Annotation of www/crypto.html, Revision 1.53
1.10 deraadt 1: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML Strict Level 2//EN//2.0">
1.1 deraadt 2: <html>
3: <head>
1.10 deraadt 4: <title>Cryptography in OpenBSD</title>
1.1 deraadt 5: <link rev=made href=mailto:www@openbsd.org>
6: <meta name="resource-type" content="document">
1.10 deraadt 7: <meta name="description" content="OpenBSD cryptography">
1.48 beck 8: <meta name="keywords" content="openbsd,cryptography,openssh,openssl,kerberos">
9: <meta name="keywords" content="ipsec,photuris,isakmp,ike,blowfish,des,rsa,dsa">
1.1 deraadt 10: <meta name="distribution" content="global">
11: <meta name="copyright" content="This document copyright 1997 by OpenBSD.">
12: </head>
13:
14: <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#23238E">
1.45 deraadt 15: <img align=left alt="[OpenBSD]" height=166 width=197 SRC="images/blowfish-notext.jpg">
16: <br>
17: <br>
18: <br>
19: "The mantra of any good security engineer is: "Security is a not a
20: product, but a process." It's more than designing strong cryptography
21: into a system; it's designing the entire system such that all security
22: measures, including cryptography, work together."<br>
23: <br>
24: -- Bruce Schneier, author of "Applied Cryptography".
25: <br clear=all>
1.37 deraadt 26: <h2><font color=#e00000>Cryptography</font><hr></h2>
1.32 deraadt 27:
28: <strong>Index</strong><br>
1.41 louis 29: <a href=#why>Why do we ship cryptography?</a>.<br>
1.47 provos 30: <a href=#ssh>OpenSSH</a>.<br>
1.32 deraadt 31: <a href=#prng>Pseudo Random Number Generators</a> (PRNG): ARC4, ...<br>
32: <a href=#hash>Cryptographic Hash Functions</a>: MD5, SHA1, ...<br>
33: <a href=#trans>Cryptographic Transforms</a>: DES, Blowfish, ...<br>
1.51 deraadt 34: <a href=#hardware>Cryptographic Hardware support</a><br>
1.32 deraadt 35: <a href=#people>International Cryptographers wanted</a><br>
1.33 deraadt 36: <a href=#papers>Further Reading</a><br>
1.1 deraadt 37: <p>
1.32 deraadt 38: <hr>
39:
40: <a name=why></a>
1.42 deraadt 41: <h3><font color=#e00000>Why do we ship cryptography?</font></h3><p>
1.32 deraadt 42:
43: In three words: <strong>because we can</strong>.<p>
44:
1.1 deraadt 45: The OpenBSD project is based in Canada.<p>
46:
1.23 deraadt 47: The <a href=ECL.html>Export Control List of Canada</a>
48: places no significant restriction on the export of
1.5 deraadt 49: cryptographic software, and is even more explicit about the free
50: export of freely-available cryptographic software. Marc Plumb has
51: done
1.2 deraadt 52: <a href=http://insight.mcmaster.ca/org/efc/pages/doc/crypto-export.html>
1.31 aaron 53: some research to test the cryptographic laws</a>.
1.2 deraadt 54: <p>
1.1 deraadt 55:
1.3 deraadt 56: Hence the OpenBSD project has embedded cryptography into numerous places
57: in the operating system. We require that the cryptographic software we
58: use be <a href=policy.html>freely available and with good licenses</a>.
1.32 deraadt 59: We do not directly use cryptography with nasty patents.
1.13 deraadt 60: We also require that such software is from countries with useful export
1.16 deraadt 61: licenses because we do not wish to break the laws of any country.
62: The cryptographic software components which we use currently were
63: written in Argentina, Australia, Canada, Germany, Greece, Norway, and
64: Sweden.
65: <p>
1.7 deraadt 66:
1.15 deraadt 67: When we create OpenBSD releases or snapshots we build our release
68: binaries in free countries to assure that the sources and binaries we
69: provide to users are free of tainting. In the past our release binary
70: builds have been done in Canada, Sweden, and Germany.<p>
71:
1.16 deraadt 72: OpenBSD ships with Kerberos IV included. The codebase we use is the
1.17 deraadt 73: exportable KTH-based release from Sweden. Our X11 source has been
74: extended to make use of Kerberos IV as well. Kerberos V support will
1.16 deraadt 75: perhaps appear in 1999, but at present time a freely exportable
76: Kerberos V release does not exist.<p>
77:
1.15 deraadt 78: Today cryptography is an important means for enhancing the <a
79: href=security.html>security</a> of an operating system. The
1.42 deraadt 80: cryptography utilized in OpenBSD can be classified into various
81: aspects, described as follows.<p>
1.10 deraadt 82:
1.39 louis 83: <a name=ssh></a>
1.47 provos 84: <h3><font color=#e00000>OpenSSH</font></h3><p>
1.39 louis 85:
1.40 deraadt 86: What is the first thing most people do after installing OpenBSD?
1.46 deraadt 87: They install Secure Shell (
88: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ssh>ssh</a>)
89: from the ports tree or the packages on the FTP sites. Until now, that is.<p>
1.39 louis 90:
1.47 provos 91: As of the upcoming 2.6 release, OpenBSD contains
1.50 provos 92: <a href="http://www.openssh.com/">OpenSSH</a>, an absolutely free and
93: patent unencumbered version of ssh.
94: <a href="http://www.openssh.com/">OpenSSH</a> interoperates with ssh
95: version 1 and has many added features,
1.47 provos 96: <ul>
97: <li>
98: all components of a restrictive nature (ie. patents, see
99: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ssl>ssl</a>))
100: have been directly removed from the source code; any licensed or
101: patented components are chosen from external libraries.
102: </li>
103: <li>
104: has been updated to support ssh protocol 1.5.
105: </li>
106: <li>
107: contains added support for
108: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=kerberos>kerberos</a>
109: authentication and ticket passing.
110: </li>
111: <li>
112: supports one-time password authentication with
113: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=skey>skey</a>.
114: </li>
115: </ul>
116: <p>
117:
118: We took a free license release of ssh and OpenBSD-ifyed it. We
119: get around the USA-based RSA patent by providing an easy way to
120: automatically download and install a RSA-enabled package containing
121: shared library versions of libcrypto and libssl. These packages are
122: based on OpenSSL. People living outside the USA can freely use the
1.40 deraadt 123: RSA patented code, while people inside the USA can freely use it for
1.47 provos 124: non-commercial purposes. It appears as if companies inside the USA
125: can use the RSA libraries too, as long as RSA is not used in a profit
126: generating role.<p>
1.39 louis 127:
1.40 deraadt 128: But this way almost everyone will get ssh built-in.<p>
1.39 louis 129:
1.18 deraadt 130: <a name=prng></a>
1.42 deraadt 131: <h3><font color=#e00000>Pseudo Random Number Generators</font></h3><p>
1.32 deraadt 132:
1.10 deraadt 133: A Pseudo Random Number Generator (PRNG) provides applications with a stream of
134: numbers which have certain important properties for system security:<p>
135:
136: <ul>
1.11 deraadt 137: <li>It should be impossible for an outsider to predict the output of the
138: random number generator even with knowledge of previous output.
139: <li>The generated numbers should not have repeating patterns which means
140: the PRNG should have a very long cycle length.
1.10 deraadt 141: </ul>
1.32 deraadt 142: <p>
1.10 deraadt 143:
1.13 deraadt 144: A PRNG is normally just an algorithm where the same initial starting
145: values will yield the same sequence of outputs. On a multiuser
146: operating system there are many sources which allow seeding the PRNG
147: with random data. The OpenBSD kernel uses the mouse interrupt timing,
148: network data interrupt latency, inter-keypress timing and disk IO
149: information to fill an entropy pool. Random numbers are available for
150: kernel routines and are exported via devices to userland programs.
1.36 deraadt 151: So far random numbers are used in the following places:<p>
1.13 deraadt 152:
1.10 deraadt 153: <ul>
1.14 deraadt 154: <li>Dynamic sin_port allocation in bind(2).
155: <li>PIDs of processes.
1.26 aaron 156: <li>IP datagram IDs.
1.14 deraadt 157: <li>RPC transaction IDs (XID).
158: <li>NFS RPC transaction IDs (XID).
159: <li>DNS Query-IDs.
160: <li>Inode generation numbers, see getfh(2) and fsirand(8).
1.31 aaron 161: <li>Timing perturbance in traceroute(8).
1.14 deraadt 162: <li>Stronger temporary names for mktemp(3) and mkstemp(3)
163: <li>Randomness added to the TCP ISS value for protection against
164: spoofing attacks.
1.29 deraadt 165: <li>random padding in IPSEC esp_old packets.
1.14 deraadt 166: <li>To generate salts for the various password algorithms.
167: <li>For generating fake S/Key challenges.
1.44 provos 168: <li>In <a href=http://www.physnet.uni-hamburg.de/provos/photuris/>photurisd</a>
1.28 angelos 169: and <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd>isakmpd</a>
170: to provide liveness proof of key exchanges.
1.10 deraadt 171: </ul>
1.1 deraadt 172:
1.10 deraadt 173: <p>
1.18 deraadt 174: <a name=hash></a>
1.42 deraadt 175: <h3><font color=#e00000>Cryptographic Hash Functions</font></h3><p>
1.32 deraadt 176:
1.10 deraadt 177: A Hash Function compresses its input data to a string of
1.36 deraadt 178: constant size. For a Cryptographic Hash Function it is infeasible to find:
179:
1.1 deraadt 180: <ul>
1.11 deraadt 181: <li>two inputs which have the same output (collision resistant),
182: <li>a different input for a given input with the same output
183: (2nd preimage resistant).
1.1 deraadt 184: </ul>
1.32 deraadt 185: <p>
1.10 deraadt 186:
1.12 millert 187: In OpenBSD MD5, SHA1, and RIPEMD-160 are used as Cryptographic Hash Functions,
1.36 deraadt 188: e.g:<p>
1.10 deraadt 189: <ul>
1.27 deraadt 190: <li>In <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=skey>S/Key</a>
191: to provide one time passwords.
192: <li>In <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec>IPsec</a>,
1.44 provos 193: <a href=http://www.physnet.uni-hamburg.de/provos/photuris/>photurisd</a>
1.27 deraadt 194: and
195: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd>isakmpd(8)</a>
196: to authenticate the data origin of packets and to ensure packet integrity.
197: <li>For FreeBSD-style MD5 passwords (not enabled by default), see
198: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=passwd.conf&sektion=5>
199: passwd.conf(5)</a>
200: <li>For TCP SYN cookie support (not enabled by default), see
201: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=options&sektion=4>
202: options(4)</a>
1.24 niklas 203: <li>In libssl for digital signing of messages.
1.10 deraadt 204: </ul>
1.32 deraadt 205: <p>
1.10 deraadt 206:
1.6 deraadt 207: <p>
1.18 deraadt 208: <a name=trans></a>
1.42 deraadt 209: <h3><font color=#e00000>Cryptographic Transforms</font></h3><p>
1.32 deraadt 210:
1.11 deraadt 211: Cryptographic Transforms are used to encrypt and decrypt data. These
212: are normally used with an encryption key for data encryption and with
213: a decryption key for data decryption. The security of a Cryptographic
214: Transform should rely only on the keying material.<p>
1.6 deraadt 215:
1.24 niklas 216: OpenBSD provides transforms like DES, 3DES, Blowfish and Cast for the
1.36 deraadt 217: kernel and userland programs, which are used in many places like:<p>
1.10 deraadt 218: <ul>
1.27 deraadt 219: <li>In libc for creating
220: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=blf_key>Blowfish</a>
1.33 deraadt 221: passwords. See also the <a href=papers/bcrypt-paper.ps>USENIX paper</a>
222: on this topic.
1.27 deraadt 223: <li>In
224: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=ipsec>IPsec</a>
225: to provide confidentiality for the network layer.
226: <li>In Kerberos and a handful of kerberized applications, like
227: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=telnet>telnet</a>,
228: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=cvs>cvs</a>,
229: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=rsh>rsh</a>,
230: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=rcp>rcp</a>,
231: and
232: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=rlogin>rlogin</a>.
1.44 provos 233: <li>In <a href=http://www.physnet.uni-hamburg.de/provos/photuris/>
1.27 deraadt 234: photurisd</a> and
235: <a href=http://www.openbsd.org/cgi-bin/man.cgi?query=isakmpd>isakmpd</a>
236: to protect the exchanges where IPsec key material is negotiated.
1.24 niklas 237: <li>In AFS to protect the messages passing over the network, providing
1.27 deraadt 238: confidentiality of remote filesystem access.
1.24 niklas 239: <li>In libssl to let applications communicate over the de-facto standard
240: cryptographically secure SSL protocol.
1.10 deraadt 241: </ul>
1.1 deraadt 242:
1.10 deraadt 243: <p>
1.51 deraadt 244: <a name=hardware></a>
245: <h3><font color=#e00000>Cryptographic Hardware Support</font></h3><p>
246:
247: OpenBSD starting with 2.7 supports some limited cryptography hardware.
248: <ul>
249: <li><b>IPSEC crypto dequeue</b><br>
250: Our IPSEC stack has been modified so that cryptographic functions get
251: done out-of-line. Most simple software IPSEC stacks need to do
252: cryptography when processing each packet. This results in syncronous
253: performance. To use hardware properly and speedily one needs to seperate
254: these two components, as we have done. Actually, doing this gains some
255: performance even for the software case.
256: <p>
257: <li><b>HiFn 7751</b><br>
1.53 ! deraadt 258: Cards using the <a href="http://www.hifn.com/products/7751.htm">HiFn 7751</a>
! 259: can be used as a cryptographic accelerator (ie.
1.51 deraadt 260: <a href="http://www.powercrypt.com">PowerCrypt</a>).
261: Current performance using a single Hifn 7751 on each end of a tunnel
262: is 63Mbit/sec for 3DES/SHA1 ESP, nearly a 600% improvement over
263: using a P3/550 cpu. Further improvements are under way to resolve a
264: few more issues, but as of April 13, 2000 the code is considered
1.53 ! deraadt 265: stable. We wrote our own driver for supporting this chip, rather
! 266: than using the (USA-written)
! 267: <a href="http://www.powercrypt.com">powercrypt</a> driver, as well
! 268: our driver links in properly to the IPSEC stack<p>
! 269: The 7751 is now considered slow by industry standards and many vendors
! 270: have faster chips (even HiFn now has a faster but more expensive
! 271: chip). We are moving towards supporting other chips such as:
! 272: <p>
! 273: <ul>
! 274: <li><a href="http://www.ire.com/OEM/OEMTechnologyDefault.htm">IRE 2141</a>
! 275: <li><a href="http://www.bluesteelnet.com/product.html">Bluesteelnet 5501</a>
! 276: <li><a href="http://www.pcc.pijnenburg.nl/pcc-ises.htm">Pijnenburg PCC-ISES</a>
! 277: <li>perhaps the
! 278: <a href="http://www.3com.com/promotions/3c990promo/index.html">3com 3c990</a>
! 279: <li>and others
! 280: </ul>
! 281: <p>
! 282: IRE and Bluesteelnet in particular have already been very
1.51 deraadt 283: friendly, and have given us all the information we need to support their
1.53 ! deraadt 284: hardware. Other vendors are on our list, but we are focusing on the
! 285: fast+cheap solutions first.
1.52 deraadt 286: Intel (and 3com to a lesser degree) don't yet fully understand how
287: they could benefit from giving us documentation for their cryptography
288: cards, so feel free to contact them independently and encourage them.
289: <p>
290: If people wish to help with writing drivers,
1.51 deraadt 291: <a href=#people>come and help us</a>.
292: <p>
293: <li><b>Intel 82802AB/82802AC Firmware Hub RNG</b><br>
294: The 82802 FWH chip (found on i810, i820, and i840 motherboards) contains
295: a random number generator (RNG). High-performance IPSEC requires more
296: random number entropy. As of April 10, 2000, we support the RNG. We
297: will add support for other RNG's found on crypto chips.
1.52 deraadt 298: <p>
299: <li><b>OpenSSL</b><br>
300: We have grand schemes for supporting crypto cards that can do RSA or DSA,
301: and exporting the functions of all crypto cards to OpenSSL so that
302: userland programs (ie. <a href="http://www.openssh.com">ssh</a>,
303: <a href="http://www.modssl.org/">apache https</a>, etc)
304: can benefit.
1.51 deraadt 305: </ul>
306:
307: <p>
1.32 deraadt 308: <a name=people></a>
1.42 deraadt 309: <h3><font color=#e00000>International Cryptographers Wanted</font></h3><p>
1.32 deraadt 310:
311: Of course, our project needs people to work on these systems. If any
312: non-American cryptographer who meets the constraints listed earlier is
313: interested in helping out with embedded cryptography in OpenBSD,
314: please contact us.<p>
315:
1.33 deraadt 316: <p>
317: <a name=papers></a>
1.42 deraadt 318: <h3><font color=#e00000>Further Reading</font></h3><p>
1.33 deraadt 319:
320: A number of papers have been written by OpenBSD team members, about
321: cryptographic changes they have done in OpenBSD. The postscript
1.34 deraadt 322: versions of these documents are available as follows.<p>
1.33 deraadt 323:
324: <ul>
1.43 deraadt 325: <li>A Future-Adaptable Password Scheme.<br>
1.49 deraadt 326: <a href=events.html#usenix99>Usenix 1999</a>,
1.43 deraadt 327: by <a href=mailto:provos@openbsd.org>Niels Provos<a/>,
328: <a href=mailto:dm@openbsd.org>David Mazieres</a>.<br>
1.33 deraadt 329: <a href=papers/bcrypt-paper.ps>paper</a> and
330: <a href=papers/bcrypt-slides.ps>slides</a>.
1.43 deraadt 331: <p>
332: <li>Cryptography in OpenBSD: An Overview.<br>
1.49 deraadt 333: <a href=events.html#usenix99>Usenix 1999</a>,
1.43 deraadt 334: by <a href=mailto:deraadt@openbsd.org>Theo de Raadt</a>,
335: <a href=mailto:niklas@openbsd.org>Niklas Hallqvist</a>,
336: <a href=mailto:art@openbsd.org>Artur Grabowski</a>,
337: <a href=mailto:angelos@openbsd.org>Angelos D. Keromytis</a>,
338: <a href=mailto:provos@openbsd.org>Niels Provos</a>.<br>
1.33 deraadt 339: <a href=papers/crypt-paper.ps>paper</a> and
340: <a href=papers/crypt-slides.ps>slides</a>.
341: </ul>
342:
1.32 deraadt 343: <p>
1.1 deraadt 344: <hr>
1.19 pauls 345: <a href=/index.html><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a>
1.10 deraadt 346: <a href=mailto:www@openbsd.org>www@openbsd.org</a>
347: <br>
1.53 ! deraadt 348: <small>$OpenBSD: crypto.html,v 1.52 2000/04/13 12:58:59 deraadt Exp $</small>
1.1 deraadt 349:
1.10 deraadt 350: </body>
351: </html>
![[BACK]](/icons/back.gif){kind=icon}
Return to crypto.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www