OpenBSD Code Audit Denies FBI Backdoor Allegations

12 days ago former NETSEC CTO Gregory Perry (nicknamed The Prez!) sent an email to BSD project leader Theo de Raadt. In the email Perry alleged that the FBI had backdoors inserted in the cryptographic framework of OpenBSD, and that DARPA dropped funding of OpenBSD for that reason. Perry wrote:

My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI.  Jason
Wright and several other developers were responsible for those
backdoors, and you would be well advised to review any and all code
commits by Wright as well as the other developers he worked with
originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they
more than likely caught wind of the fact that those backdoors were
present and didn't want to create any derivative products based upon
the same.

Perry's claims generated legitimate concerns in the OpenBSD community, and sparked a full scale audit of OpenBSD code.

After code audits de Raadt has come forward to deny that any such backdoors exist, although he did disclose that there was a serious bug in the Encapsulating Security Payload code that was not brought to the public's attention in 2002. Vulnerability to cypher-block chaining oracle attacks were discovered in some drivers, and fixes have been devised for those bugs. Theo de Raadt believes those vulnerabilities were accidents, albeit serious ones, rather than intentionally inserted bugs.

Some in the IT community immediately had questions regarding the scope of such a maneuver, specifically whether or not Linux may have been targeted by like endeavors. The issue seems not to affect Linux, as the IPSec stack for Linux appears to be entirely original. There were also legitimate concerns with regard to Apple Computers, which has used BSD code in their computers (freeBSD to be exact, but the BSD's have done a lot of code sharing). There has also been a vocal concern involving how fast OpenBSD responded and the apparent speed of the code review. If admitting a problem would cost your company millions of dollars, then would you admit it or come forward with an official denial?

This story will likely die. There are too few people with serious concerns and way too many people who question the validity of Perry's claims. Besides that, though, shouldn't everyone assume that the FBI and the NSA have done everything in their power to make backdoors possible and work from that assumption? It boggles the mind that there are people who might think such claims are outrageous, when in reality it would be outrageous to think that the intelligence community had done no such thing. It's their job to make such things possible, regardless of public opinion.

Online Activist Group Anonymous

A story from BBC News 10 days ago, which somehow escaped my attention until now, described an online activist group called Anonymous. It is to laugh. British hoodlums, as they are known to people more familiar with the "organization," have really been outdoing Americans with their "activism" (Note- soccer fans do not sock any hers). Realizing huge numbers of people don't get news from the Internet, they have taken to putting up posters to draw attention to the Wikileaks story. The BBC does everything but name the site where Anonymous takes those ideas to get mass support. In the midst of being totally screwed up, yotsuba scripters do bring a certain je na sais quoi to the table. That's as much as needs be said. Boing Boing, also.

Merry Christmas

Blessings and good will to everyone out there during the holiday season. May the heavens shine down on you with warmth and grace. Merry Christmas, world. And to myself, from me, next year: Just because you've witnessed the empty turn of the language means you should twice as much enjoy the holiday, even without anyone around. And don't get thrown in a hospital to avoid arrest for enjoying it too much...

Clark Ashton Smith

Somehow in the course of my obsession with macabre, esoteric, fantasy and science fiction writing I missed out on reading Clark Ashton Smith until very recently. Smith gained fame through publication in Weird Tales, just as did his contemporaries H.P. Lovecraft and Robert E. Howard and other great authors. Unlike the other two most famous authors from the pulp magazine, however, Smith has remained undersung and underappreciated by mainstream fantasy enthusiasts.

I just finished Zothique, a collection of stories set in Earth's distant future where the only continent bears that name. It blew me away. Smith had a phenomenal grasp on phantasmagoria and dark, occult themes. Never since reading Lovecraft as a teenager have I been so impressed with an author in that genre. The collection comes highly recommended to anyone who has a fondness for Gothic and horror literature. You won't be disappointed, except by the fact that Smith stopped writing long before his death and could have given the world so much more to read.

Two Hunts (become many)

The Deer: One frozen morning I held fire on a 16-20 point buck, frozen and young. Later that morning I killed a smaller one that outweighed me 2.3 to 1. The distance stepped off to the evidence of point of impact, triangulated and visual: 265 yards. It was inspected by a Louisiana Department of Wildlife and Fisheries Officer. I gutted, skinned and cleaned it under the tutelage of my father. I emptied a 30-06 in a ravine on Tunica Tribal Land in the small mountainous uplift skirting the southern part of Angola Prison: Another beautiful buck. God knows I wish I had been able to gauge the trajectory better (still only 12). It wasn't as big as the one killed near Lottie.

The Snakes: 3.5 foot long black diamond back in the brambles of the Felicianas. It lived in an outside freezer. Shot at point blank range with J. H.'s gun for that family (glad to be of service in that matter). 4 foot long viper in tree limbs of Old River Road Swamp, and a dozen rattle snakes on the ground, less than a mile from the Louisiana State University campus.