http://thread.gmane.org/gmane.os.openbsd.tech/22557
This appears to be some serious FUD, but if true could have some serious implications for IPSEC stacks in all kinds of equipment.
-wil
Does anyone remember the last time a law enforcement agency had
someone sign a 10 year NDA on a backdoor?
"Oh, times up, I can post it on Facebook now. Cool."
22:42 <@smartboy> curious what the guy's motives really are. pretty sure the
NDA expiration on putting a backdoor into software for the
FBI would be "when you're dead"
22:42 <@smartboy> or "when you'd like to be dead"
/kc
Someone is confusing FBI with NSA, methinks.
And yes, if this is the kind of thing not talked about, "NDA"s expire when you do.
But seriously ... this would seem to be the kind of code that Smart People should be doing security audits on Just Because.
So rustle up a couple of PostDocs, and give them an idea for a Thesis, and yer set.
Aloha,
Michael.
More to the point, I think it wouldn't be an NDA, but a security
classification on the knowledge of the backdoors, and probably one not
subject to automatic downgrading.
Please pardon my ignorance on the matter as I am not involved in any way
with Open Source development, but it stands to reason that anything of this
sort would have been scrutinized by the many developers involved with
OpenBSD and surely would have been discovered at some point. And to further
that point, is this not something that can be verified now if this code is
still in the public domain? Or is writing a crypto stack such an esoteric
task that only a relegated few can possibly decipher the inner workings?
Not that I don't love a good government conspiracy theory, and yes I do
believe there are a fair amount of backdoors in most code (including that of
many private and publicly held corporations)... but open source? Just seems
unlikely to me based on my limited understanding...
Stefan
In sober honesty, I doubt that there are any backdoors in any *BSD
crypto stack that is really open source -- modulo the issues set out in
"On trusting trust". But while I doubt it, that doesn't mean that I'm
certain there are none.
At this point, a real Conspiracy Theorist (TM) would ramble on about how
all the *BSD crypto stack folks either were co-opted by the NSA or were
under threat of death or worse if they talked.
update.. hoax it appears.
http://www.itworld.com/open-source/130820/openbsdfbi-allegations-denied-named-participant
Stefan,
I wouldn't want to debate whether or not this specific theoretical "back
door" exists (since it seems to be less than marginally credible at this
point,) but it is more plausible than you might think.
I believe that most of us a fairly static situation that we think of when
we hear "back door" as it pertains to technology and software. This,
however, is an alleged "back door" (though perhaps describing it as a
weakness is less likely to elicit tin-foil-hat-type predictions) in the
crypto. There are tons of brilliant developers in the open source *and*
commercial community that could spot a back door in the *code* in a
heartbeat. The alleged weakness here, however, is far more likely to be a
mathematical weakness in the actual crypo algorithms which wouldn't stand
out to most developers - even the top-end folks.
Ultimately, it will probably come down to crypto-nerds and mathematicians
to verify the algorithms that were used rather than just putting great
programming eyes on the code. Such things have happened before, though with
much less fanfare to the general community. For example:
http://www.schneier.com/blog/archives/2007/11/the_strange_sto.html
// Ben S.
[snip]
Also, the original sender of the email confirms he sent it. Also
mentions PF as a target in the follow-up.
http://blogs.csoonline.com/1296/an_fbi_backdoor_in_openbsd
Anyone know the trustworthy-ness of 'csoonline'?
-Bryan
> More to the point, I think it wouldn't be an NDA, but a security
> classification on the knowledge of the backdoors, and probably one not
> subject to automatic downgrading.Please pardon my ignorance on the matter as I am not involved in any way
with Open Source development, but it stands to reason that anything of this
sort would have been scrutinized by the many developers involved with
OpenBSD and surely would have been discovered at some point. And to further
that point, is this not something that can be verified now if this code is
still in the public domain? Or is writing a crypto stack such an esoteric
task that only a relegated few can possibly decipher the inner workings?
See Ken Thompson's classic paper "Reflections on trusting trust",
http://en.wikipedia.org/wiki/Backdoor_(computing)#Reflections_on_Trusting_Trust
http://cm.bell-labs.com/who/ken/trust.html
Not that I don't love a good government conspiracy theory, and yes I do
believe there are a fair amount of backdoors in most code (including that of
many private and publicly held corporations)... but open source? Just seems
unlikely to me based on my limited understanding...
The world is not that simple.
Steinar Haug, Nethelp consulting, sthaug@nethelp.no
See Ken Thompson's classic paper "Reflections on trusting trust",
Also see David A Wheeler's "Countering Trusting Trust through Diverse
Double-Compiling"
>
>> > From: mikea [mailto:mikea@mikea.ath.cx]
>> > Sent: Wednesday, December 15, 2010 8:28 AM
>> > To: nanog@nanog.org
>> > Subject: Re: Alleged backdoor in OpenBSD's IPSEC
implementation.
I might just be me, but a few hundred bucks just doesn't seem like enough to
warrant potentially receiving a visit from the men in black...
Stefan
Someone working on a classified project or having access to classified
info would be signing a lot more than an NDA. Which leads me to the
conclusion Perry probably did not have access to classified info; a
gov't backdoor planted in OpenBSD would probably be classified, so
Perry was more likely than not, either in error or exagerating.
If Perry really is risking making authorities frustrated for revealing
that they have a backdoor, then it does not help the community much
for him to withold the minimal amount of info required to verify the
claims. For now it smells of FUD, because the claims are too vague,
unsupported, and the extent of what Perry claims to have witnessed has
not been explained.
An example of Perry being in error would be if the company was paid
to merely develop a backdoor or side channel, but not actually to
plant it in their contributed code.
The FBI might have wanted proof of concepts, or backdoored versions of
code as "drop in piece" to use for other projects.. for example,
insider penetration testing, or surreptitious monitoring by planting
the backdoored version on specific targetted systems.
Proof of concept code might have gone nowhere.
In that case, it would be impossible to find the backdoor by analyzing
the OpenBSD source code. Or a backdoor or coding error made by
someone else entirely might be discovered instead.
Rewriting instead of merely auditing, of course, presents a risk that
new backdoors could be introduced by whoever rewrites.
Even if a backdoor were developed, Perry posted very little info
about exactly what he knows and how he knows it, what was his role in
the project. Such as the question of: 'Did he personally check
the contributed code and see the backdoor present?'