Openbsd som är känd som ett av de mest säkra operativsystemen kommer nu skakas om i sina grundvalar om vad Gregory Perry, tidigare CTO på Netsec, skriver är sant.

I ett privat meddelande till Openbsds projektledare Theo de Raadt påstår han att FBI planterat en bakdörr i Openbsds ipsec-stack som används för säker kryptering som gör det möjligt att övervaka trafiken.

Bakdörren, om den finns, är allvarlig då openbsd används i ett flertal brandväggar, både proprietära och öppna. Koden till bsd är vida spridd då den kan användas i både stängda och öppna lösningar. Bland annat har Microsoft tidigare använt kod från bsd i sin tcpip.

Theo de Raadt väljer göra meddelandet publikt samtidigt som han röjer Gregory Perrys identitet, vilket han rättfärdigar med att "den 'lilla etiken', att offentliggöra ett privatmeddelande, inte väger upp mot den 'stora etiken', att offentliggöra anklagelserna.

Vi väljer att publicera Gregory Perrys meddelande i sin helhet nedan:

Hello Theo,

Long time no talk. If you will recall, a while back I was the CTO at NETSEC and arranged funding and donations for the OpenBSD Crypto Framework. At that same time I also did some consulting for the FBI, for their GSA Technical Support Center, which was a cryptologic reverse engineering project aimed at backdooring and implementing key escrow mechanisms for smart card and other hardware-based computing technologies.

My NDA with the FBI has recently expired, and I wanted to make you aware of the fact that the FBI implemented a number of backdoors and side channel key leaking mechanisms into the OCF, for the express purpose of monitoring the site to site VPN encryption system implemented by EOUSA, the parent organization to the FBI. Jason Wright and several other developers were responsible for those backdoors, and you would be well advised to review any and all code commits by Wright as well as the other developers he worked with originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn't want to create any derivative products based upon the same.

This is also why several inside FBI folks have been recently advocating the use of OpenBSD for VPN and firewalling implementations in virtualized environments, for example Scott Lowe is a well respected author in virtualization circles who also happens top be on the FBI payroll, and who has also recently published several tutorials for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas...

Gregory Perry
Chief Executive Officer
GoVirtual Education