[cryptography] Fwd: [gsc] Fwd: OpenBSD IPSEC backdoor(s)

Zooko O'Whielacronx zooko at zooko.com
Fri Dec 17 03:28:09 EST 2010


On Thu, Dec 16, 2010 at 6:41 PM, Paul Hoffman <paul.hoffman at vpnc.org> wrote:
> At 7:06 PM -0600 12/16/10, Marsh Ray wrote:
>>There were some wild accusations made and widely repeated, I'm trying my best to stick to facts and not direct accusations about anyone.
>
> You failed (miserably, in my opinion).

It is understandable if you are upset at the suggestion that someone
you like and trust may have been complicit in such a trick, but Marsh
Ray already did a fine job of sticking to facts in his original
message, quoted below.

He did not go on to declare (in that original message) that he
believed the coders in question to be innocent, but nor did he go on
to declare that he believed them to be guilty. To state facts is
sufficient and that's what Marsh Ray did.

Regards,

Zooko

> At 4:09 PM -0600 12/16/10, Marsh Ray wrote:
>>How's this:
>>
>>OpenBSD shipped with a bug which prevented effective IPsec ESP authentication for a few releases overlapping the time period in question:
>>
>>>http://code.bsd64.org/cvsweb/openbsd/src/sys/netinet/ip_esp.c.diff?r1=1.74;r2=1.75;f=h
>>
>>No advisory was made.
>>
>>The developer who added it, and the developer who later reverted it, were said to be funded by NETSEC
>>
>>>http://monkey.org/openbsd/archive/misc/0004/msg00583.html
>>
>>I think there's more. I'm out of time to describe it right now, BBIAB.



More information about the cryptography mailing list