Earlier this year I FOIAed the FBI for details on allegations of backdoor installed in the IPSEC stack in 2010, originally discussed by OpenBSD devs reddit / BSD ---------------------------------------------------------------------- Mcnst · 2019-07-24 18:56 Any non-Twitter way to take a look at what this is all about? BTW, I thought these agencies specifically use secret keywords for everything, so that you cannot FOIA anything about these sorts of topics, unless you know the secret keyword that the things go by. Can someone in the know explain what's going on here? Did they forget to use the keywords? Or what's the deal here? ---------------------------------------------------------------------- uranium4breakfast · 2019-07-26 13:03 [Here's the file that matters, but it's heavily redacted.](https://cdn .muckrock.com/foia_files/2019/07/19/Ecd74aeb090e009e1ede26e1a0fe860c18 4bb6797_Q52218_R348013_D2256726.pdf) ---------------------------------------------------------------------- TheGrandSchlonging · 2019-07-27 07:52 FBI DITU doesn't need backdoors in IPsec stacks, much less an actual SIGINT agency, because the developers of IPsec stacks are happy to supply their own unintentionally. Hell, the useless hipsters at Apple don't even bother importing fixes for *known* flaws (known in the sense that their upstream NetBSD has fixed them or that their upstream FreeBSD hasn't left them sitting around collecting dust in a report queue for years on end). Consider this: It takes only one person to spend a week or two diff'ing the OpenBSD, NetBSD, FreeBSD, and XNU IPv4/IPv6/IPsec trees and comparing the application of known fixes (whether they were announced in security advisories or were silent commits). Yet apparently FreeBSD and Apple lack the wherewithal to have someone do that and are too busy funding political activism, codes of conduct, and virtual-hug scoldings. There are no doubt people who mercilessly punish such sluggishness and misplaced priorities and who laugh to the bank -- I don't blame them. ~~As for the alleged OpenBSD backdoor, my understanding is that it was OpenBSD-specific and not something affecting all KAME-derived stacks. Therefore [...]~~ [Edit: I'm mixing up OpenBSD's history here. Their IPsec stack predates 2010 and wasn't a start-from-scratch consequence of the allegations. Also, I'm skeptical that focusing on the commits of the one or two individuals involved would've been rigorous enough. Often the developer who commits code isn't the one who wrote the code.] Honestly, with OpenBSD, it's a lot easier to exploit the fact that most users end up running out-of-date third-party software because (i) there are prohibitive delays in package builds; (ii) there are huge gaps in what gets backported to -stable ports; (iii) running -current snapshots is not something many admins are inclined to do on production servers, and it's still far from a seamless process for updating third-party software anyway. OpenBSD's unique security vigor and its admirable approach to mitigations unfortunately can't stop everything that can go wrong with third-party software. ---------------------------------------------------------------------- Kernigh · 2019-07-29 03:41 OpenBSD claims to be "[the first free operating system to provide an IPSec stack](https://www.openbsd.org/innovations.html)"; problems in OpenBSD's IPsec might have spread to other operating systems. [FreeBSD ipsec(4)](https://www.freebsd.org/cgi/man.cgi?query=ipsec&sektion=4&ap ropos=0&manpath=FreeBSD+12.0-RELEASE+and+Ports) and [NetBSD fast\_ipsec(4)](https://netbsd.gw.com/cgi-bin/man-cgi?fast_ipsec+4) "draw heavily on the OpenBSD implementation". The BSDs have been diverging for decades. TCP is different enough that FreeBSD, NetBSD, and OpenBSD have different TCP fingerprints in [pf.os(5)](https://man.openbsd.org/pf.os). WPA PSK uses [ifconfig(8)](https://man.openbsd.org/ifconfig.8) in OpenBSD but [wpa\_supplicant(8)](http://netbsd.gw.com/cgi-bin/man- cgi?wpa_supplicant+8+NetBSD-current) in NetBSD. IPsec is different enough that OpenBSD has [iked(8)](https://man.openbsd.org/iked.8), [ipsecctl(8)](https://man.openbsd.org/ipsecctl.8), [isakmpd(8)](https://man.openbsd.org/isakmpd.8), but NetBSD has [racoon(8)](http://netbsd.gw.com/cgi-bin/man- cgi?racoon+8.i386+NetBSD-8.1), [setkey(8)](http://netbsd.gw.com/cgi- bin/man-cgi?setkey+8.i386+NetBSD-8.1). There are so many differences that a problem would not stand out.