11 ms·
Speculation on "BULLRUN"
- tjaerv 13y agoUpstream source: http://www.metzdowd.com/pipermail/cryptography/2013-September/017218.html http://www.metzdowd.com/pipermail/cryptography/2013-Septembe...
- ChuckMcM 13y agoThe author, John Gilmore, shared these sorts of stories with me when I was complaining about the NSA intervention on the crypto work I was doing on Java. Sun said I had to have them sign off that we were 'compliant' (which means they would tell the State Department to sign off on our export license) and that was a total PITA. At the time I was working on an end to end loadable strong encryption package [1]. [1] http://patents.justia.com/patent/6546487 http://patents.justia.com/patent/6546487 - if that looks complex and twisted, it is. The original version wasn't "compliant."
- ewoodrich 13y agoThe Sun patent appears to be listed on Oct 19, 1999. Out of curiosity, when did the compliance discussions with the NSA occur? (I'm quite interested in '90s crypto/political interaction, and had thought that by '99, the NSA and State/Export restrictions had been mostly lifted, but I'd love to learn more from the inside).
- ChuckMcM 13y agoI was building a strong crypto package for Java in '93-'94. It was part of a capabilities system for Java which would have had the JVM unable to decrypt/instantiate methods in classes for which capabilities had not been granted. I modelled it on the Joule system which Mark Miller had worked on earlier. In late 1991/ early 1992 Sun had engaged RSA Data Security for a license to use their asymmetric crypto system we know as the RSA algorithm. I had started that because I was building a high trust authentication system for our name service (NIS+) and I really wanted to be able to pass around public keys for servers that a client trusted to be legitimate. When I started working on Java security in 1993 I sought to use some of those same techniques in creating a way for the JVM to "load" a cryptographic class which it could trust, and the class could validate that the JVM loadinging was trustable as well (avoiding MITM attacks). Since I had already been engaged with the issues of shipping crypto code in ONC-RPC, I knew it would be an issue to release source code that implemented arbitrarily strong RSA so when it came up, the NSA came out to talk to us. Our "rep" was a woman (and I'm not making this up) named Cindie Spies. She understood what I wanted to do but wasn't particularly keen on us doing it. We went back and forth with me sending code to her, and her sending back suggestions. It was a tedious process and ultimately moot since the capabilities version of Java never actually shipped.
- ewoodrich 13y agoFascinating stuff. The "Cindie Spies" negotiations (and not just the spot-on name) provide good context for what it would be like developing crypto in a tumultuous, formative period for our current security technology/regulations.
- yuhong 13y agoIt wasn't, it was just raised to 56-bit from 40-bit.
- ewoodrich 13y ago"In 1999, all restrictions on key length were lifted, except for exports to embargoed countries." [1] http://en.wikipedia.org/wiki/56-bit_encryption http://en.wikipedia.org/wiki/56-bit_encryption If you have a source that contradicts this, I'm all ears. I'd just always believed (based on what I've read) that the period from '96-'99 opened up arbitrarily strong crypto (excluding embargos/restrictions to states like North Korea).
- yuhong 13y agohttp://www.nytimes.com/2000/01/31/business/worldbusiness/31iht-ttcrypto.2.t.html http://www.nytimes.com/2000/01/31/business/worldbusiness/31i...
- ewoodrich 13y ago"Further relaxation of encryption export controls took place in September 1999, when the Clinton Administration announced that encryption items of any key length may now be exported under a license exception, after a technical review, to individuals, firms, and other non-government end-users in any country except for seven state supporters of terrorism.25 After a technical review, retail encryption commodities and software of any key length will also be exportable under a license exception to any recipient in any country except for the same seven destinations." http://www.au.af.mil/au/awc/awcgate/crs/rl30273.pdf http://www.au.af.mil/au/awc/awcgate/crs/rl30273.pdf I think we're pretty much in agreement, considering that the time period between Sep. '99 and Jan '00 is about the length of time for new policy to fully propagate. Regardless, the latter portion of '99 and early '00 was when NSA and State/Export restrictions had been lifted.
- dunham 13y agoI know there are some hoops you have to jump through if you're selling an iOS app that uses encryption, which arguably could include HTTPS. There is a registration/approval process, but an exemption for certain cases. More details here: http://stackoverflow.com/questions/9609901/when-to-check-the-this-application-uses-encryption-box http://stackoverflow.com/questions/9609901/when-to-check-the...
- XorNot 13y agoPatents look complicated and twisted no matter what they're about.
- fnordfnordfnord 13y ago"NSA employees participted throughout, and occupied leadership roles in the committee and among the editors of the documents" I don't know jack about writing crypto software, but I see one improvement that we can make to the process, right away. Gotta love Open Source, and open standards.
- yuhong 13y agoAh, crypto back in the late 1990s, the period when NSA was trying to restrict export of encryption stronger than 40-bit. The funny thing is that 56-bit crypto is still in use in the form of PPTP with MS-CHAPv2. What is even worse is they thought it was non-exportable 128-bit encryption at the time, the actual 40-bit and 56-bit versions are even worse.
- riobard 13y agoSo PPTP is insecure, and IPSec is fundamentally broken… How about OpenVPN? Is that compromised too?
- ghshephard 13y agoIPSec is not fundamentally broken, it's just needlessly complex.
- cpeterso 13y agoIs there a simple (and auditable) subset of IPSec that could still compatible with IPSec clients using a full/complex stack?
- wiml 13y agoAs I understand it most of the terribleness is in the key agreement stuff; the actual packet processing is a little ugly but is practical. So you could in theory set up (and regularly update) SAs manually with setkey(8), instead of having racoon do it. For a small network you could presumably lash together some cronjobs to keep this working. Would that be as secure as IKEv2 as actually implemented? I dunno :)
- plorkyeran 13y agoIf the unnecessary complexity has resulted in most implementations being broken then I'd be okay with calling it fundamentally broken, but I have no idea if that's actually the case.
- gwu78 13y agoOpenVPN uses SSL for encryption. It's an "SSL VPN". Any more questions? There are more reasons than just current events to avoid using SSL. But if this NSA hoopla is what it takes to make people aware of how poor SSL is as a solution, then let the conspiracy theories flourish.
- tytso 13y agoI was chair of the IPSEC working group at the IETF, and I think I know what John Gilmore was referring to with respect to the question of the Initialization Vector. The person who expressed a concern with a per-packet IV (which by the way had indeed done a lot of consulting for the NSA; nice guy, though) didn't like the idea because it's too easy for people to screw up and use an incrementing counter for the IV. This is bad, because if the first couple of bytes in the packet are mostly fixed (becuase you are encapsulating a TCP or UDP packet, for example), the resulting plaintext in the first block of these packets will have a very low hamming distance between them, and this can enable certain cryptoanalytic attacks (i.e., such as differential cryptoanalysis). He was not advocating using the same IV across the entire session, in the sense that we would use the same IV for each packet (which would have been a cryptographic disaster), but rather we use the previous packet's cipherblock as the IV for the next packet (i.e., just keep chaining the cipherblocks). As is often the case in standards bodies when there is disagreement, neither side won, and we left things unspecified. The RFC doesn't constrain how the IV should be chosen, so you can initialize the IV either way. There was language indicating that the IV should never be the same, as well as an additional method of generating the IV, by using a Linear Feedback Shift Register (LFSR), which also will eliminate the potential problem of related plaintext being sent to the crypto algorithm. So although the RFC doesn't say this, I would recommend either the use of a LFSR, or the last cipherblock in the previous packet encrypted using that key, and to avoid using a simple counter in your IPSEC implementation for the Initialization Vector (IV) in each packet. So to be fair, in this particular case, the person with "known associations with the NSA" was actually trying to make things better, although he did feel constrained in not explaining all of his reasons in the open wg meeting. Which no doubt tripped Gilmore's paranoia, and I can't blame him for that either.
- pkl2 13y ago> which by the way had indeed done a lot of consulting for the NSA; nice guy, though Brings up an interesting point. Going forward should it be disqualifying to be currently working for the NSA to be on one of these committees? To have formerly worked for them? To done a lot of consulting? To have done any consulting? To have ever had a security clearance? Witchhunts have a deservedly negative connotation, but what if you are actually surrounded by witches?
- rdl 13y agoIt does seem a pretty fair that the IPSEC process, and IPSEC in general, has been an utter clusterfuck. Raccoon, etc. are horrible (really anything with IKE). Free S/WAN had its own problems, but at least Hugh was fairly reasonable. That doesn't necessarily point to NSA, though. (most of this criticism applies to DNSSEC too)
- tytso 13y agoI can't _prove_ that there were people who was purposely delaying consensus to give their product more time to make it to market. But there were those who had their suspicions...
- newman314 13y agoRacoon is a nightmare to set up. I would say that I'm reasonably technical but gave up after trying to set up a road warrior config for home use passing through dd-wrt and terminating in a server.
- Zigurd 13y agoIt will be interesting to see if the NSA can still push their way into standards bodies. I wonder if similar techniques were used on WebRTC security.
- obituary_latte 13y ago-1 on the title change. "Linux ipsec" vs "bullrun"? Really? Someone just flexing?
- zeteo 13y agoI may be digressing but the symbolism they chose for these names is rather spooky. The US program is named after the first battle in the American Civil War, and its UK correspondent after the first in the English Civil War.
- regularfry 13y agoHow are project or operation names chosen? I'd always assumed they had to be randomly selected so knowing the name wouldn't give you any clue (even accidentally) to the content.
- ihsw 13y ago> because of bullheadedness in the maintainer who managed that part of the kernel. Instead he built a half-baked implementation that never worked. I have no idea whether that bullheadedness was natural, or was enhanced or inspired by NSA or its stooges. Who knows, maybe he was paranoid of others because he was incompetent. He could look at your code and its complexity would astound him, therefore you're trying to confuse him and mislead him into accepting your code without knowing what it was doing. He may have already known that there were NSA employees in kernel development.
- eps 13y agoI vaguely remember some incident back in early '00 when they found some "interesting" patch in FreeS/WAN code added by someone who was either consulting or tied otherwise with NSA. There was a flurry of discussion on a mailing list followed, I think, by the patch reversal. Does anyone know what I am referring to?
- guelo 13y agoOh well. Is OpenVPN still considered solid?
- jacoblyles 13y agoThis sounds like a good time to start doing crypto research outside of the United States.
- fosap 13y agoIPSec is a kind of broken, what happend to CurveCP btw?
- JulianMorrison 13y agoI think someone needs to set up a fresh committee, and fix IPSEC, and deprecate the existing version.