OpenBSD Cryptography

The Export Control List of Canada places no significant restriction on the export of cryptographic software, and is even more explicit about the free export of freely-available cryptographic software. Marc Plumb has done some research to test the cryptographic laws.

Hence the OpenBSD project has embedded cryptography into numerous places in the operating system. We require that the cryptographic software we use be freely available and with good licenses. We do not use cryptography with nasty patents. We also require that such software is from a countries with useful export licenses because we do not wish to break the laws of any country.

We use strong and weak crypto in different parts of the system:

• Strong blowfish based password entries with 128-bit salt and a strength-control mechanism for the system administrator.
• KerberosIV fully integrated.
• IPSEC with 10+ ciphers integrated into the OS.
• The IPSEC Photuris daemon.
• Strong random number components are used in numerous places.
• All the normal DES code is in libc (where it belongs).
• DNS id pseudo-randomization.
• (What have I missed?)

When we make OpenBSD releases or snapshots we do our build processes in free countries to assure that the sources and binaries we provide to users are free of tainting. In the past our release binary builds have been done in Canada, Sweden, and Germany.