https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.65.5837)

---
Adapted from the Wikipedia article [Trusted path](https://en.wikipedia.org/wiki/Trusted_path) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Trusted_path?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.