Yesterday, we reported on the allegations made by Gregory Perry. He claims that 10 years ago, several developers were paid by the FBI to implement hidden backdoors into OpenBSD’s IPSEC stack. This has prompted a lot of speculation about the allegations’ validity, and less than 24 hours later, it has descended into one person’s word against that of others. Update: Jason Wright, too, denies all the allegations. “I will state clearly that I did not add backdoors to the OpenBSD operating system or the OpenBSD crypto framework (OCF). […] It is a baseless accusation the reason for which I cannot understand.”
Gregory Perry gave some additional background information to Robert McMillan, stating he did not intend for De Raadt to make the email public – although he doesn’t seem to object to it. The background he provides is incredibly detailed (too much to summarise – just read it yourself), which certainly does seem to lend some credibility to his claims. Then again, in this day and age, information is easy to come by.
He also details which parts of OpenBSD were considered targets. “The OCF was a target for side channel key leaking mechanisms, as well as pf (the stateful inspection packet filter), in addition to the gigabit Ethernet driver stack for the OpenBSD operating system,” Perry details, “All of those projects NETSEC donated engineers and equipment for, including the first revision of the OCF hardware acceleration framework based on the HiFN line of crypto accelerators.”
Perry further states that he also became the target of an official FISA investigation. “After I left NETSEC, I ended up becoming the recipient of a FISA-sanctioned investigation, presumably so that I would not talk about those various projects,” he explains, “My NDA recently expired so I am free to talk about whatever I wish.”
At least one person from Perry’s original allegations has denied any and all involvement. Perry mentioned Scott Lowe, and Brian Proffitt (best. Name. Ever.) decided to contact Scott Lowe – actually, he contacted two Scot Lowes, since there are two who fit the bill; these two Lowes have been mixed up before. Both of them denied the allegations made by Perry.
“Mr. Perry is mistaken. I am not, nor have I ever been, affiliated with or employed by the FBI or any other government agency. Likewise, I have not ever contributed a single line of code to OpenBSD; my advocacy is strictly due to appreciation of the project and nothing more,” Lowe 1 stated.
“I am not, nor have I ever been, on the FBI’s payroll, nor do I use or advocate the use of OpenBSD either personally or in my writing,” Lowe 2 stated.
So, we have a bit more background information from Perry, which might be of use to those investigating the case, and we have two Scot Lowes denying any involvement with the FBI. This is starting to sound like the start of an interesting, if not rather boring film (you know, because dramatic shots of people sending emails won’t draw the crowds).