FBI contractor admits that there are backdoors in OpenBSD ipsec (cryptography)

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

1. With open source software, backdoors are found and fixed.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Jason......

DARPA......

Merry Christmas......

1. With open source software, backdoors are found and fixed.

indeed. i personally examined 5 linux distributions this afternoon and found no problems. my mom found a couple flaws in sp3 for xp.

Well, it's official. We are screwed and don't think for a second that OpenSSL, OpenSSH, Linux, Windows and friends don't have any back doors.




From: Gregory Perry <[email protected]>
To: "[email protected]" <[email protected]>
Subject: OpenBSD Crypto Framework
Thread-Topic: OpenBSD Crypto Framework
Thread-Index: AcuZjuF6cT4gcSmqQv+Fo3/+2m80eg==
Date: Sat, 11 Dec 2010 23:55:25 +0000
Message-ID: <[email protected]​021.domain.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status: RO

Hello Theo,

Long time no talk. If you will recall, a while back I was the CTO at
NETSEC and arranged funding and donations for the OpenBSD Crypto
Framework. At that same time I also did some consulting for the FBI,
for their GSA Technical Support Center, which was a cryptologic
reverse engineering project aimed at backdooring and implementing key
escrow mechanisms for smart card and other hardware-based computing
technologies.

My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI. Jason
Wright and several other developers were responsible for those
backdoors, and you would be well advised to review any and all code
commits by Wright as well as the other developers he worked with
originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they
more than likely caught wind of the fact that those backdoors were
present and didn't want to create any derivative products based upon
the same.

This is also why several inside FBI folks have been recently
advocating the use of OpenBSD for VPN and firewalling implementations
in virtualized environments, for example Scott Lowe is a well
respected author in virtualization circles who also happens top be on
the FBI payroll, and who has also recently published several tutorials
for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas...

Gregory Perry
Chief Executive Officer
GoVirtual Education

"VMware Training Products & Services"

540-645-6955 x111 (local)
866-354-7369 x111 (toll free)
540-931-9099 (mobile)
877-648-0555 (fax)









Make no mistake, this means that we are being watched, and that there are no secure communications.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

1. With open source software, backdoors are found and fixed.

indeed. i personally examined 5 linux distributions this afternoon and found no problems. my mom found a couple flaws in sp3 for xp.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.


Oh I agree. The Spooks would NEVER try anything fishy.

they just trap everything coming out, filter it, decrypt it, and save it. Kind of like here lol.

And do what with it?

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.


Oh I agree. The Spooks would NEVER try anything fishy.

They can try it but not with the actual OS because everyone would see what they did as it has the source code.
But they can no doubt get you at the network level anyway.

they just trap everything coming out, filter it, decrypt it, and save it. Kind of like here lol.

And do what with it?


Run it thru traps for keywords. Lol, I don't BS you, it exist and is used extensibly worldwide. It's my understanding the extra server filter never slows the traffic down. Just creates an extra hop.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.


Read the comments, get a clue

[link to bsd.slashdot.org]

It isn't necessarily obvious.

Basically, the idea is that bits of the key leak. And how is this accomplished?

For example - if a key bit is 0, you take one code path, if 1, another. Make the two paths different lengths. It may be possible to affect packet timing. Or... A function may end with "x - y" and then return "z". No leak? Not so clear, the carry/borrow may be leaking information to the caller (on x86 style hardware).

Anyway, it probably isn't a "back door", just some means of determining enough key bits to make brute force practical is enough. And this sort of thing can be subtle. It can even be based on the machine code generated for certain sequences by a particular compiler (the "x-y; return z" sequence above, for example).

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.


Oh I agree. The Spooks would NEVER try anything fishy.

They can try it but not with the actual OS because everyone would see what they did as it has the source code.
But they can no doubt get you at the network level anyway.


Bingo

they just trap everything coming out, filter it, decrypt it, and save it. Kind of like here lol.

And do what with it?


Run it thru traps for keywords. Lol, I don't BS you, it exist and is used extensibly worldwide. It's my understanding the extra server filter never slows the traffic down. Just creates an extra hop.

1. With open source software, backdoors are found and fixed.

2. Back doors doesnt necessarily have anything to do with whether or not end user communication is secure or not.

Exactly its open source we have the source code lol ffs how stupid is this.


Oh I agree. The Spooks would NEVER try anything fishy.

They can try it but not with the actual OS because everyone would see what they did as it has the source code.
But they can no doubt get you at the network level anyway.


Bingo


Every major hub is "compromised" by NSA activities.