Annotation of www/crypto.html, Revision 1.151
1.114 jufi 1: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
1.1 deraadt 2: <html>
3: <head>
1.114 jufi 4: <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
1.149 tj 5: <meta name="copyright" content="This document copyright 1997-2016 by OpenBSD.">
6: <title>OpenBSD: Cryptography</title>
1.148 deraadt 7: <meta name="viewport" content="width=device-width, initial-scale=1">
8: <link rel="stylesheet" type="text/css" href="openbsd.css">
1.151 ! tb 9: <link rel="canonical" href="https://www.openbsd.org/crypto.html">
1.1 deraadt 10: </head>
11:
1.150 tb 12: <body bgcolor="#ffffff" text="#000000" link="#23238E">
13:
1.148 deraadt 14: <h2>
15: <a href="index.html">
16: <i><font color="#0000ff">Open</font></i><font color="#000084">BSD</font></a>
17: <font color="#e00000">Cryptography</font>
1.149 tj 18: </h2>
1.138 jcs 19: <hr>
20:
1.114 jufi 21: <a name="why"></a>
22: <h3><font color="#e00000">Why do we ship cryptography?</font></h3><p>
1.32 deraadt 23:
24: In three words: <strong>because we can</strong>.<p>
25:
1.1 deraadt 26: The OpenBSD project is based in Canada.<p>
27:
1.114 jufi 28: The <a href="ECL.html">Export Control List of Canada</a>
1.23 deraadt 29: places no significant restriction on the export of
1.5 deraadt 30: cryptographic software, and is even more explicit about the free
31: export of freely-available cryptographic software. Marc Plumb has
32: done
1.116 nick 33: <a href="http://www.efc.ca/pages/doc/crypto-export.html">
1.31 aaron 34: some research to test the cryptographic laws</a>.
1.2 deraadt 35: <p>
1.1 deraadt 36:
1.3 deraadt 37: Hence the OpenBSD project has embedded cryptography into numerous places
38: in the operating system. We require that the cryptographic software we
1.114 jufi 39: use be <a href="policy.html">freely available and with good licenses</a>.
1.32 deraadt 40: We do not directly use cryptography with nasty patents.
1.13 deraadt 41: We also require that such software is from countries with useful export
1.16 deraadt 42: licenses because we do not wish to break the laws of any country.
43: <p>
1.7 deraadt 44:
1.87 brad 45: OpenBSD was the first operating system to ship with an IPsec stack.
1.102 brad 46: We've been including IPsec since the OpenBSD 2.1 release in 1997.
1.66 deraadt 47: <p>
48:
1.114 jufi 49: <a name="ssh"></a>
50: <h3><font color="#e00000">OpenSSH</font></h3><p>
1.39 louis 51:
1.55 deraadt 52: As of the 2.6 release, OpenBSD contains
1.50 provos 53: <a href="http://www.openssh.com/">OpenSSH</a>, an absolutely free and
1.128 david 54: patent unencumbered version of ssh.
1.55 deraadt 55: <a href="http://www.openssh.com/">OpenSSH</a> interoperated with ssh
56: version 1 and had many added features,
1.47 provos 57: <ul>
58: <li>
1.88 brad 59: all components of a restrictive nature (i.e., patents, see
1.147 sthen 60: <a href="http://man.openbsd.org/?query=ssl&sektion=8">ssl(8)</a>)
1.55 deraadt 61: had been directly removed from the source code; any licensed or
62: patented components used external libraries.
1.47 provos 63: <li>
1.55 deraadt 64: had been updated to support ssh protocol 1.5.
1.47 provos 65: <li>
1.55 deraadt 66: supported one-time password authentication with
1.147 sthen 67: <a href="http://man.openbsd.org/?query=skey&sektion=1">skey(1)</a>.
1.47 provos 68: </ul>
69: <p>
70:
1.93 deraadt 71: Roughly said, we took a free license release of ssh, OpenBSD-ifyed it.
72: About a year later, we extended OpenSSH to also do SSH 2 protocol, the
73: result being support for all 3 major SSH protocols: 1.3, 1.5, 2.0.
1.69 deraadt 74:
75: <p>
1.114 jufi 76: <a name="people"></a>
77: <h3><font color="#e00000">International Cryptographers Wanted</font></h3><p>
1.32 deraadt 78:
79: Of course, our project needs people to work on these systems. If any
80: non-American cryptographer who meets the constraints listed earlier is
81: interested in helping out with embedded cryptography in OpenBSD,
82: please contact us.<p>
83:
1.33 deraadt 84: <p>
1.114 jufi 85: <a name="papers"></a>
86: <h3><font color="#e00000">Further Reading</font></h3><p>
1.33 deraadt 87:
88: A number of papers have been written by OpenBSD team members, about
89: cryptographic changes they have done in OpenBSD. The postscript
1.34 deraadt 90: versions of these documents are available as follows.<p>
1.33 deraadt 91:
92: <ul>
1.43 deraadt 93: <li>A Future-Adaptable Password Scheme.<br>
1.114 jufi 94: <a href="events.html#usenix99">Usenix 1999</a>,
95: by <a href="mailto:provos@openbsd.org">Niels Provos</a>,
96: <a href="mailto:dm@openbsd.org">David Mazieres</a>.<br>
97: <a href="papers/bcrypt-paper.ps">paper</a> and
98: <a href="papers/bcrypt-slides.ps">slides</a>.
1.43 deraadt 99: <p>
100: <li>Cryptography in OpenBSD: An Overview.<br>
1.114 jufi 101: <a href="events.html#usenix99">Usenix 1999</a>,
102: by <a href="mailto:deraadt@openbsd.org">Theo de Raadt</a>,
103: <a href="mailto:niklas@openbsd.org">Niklas Hallqvist</a>,
104: <a href="mailto:art@openbsd.org">Artur Grabowski</a>,
105: <a href="mailto:angelos@openbsd.org">Angelos D. Keromytis</a>,
106: <a href="mailto:provos@openbsd.org">Niels Provos</a>.<br>
107: <a href="papers/crypt-paper.ps">paper</a> and
108: <a href="papers/crypt-slides.ps">slides</a>.
1.62 niklas 109: <p>
110: <li>Implementing Internet Key Exchange (IKE).<br>
1.114 jufi 111: <a href="events.html#usenix2000">Usenix 2000</a>,
112: by <a href="mailto:niklas@openbsd.org">Niklas Hallqvist</a> and
113: <a href="mailto:angelos@openbsd.org">Angelos D. Keromytis</a>.<br>
114: <a href="papers/ikepaper.ps">paper</a> and
115: <a href="papers/ikeslides.ps">slides</a>.
116: <p>
117: <li>Encrypting Virtual Memory.<br>
118: <a href="events.html#sec2000">Usenix Security 2000</a>,
119: <a href="mailto:provos@openbsd.org">Niels Provos</a>.<br>
1.128 david 120: <a href="papers/swapencrypt.ps">paper</a> and
1.114 jufi 121: <a href="papers/swapencrypt-slides.ps">slides</a>.
1.121 jason 122: <p>
123: <li>The Design of the OpenBSD Cryptographic Framework.<br>
124: <a href="events.html#usenix2003">Usenix 2003</a>, by
125: <a href="mailto:angelos@openbsd.org">Angelos D. Keromytis</a>,
126: <a href="mailto:jason@openbsd.org">Jason L. Wright</a>, and
127: <a href="mailto:deraadt@openbsd.org">Theo de Raadt</a>.<br>
128: <a href="papers/ocf.pdf">paper</a>.
1.133 steven 129: <p>
1.132 jason 130: <li>Cryptography As an Operating System Service: A Case Study.<br>
1.133 steven 131: <a href="http://www.acm.org/tocs/">ACM Transactions on Computer Systems</a>,
1.132 jason 132: February 2006, by
133: <a href="mailto:angelos@openbsd.org">Angelos D. Keromytis</a>,
134: <a href="mailto:jason@openbsd.org">Jason L. Wright</a>, and
135: <a href="mailto:deraadt@openbsd.org">Theo de Raadt</a>.<br>
136: <a href="papers/crypt-service.pdf">paper</a>.
1.33 deraadt 137: </ul>
1.1 deraadt 138:
1.10 deraadt 139: </body>
140: </html>
![[BACK]](/icons/back.gif){kind=icon}
Return to crypto.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www