Marsh Ray's analysis of the OpenBSD IPSEC ESP flaw

extendedsubset.com

36 points·tptacek··5 comments

Deleted comment

IIRC, the US policy of restricting cryptography applied mainly to exports, not use within the States. While the constitution gives you the right to bear arms, the argument is that it doesn't give you the right to send them to possible subversives in Timbuktu.

To get around that, developers used the First Amendment in a very interesting way: while this law was intact, crypto code developed in the USA was distributed internationally by printing out the source code, binding it in volumes as a book (and, thus, protected by Free Speech), then shipping it abroad where it was scanned (by machine or humans, I cannot recall) and compiled.

Source: http://www.pcworld.com/article/5190/pgp_5_export_the_lowtech...

This is basically a stunt. The reality is, export controls really did make it a giant pain to ship software, they really did weaken crypto for everyone (by prompting vendors to ship "export-grade" crypto versions), and the policy was genuinely effective despite nerdy moves like "printing the code in a book". Meanwhile, the underlying science of cryptography was published in academic journals and free to the world; the only people who suffered were developers and end-users.

I'm not sure how that helps here; despite your right to keep and bear arms, you most certainly can't export them freely.

Left out of all of this is that Sam Leffler found this bug when he was incorporating the OCF into FreeBSD.

Yet the team at OpenBSD has never credited him.

Why?

Reply on news.ycombinator.com