Voici un message re\u00e7u aujourd’hui via la liste de diffusion OpenBSD :<\/p>\n
Return-Path: <owner-security-announce+M96@openbsd.org>\nX-Original-To: xxxxxxxxxxx@xxxxxxxxxxx\nDelivered-To: xxxxxxxxxxx@xxxxxxxxxxx\nReceived: from shear.ucar.edu (lists.openbsd.org [192.43.244.163])\n\tby xxxxxxxxxxx (Postfix) with ESMTP id C13785174A\n\tfor <xxxxxxxxxxx@xxxxxxxxxxx>; Wed, 15 Dec 2010 02:37:56 +0100 (CET)\nReceived: from openbsd.org (localhost.ucar.edu [127.0.0.1])\n\tby shear.ucar.edu (8.14.3\/8.14.3) with ESMTP id oBF0vKWR008926;\n\tTue, 14 Dec 2010 17:57:20 -0700 (MST)\nReceived: from shear.ucar.edu (localhost.ucar.edu [127.0.0.1])\n\tby shear.ucar.edu (8.14.3\/8.14.3) with ESMTP id oBF0qUgX012766\n\t(version=TLSv1\/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO)\n\tfor <security-announce@openbsd.org>; Tue, 14 Dec 2010 17:52:30 -0700 (MST)\nReceived: (from root@localhost)\n\tby shear.ucar.edu (8.14.3\/8.14.3\/Submit) id oBF0qUaw015893;\n\tTue, 14 Dec 2010 17:52:30 -0700 (MST)\nReceived: from cvs.openbsd.org (cvs.openbsd.org [199.185.137.3])\n\tby shear.ucar.edu (8.14.3\/8.14.3) with ESMTP id oBELIRZ7022282 (version=TLSv1\/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=FAIL)\n\tfor <tech@shear.ucar.edu>; Tue, 14 Dec 2010 14:18:27 -0700 (MST)\nReceived: from cvs.openbsd.org (localhost [127.0.0.1])\n\tby cvs.openbsd.org (8.14.3\/8.12.1) with ESMTP id oBELIRnH002826\n\tfor <tech>; Tue, 14 Dec 2010 14:18:27 -0700 (MST)\nMessage-Id: <201012142118.oBELIRnH002826@cvs.openbsd.org>\nTo: security-announce@openbsd.org\nSubject: Allegations regarding OpenBSD IPSEC\nDate: Tue, 14 Dec 2010 14:18:27 -0700\nFrom: Theo de Raadt <deraadt@cvs.openbsd.org>\nList-Help: <mailto:majordomo@openbsd.org?body=help>\nList-Owner: <mailto:security-announce-owner@openbsd.org>\nList-Post: <mailto:security-announce@openbsd.org>\nList-Subscribe: <mailto:majordomo@openbsd.org?body=sub%20security-announce>\nList-Unsubscribe: <mailto:majordomo@openbsd.org?body=unsub%20security-announce>\nX-Loop: security-announce@openbsd.org\nPrecedence: list\nSender: owner-security-announce@openbsd.org\n\nI have received a mail regarding the early development of the OpenBSD\nIPSEC stack. It is alleged that some ex-developers (and the company\nthey worked for) accepted US government money to put backdoors into\nour network stack, in particular the IPSEC stack. Around 2000-2001.\n\nSince we had the first IPSEC stack available for free, large parts of\nthe code are now found in many other projects\/products. Over 10\nyears, the IPSEC code has gone through many changes and fixes, so it\nis unclear what the true impact of these allegations are.\n\nThe mail came in privately from a person I have not talked to for\nnearly 10 years. I refuse to become part of such a conspiracy, and\nwill not be talking to Gregory Perry about this. Therefore I am\nmaking it public so that\n (a) those who use the code can audit it for these problems,\n (b) those that are angry at the story can take other actions,\n (c) if it is not true, those who are being accused can defend themselves.\n\nOf course I don't like it when my private mail is forwarded. However\nthe \"little ethic\" of a private mail being forwarded is much smaller\nthan the \"big ethic\" of government paying companies to pay open source\ndevelopers (a member of a community-of-friends) to insert\nprivacy-invading holes in software.\n\n----\n\nFrom: Gregory Perry <Gregory.Perry@GoVirtual.tv>\nTo: \"deraadt@openbsd.org\" <deraadt@openbsd.org>\nSubject: OpenBSD Crypto Framework\nThread-Topic: OpenBSD Crypto Framework\nThread-Index: AcuZjuF6cT4gcSmqQv+Fo3\/+2m80eg==\nDate: Sat, 11 Dec 2010 23:55:25 +0000\nMessage-ID: <8D3222F9EB68474DA381831A120B1023019AC034@mbx021-e2-nj-5.exch021.domain.local>\nAccept-Language: en-US\nContent-Language: en-US\nX-MS-Has-Attach:\nX-MS-TNEF-Correlator:\nContent-Type: text\/plain; charset=\"iso-8859-1\"\nContent-Transfer-Encoding: quoted-printable\nMIME-Version: 1.0\nStatus: RO\n\nHello Theo,\n\nLong time no talk. If you will recall, a while back I was the CTO at\nNETSEC and arranged funding and donations for the OpenBSD Crypto\nFramework. At that same time I also did some consulting for the FBI,\nfor their GSA Technical Support Center, which was a cryptologic\nreverse engineering project aimed at backdooring and implementing key\nescrow mechanisms for smart card and other hardware-based computing\ntechnologies.\n\nMy NDA with the FBI has recently expired, and I wanted to make you\naware of the fact that the FBI implemented a number of backdoors and\nside channel key leaking mechanisms into the OCF, for the express\npurpose of monitoring the site to site VPN encryption system\nimplemented by EOUSA, the parent organization to the FBI. Jason\nWright and several other developers were responsible for those\nbackdoors, and you would be well advised to review any and all code\ncommits by Wright as well as the other developers he worked with\noriginating from NETSEC.\n\nThis is also probably the reason why you lost your DARPA funding, they\nmore than likely caught wind of the fact that those backdoors were\npresent and didn't want to create any derivative products based upon\nthe same.\n\nThis is also why several inside FBI folks have been recently\nadvocating the use of OpenBSD for VPN and firewalling implementations\nin virtualized environments, for example Scott Lowe is a well\nrespected author in virtualization circles who also happens top be on\nthe FBI payroll, and who has also recently published several tutorials\nfor the use of OpenBSD VMs in enterprise VMware vSphere deployments.\n\nMerry Christmas...\n\nGregory Perry\nChief Executive Officer\nGoVirtual Education\n\n\"VMware Training Products & Services\"\n\n540-645-6955 x111 (local)\n866-354-7369 x111 (toll free)\n540-931-9099 (mobile)\n877-648-0555 (fax)\n\nhttp:\/\/www.facebook.com\/GregoryVPerry\nhttp:\/\/www.facebook.com\/GoVirtua<\/pre>\nVrai ou faux?<\/p>\n
Cela montre si il en \u00e9tait encore besoin que la cryptographie est un \u00e9l\u00e9ment crucial de tout syst\u00e8me d’information moderne.<\/p>\n
En l’absence de syst\u00e8me librement auditable sur ce genre de sujet, point de salut…<\/p>\n","protected":false},"excerpt":{"rendered":"
Voici un message re\u00e7u aujourd’hui via la liste de diffusion OpenBSD : Return-Path: <owner-security-announce+M96@openbsd.org><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[2,73,3],"tags":[246,342,343],"_links":{"self":[{"href":"http:\/\/blog.nebule.org\/index.php?rest_route=\/wp\/v2\/posts\/34"}],"collection":[{"href":"http:\/\/blog.nebule.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.nebule.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.nebule.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.nebule.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=34"}],"version-history":[{"count":1,"href":"http:\/\/blog.nebule.org\/index.php?rest_route=\/wp\/v2\/posts\/34\/revisions"}],"predecessor-version":[{"id":2399,"href":"http:\/\/blog.nebule.org\/index.php?rest_route=\/wp\/v2\/posts\/34\/revisions\/2399"}],"wp:attachment":[{"href":"http:\/\/blog.nebule.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.nebule.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.nebule.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}