OpenBSD IPSec Possibly Probably Not Backdoored by FBI

In a post to the OpenBSD mailing list, developer Theo de Raadt reveals an email from an ex-contributor (Gregory Perry) alleging that money was accepted from the FBI around 2000-2001, in return for implementing a backdoor into the IPSec stack. Such a backdoor would give the FBI the ability to eavesdrop on any IPSec connection made using OpenBSD, or any other projects that have since made use of its IPSec code.

Clearly this would be a big deal if true, and although we know that open source projects are regularly backdoored by rogue developers or ‘hackers’ (such as the recent ProFTPd backdoor), it is not often that we hear of governments inserting some themselves. Should we be surprised? After all it is known that the NSA was involved with the development of DES by altering the algorithm’s S-Boxes and suggesting a shorter key length. There are also rumors of a covert backdoor in several versions of the Windows OS. That said, many people are smelling a troll in this case.

Following this information (can we call it a leak rumor?), OpenBSD’s IPSec code will undoubtedly come under quite a bit of scrutiny, and I’m sure we will hear a lot more about it should anything untoward be uncovered.

Read the full mailing list post here, archived below for posterity.

[Update] Scott Lowe denies being affiliated with the FBI, and Jason Wright denies having inserted a backdoor. This is sounding more and more like a trolling. To what end, I couldn’t speculate. It’s also worth noting that this kind of activity would probably not fall under a normal NDA, but under a government-level Top Secret classification which lasts at least 25 years…

An interesting observation about OpenBSD IPSec and Stuxnet.

<strong><span style="font-size: xx-small;">List: <a href="http://marc.info/?l=openbsd-tech&r=1&w=2">openbsd-tech</a> Subject: <a href="http://marc.info/?t=129236639300001&r=1&w=2">Allegations regarding OpenBSD IPSEC</a> From: <a href="http://marc.info/?a=90366097200024&r=1&w=2">Theo de Raadt <deraadt () cvs ! openbsd ! org></a> Date: <a href="http://marc.info/?l=openbsd-tech&r=1&w=2&b=201012">2010-12-14 22:24:39</a> Message-ID: <a href="http://marc.info/?i=201012142224.oBEMOdWM031222%20%28%29%20cvs%20%21%20openbsd%20%21%20org">201012142224.oBEMOdWM031222 () cvs ! openbsd ! org</a></span> [<a href="http://marc.info/?l=openbsd-tech&m=129236621626462&q=raw">Download message RAW</a>]</strong> I have received a mail regarding the early development of the OpenBSD IPSEC stack. It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack. Around 2000-2001. Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products. Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are. The mail came in privately from a person I have not talked to for nearly 10 years. I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this. Therefore I am making it public so that (a) those who use the code can audit it for these problems, (b) those that are angry at the story can take other actions, (c) if it is not true, those who are being accused can defend themselves. Of course I don't like it when my private mail is forwarded. However the "little ethic" of a private mail being forwarded is much smaller than the "big ethic" of government paying companies to pay open source developers (a member of a community-of-friends) to insert privacy-invading holes in software. ---- From: Gregory Perry <Gregory.Perry@GoVirtual.tv> To: "deraadt@openbsd.org" <deraadt@openbsd.org> Subject: OpenBSD Crypto Framework Thread-Topic: OpenBSD Crypto Framework Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg== Date: Sat, 11 Dec 2010 23:55:25 +0000 Message-ID: <8D3222F9EB68474DA381831A120B1023019AC034@mbx021-e2-nj-5.exch021.domain.local> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Status: RO Hello Theo, Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies. My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC. This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn't want to create any derivative products based upon the same. This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments. Merry Christmas... Gregory Perry Chief Executive Officer GoVirtual Education "VMware Training Products & Services" 540-645-6955 x111 (local) 866-354-7369 x111 (toll free) 540-931-9099 (mobile) 877-648-0555 (fax)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93

<strong><span style="font-size: xx-small;">List:       <a href="http://marc.info/?l=openbsd-tech&r=1&w=2">openbsd-tech</a> Subject:    <a href="http://marc.info/?t=129236639300001&r=1&w=2">Allegations regarding OpenBSD IPSEC</a> From:       <a href="http://marc.info/?a=90366097200024&r=1&w=2">Theo de Raadt <deraadt () cvs ! openbsd ! org></a> Date:       <a href="http://marc.info/?l=openbsd-tech&r=1&w=2&b=201012">2010-12-14 22:24:39</a> Message-ID: <a href="http://marc.info/?i=201012142224.oBEMOdWM031222%20%28%29%20cvs%20%21%20openbsd%20%21%20org">201012142224.oBEMOdWM031222 () cvs ! openbsd ! org</a></span> [<a href="http://marc.info/?l=openbsd-tech&m=129236621626462&q=raw">Download message RAW</a>]</strong>   I have received a mail regarding the early development of the OpenBSD IPSEC stack.  It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack.  Around 2000-2001.   Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products.  Over 10 years, the IPSEC code has gone through many changes and fixes, so it is unclear what the true impact of these allegations are.   The mail came in privately from a person I have not talked to for nearly 10 years.  I refuse to become part of such a conspiracy, and will not be talking to Gregory Perry about this.  Therefore I am making it public so that     (a) those who use the code can audit it for these problems,     (b) those that are angry at the story can take other actions,     (c) if it is not true, those who are being accused can defend themselves.   Of course I don't like it when my private mail is forwarded.  However the "little ethic" of a private mail being forwarded is much smaller than the "big ethic" of government paying companies to pay open source developers (a member of a community-of-friends) to insert privacy-invading holes in software.   ----   From: Gregory Perry <[email protected]> To: "[email protected]" <[email protected]> Subject: OpenBSD Crypto Framework Thread-Topic: OpenBSD Crypto Framework Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg== Date: Sat, 11 Dec 2010 23:55:25 +0000 Message-ID: <[email protected]domain.local> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Status: RO   Hello Theo,   Long time no talk.  If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework.  At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies.   My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI.  Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC.   This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn't want to create any derivative products based upon the same.   This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments.   Merry Christmas...   Gregory Perry Chief Executive Officer GoVirtual Education   "VMware Training Products & Services"   540-645-6955 x111 (local) 866-354-7369 x111 (toll free) 540-931-9099 (mobile) 877-648-0555 (fax)