Home opinion-and-analysis Open Sauce Developer defends claims of backdoors in OpenBSD

The former OpenBSD developer who has caused a stir by claiming that the FBI had, through certain other OpenBSD developers, planted backdoors in its cryptographic code, says he raised the matter only to encourage a source code audit of the OpenBSD project.

Gregory Perry made the claim in an email to OpenBSD founder Theo de Raadt who posted the mail along with his comments to the openbsd-tech mailing list.

Perry, chief executive of a company named GoVirtual, told iTWire: "I have absolutely, positively nothing to gain from making those statements to Theo, and only did so to encourage a source code audit of the OpenBSD Project based upon the expiry of my NDA with the FBI. Being in any limelight is not my bag at all."

An audit of the cryptographic code has commenced and de Raadt told iTWire yesterday that two bugs had been found.

Perry said he had sent a private email to de Raadt, urging him to perform a source code audit of the OpenBSD Project based upon the allegations contained within the mail.

"Theo then sent, without my permission and against my wishes, the entire contents of that email with my contact particulars to a public listserver, which ignited this firestorm of controversy that I am now seemingly embroiled in," he said.

"If I had this to do over again, I would have sent an anonymous postcard to WikiLeaks probably."

In his email to de Raadt, Perry had mentioned two names - Scott Lowe and Jason Wright - and also spoken of other unnamed developers who were involved in allegedly planting the backdoors. Both Lowe and Wright have denied being involved in planting any backdoors.

"I personally hired and managed Jason Wright as well as several other developers that were involved with the OpenBSD Project," Perry said.

"I am intimately familiar with OpenBSD, having used it for a variety of commercial products over the years, and I arranged the initial funding for the cryptographic hardware accelerated OCF and gigabit Ethernet drivers by way of a series of disbursements of equipment and development monies made available via NETSEC (as well as my own personal donations) to the OpenBSD Project."

Perry said that although he did not agree with what de Raadt had done, "I will say that he is a brilliant and very respected individual in the computer security community and he would have in no way agreed to intentionally weaken the security of his project.

"Theo is an iron-fisted fascist when it comes to secure systems architecture, design, and development, and there is no better person than him and his team to get to the bottom of any purported issues with the OpenBSD security controls and its various internal cryptographic frameworks."

He added: "Many, many commercial security products and real time embedded systems are derived from the OpenBSD Project, due to Theo's liberal BSD licensing approach contrasted with other Linux-based operating systems licensed under the GPL.

"Many, many commercial security products and embedded systems are directly and proximately affected by any lapse in security - unintentional or otherwise - by the OpenBSD Project.

"Almost every operating system on the planet uses the OpenSSH server suite, which Theo and his team created with almost zero remuneration from the many operating systems and commercial products that use it without credit to the OpenBSD Project.

"Given the many thousands of lines of code that the IPSEC stack, OCF, and OpenSSL libraries consist of, it will be several months before the dust settles and the true impact of any vulnerabilities can be accurately determined; it's only been about 96 hours since their source code audit commenced and your recent article points to at least two vulnerabilities discovered so far."


Download an in-depth guide to managing a healthy, motivated and energetic workforce without breaking the bank.


Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.






Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities