bugtraq - Re: OpenBSD Paradox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 15 Dec 2010 13:22:43 -0700
From: Theo de Raadt <deraadt@....openbsd.org>
To: musnt live <musntlive@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: OpenBSD Paradox

> We has OpenBSD tell us:
> 
> "We have never allowed US citizens or foreign citizens working in the
> US to hack on crypto code"
> http://marc.info/?l=3Dopenbsd-tech&m=3D129237675106730&w=3D2

That statement remains true.

IPSEC isn't 100% crypto; it is a complex layered subsystem with many
other elements to it.  In particular our IPSEC stack also supports the
IPCOMP sub-protocol -- the same management framework moves compressed
ip packets through the framework.  This means that there are parts of
the IPSEC stack that are 'dual use'.  There are also many other parts
of IPSEC which are related to non-encrypted encapsulations.

Our project permitted American developers to work on any part of the
tree which was not specifically cryptography; in this particular
instance that includes the parts of IPSEC which are 'dual use' or 'not
related to cryptography'.  We did not permit them to work on the
crypto-specific parts.

> And is yes on the same thread, we have the presumed innocent until
> proven is guilty party conflict with team OpenBSD:
> 
> "I will state clearly that I did not add backdoors to the OpenBSD
> operating system or the OpenBSD crypto framework (OCF)."
> "The timeline for my involvement with IPSec can be clearly
> demonstrated by looking at the revision history of:
>       src/sys/dev/pci/hifn7751.c (Dec 15, 1999)

This is a driver for a crypto chip, but the driver itself does not do
any cryptography.  The driver moves things around so that the hardware
can do the cryptography.

> 	src/sys/crypto/cryptosoft.c (March 2000)

revision 1.38
date: 2003/02/21 20:33:35;  author: jason;  state: Exp;  lines: +1 -6
There's no cleaning necessary for deflate compression, so remove it from
the switch.

Note, the commit message talks about compression.

> What is this time to stop the press!
> 
> OpenBSD - "We is never allow Americans to work on crypto move is along"
> Perp - "Is when I worked on OpenBSD crypto..."
> 
> Is we here see Paradox? For to this we create the BSD Paradox:
> 
> Paradox - A paradox is a true statement or group of statements that
> leads to a contradiction or a situation which defies intuition.
> 
> OpenBSD Paradox - There is no backdoor - that we knowingly admit to is
> know of. Is

That is a simplistic viewpoint held by your simplistic mind.