Re: OpenBSD Paradox

[Rob Wilcox <robertwilcox () gmail com>]

Ok, so there is suspicion that IPSEC and maybe some related code has
been backdoored.  How to validate?  We have some smart folks on this
board, what methods do the gurus have to impart to the little people?
We are not stupid either, but sometimes a clue can help a brother
out...

-Rob

On Wed, Dec 15, 2010 at 3:22 PM, Theo de Raadt <deraadt () cvs openbsd org> wrote:
> > We has OpenBSD tell us:
> >
> > "We have never allowed US citizens or foreign citizens working in the
> > US to hack on crypto code"
> > http://marc.info/?l=3Dopenbsd-tech&m=3D129237675106730&w=3D2
>
> That statement remains true.
>
> IPSEC isn't 100% crypto; it is a complex layered subsystem with many
> other elements to it.  In particular our IPSEC stack also supports the
> IPCOMP sub-protocol -- the same management framework moves compressed
> ip packets through the framework.  This means that there are parts of
> the IPSEC stack that are 'dual use'.  There are also many other parts
> of IPSEC which are related to non-encrypted encapsulations.
>
> Our project permitted American developers to work on any part of the
> tree which was not specifically cryptography; in this particular
> instance that includes the parts of IPSEC which are 'dual use' or 'not
> related to cryptography'.  We did not permit them to work on the
> crypto-specific parts.
>
> > And is yes on the same thread, we have the presumed innocent until
> > proven is guilty party conflict with team OpenBSD:
> >
> > "I will state clearly that I did not add backdoors to the OpenBSD
> > operating system or the OpenBSD crypto framework (OCF)."
> > "The timeline for my involvement with IPSec can be clearly
> > demonstrated by looking at the revision history of:
> >       src/sys/dev/pci/hifn7751.c (Dec 15, 1999)
>
> This is a driver for a crypto chip, but the driver itself does not do
> any cryptography.  The driver moves things around so that the hardware
> can do the cryptography.
>
> >       src/sys/crypto/cryptosoft.c (March 2000)
>
> revision 1.38
> date: 2003/02/21 20:33:35;  author: jason;  state: Exp;  lines: +1 -6
> There's no cleaning necessary for deflate compression, so remove it from
> the switch.
>
> Note, the commit message talks about compression.
>
> > What is this time to stop the press!
> >
> > OpenBSD - "We is never allow Americans to work on crypto move is along"
> > Perp - "Is when I worked on OpenBSD crypto..."
> >
> > Is we here see Paradox? For to this we create the BSD Paradox:
> >
> > Paradox - A paradox is a true statement or group of statements that
> > leads to a contradiction or a situation which defies intuition.
> >
> > OpenBSD Paradox - There is no backdoor - that we knowingly admit to is
> > know of. Is
>
> That is a simplistic viewpoint held by your simplistic mind.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/