Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Encryption

DoD team nears Security Validation of OpenSSL 109

Posted by CmdrTaco from the something-to-think-about dept.
tadelste writes "An important DoD program took a page from Open Source and Do-It-Yourself-IT (DIYIT) and applied for their own Security Validation. In this article Steve Marquess says:as a taxpayer, I felt very annoyed. But it made me realize a couple of things. First, if OpenSSL had been validated, then it was possible for us to do it again. Secondly, if we could do it we could save a lot of money for the program."
This discussion has been archived. No new comments can be posted.

DoD team nears Security Validation of OpenSSL More

DoD team nears Security Validation of OpenSSL

Comments Filter:

  • More cost effective (Score:5, Insightful)

    by dogfart ( 601976 ) on Sunday July 04, 2004 @12:33PM (#9606448) Homepage Journal
    Looks like:
    • Government pays directly for certifying open source products
    • Private companies "use" the open source product in their own commercial (very expensive) offerings, pay for the certification, then sell the (largely open source) products at a substantial markup to the government
    You save a few pennies in the first option by no longer having the government pay for certification, but you lose many times over in the markup

    • Re:More cost effective (Score:4, Insightful)

      by WNight ( 23683 ) on Sunday July 04, 2004 @02:56PM (#9607312) Homepage
      If the government has an encrytion system they trust they don't bother buying products with a potentially flawed system, they simply run the unencrypted system over a VPN, or SSH.

      That way everyone saves. The applications can be developed more easily without redoing a specific encryption layer for every one. Nobody wastes money developing and verifying a redundant system.

      If the government simply accepted that contractors were going to base things on OpenSSL they'd need to verify every product, to make sure that nobody had accidently or intentionally, weakened it. By simply using the official signed and verified version they only have to trust their verification team once.

  • Ironic (Score:5, Insightful)

    by Pharmboy ( 216950 ) on Sunday July 04, 2004 @12:33PM (#9606457) Journal
    Since they are having to revalidate the same code others have already validated (albeit with some modifications) but its still a good thing to see DoD at least attempting to use my tax dollars smarter, by spending the time to formally validate open source software instead of buying proprietary software for hundreds of thousands of dollars, that contains basically the same code.

    Any time the Govt. decides to use Free software instead of MS stuff, I also sleep better at night, for several reasons.

    • Lemme get this straight ... (Score:4, Insightful)

      by jc42 ( 318812 ) on Sunday July 04, 2004 @01:00PM (#9606616) Homepage Journal
      They knew that OpenSSL had already been validated by several commercial vendors. So validating OpenSSL by itself should be a slam-dunk after they'd already done it N times. But suggesting that they just use OpenSSL for free rather than paying a commercial supplier for it is an "out of the box move" that "took guts"? As Dick Cheney might ask, WTF?

      Furthermore, it would be a big surprise if other parts of the military didn't have copies of OpenSSL lying about on a few thousand machines already, so they wouldn't even have to go through the motion of downloading and verifying the public version. I'd bet that it's already mirrored on any number of .mil sites.

      How can this idiocy be explained, other than by the theory that they shouldn't get something for free if they can spend money for the same thing and support a campaign contributor?

      It does sorta go along with the old stories of the Navy using Windows NT to control their hardware ...

      • It does not work this way. The other companies took SSL and enhanced. We do not know if those enhancements were to get around weaknesses or for the companies marketers. Now, by validating a base, it will make it possible to lower the costs for all.

        Now if the Linux community would take a base system and run it through all this and then add their own stuff. That would improve everybodies lot

      • Re:Lemme get this straight ... (Score:5, Insightful)

        by steveha ( 103154 ) on Sunday July 04, 2004 @02:06PM (#9607023) Homepage
        suggesting that they just use OpenSSL for free rather than paying a commercial supplier for it is an "out of the box move" that "took guts"?

        Yes.

        We are talking about a huge bureaucracy here, one that has procedures established. These guys bucked the procedures and did something different, rather than doing the safe and expected thing. I can well believe that this took guts.

        steveha
        • I was going to reply myself, but you put it well. The first rule of any Govt. employee is "don't get fired", and if you always take the safe way, you don't get fired.
        • We are talking about a huge bureaucracy here, one that has procedures established. These guys bucked the procedures and did something different, rather than doing the safe and expected thing. I can well believe that this took guts

          Today's radicals are tomorrow's conservatives.

      • There is a reason that most pencil pushers in the government really like expensive sofware. When something doesn't work its the vendors fault. Can't blame them. Not at all. They spent a lot of money on the product so the problems can not not not not be their fault.
        • Heh; I think you might have the "logic" right.

          Of course, there's also the venerable management principle that the more money (and people) you're in charge of, the more important you are. The capitalist ideologs like to claim that this is solely a problem in government. In fact, it's a generally-recognized management problem in all human organizations, and affects the corporate world as badly as any government.

          It's interesting that so much linux/OSS/free-software news is coming from governments. It doe

    • Re:Ironic (Score:1, Insightful)

      by Fweeky ( 41046 )
      OpenSSL is not Free software. That'd be the GNU TLS library [gnu.org]; OpenSSL is under a BSD-style license. Would you have prefered them to validate GNU TLS because it's Free?

      • OpenSSL *is* Free Software (Score:5, Informative)

        by lordcorusa ( 591938 ) on Sunday July 04, 2004 @01:22PM (#9606742)

        I really hate to get pedantic, but OpenSSL is Free Software. According [fsf.org] to the Free Software Foundation, the OpenSSL license is a Free Software license incompatible with the GPL.

        What you should have said is that the Free Software Foundation recommends developers use the GNU TLS library, but using OpenSSL in non-GPL projects is perfectly okay. Remember, GPL licensed software is only a subset of Free Software.

        • Fair enough. I guess the confusion arrises because the "Free Software Movement" typically refers only to GPL licensed stuff. I can certainly remember reading articles by such people as RMS whinging about the term "Free Software" being diluted by other less restrictive licenses, but that was so long ago I really don't remember the details.

          A little surprised OpenSSL isn't GPL compatible. Kind of ironic that it's compatible with closed source apps like my favourite SSH client [siliconcircus.com] but not with GPL software.
          • Free Software can be copied and modified and sold if you want, distributed in any way you want because it's just that. Free.

            GPL software is protected and can't be modified then sold for money without offering it for free (or for a small price to cover media costs) and must be shipped with source. I think.

            It's licenses are incompatable, not the software itself. Important distinction here.
            • Er, that's the point; you can't use OpenSSL in a GPL app, even if you're just dynamically linking the library in. The GPL wants to spread to cover the linked in library, but can't because the Apache license includes restrictions which aren't in the GPL -- much like the original BSD license.

              Sorry, did I come across as someone who doesn't know what these licenses mean?
            • GPL software is protected and can't be modified then sold for money without offering it for free (or for a small price to cover media costs) and must be shipped with source. I think.

              Sorta, but not really. I could paraphrase it here, but I think quoting the actual text is more effective:

              3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

              a) A

          • A little surprised OpenSSL isn't GPL compatible.

            It is GPL compatible. See this. [gnu.org] Any software that used a modern BSD license (without the advertising clause) is GPL compatible.

            The bitch is from BSD authors, because you can include BSD code into GPL projects, but you can't include GPL code into BSD projects. This is because BSD allows you to NOT release code for distributed binaries, and this is not allowed in the GPL.

            BSD is actually MORE Free than GPL (as an author, you can take other BSD code, make
            • Direct from said page:

              The license of OpenSSL is a conjunction of two licenses, One of them being the license of SSLeay. You must follow both. The combination results in a copyleft free software license that is incompatible with the GNU GPL. It also has an advertising clause like the original BSD license and the Apache license.

              Has this changed? The FAQ [openssl.org] suggests things are a little shaky.

              Not that I much care; BSD's my preferred license, FreeBSD is my preferred OS, so it's all good. Makes a change from th

              • Has this changed? The FAQ suggests things are a little shaky.

                Hmm, you are correct, it is not as clear as I thought. Fortunately, SCO is expending a lot of energy to make licensing and the GPL much more clear for the future... :)

                I am between the two. BSD is easier to like, but GPL does seem to give more protection that MS wont take your code and get rich from it without putting back into the community. The problem with sharing software on "the honor system" is not everyone is honorable. Its hard enoug
              • No, this hasn't changed. Since you are using FreeBSD you can look for yourself: /usr/src/crypto/openssl/LICENSE In fact, *both* licenses contain the advertising clause, plus the OpenSSL license contains restrictions on what you're allowed to name your derivative works. I suspect that this part also goes against the GPL. Having said all that, its possible that the government would prefer not to use a "forced-free" library when a "leniently-free" one is available. The line between "internal use" and "dis
      • OpenSSL is not Free software.

        BSD license qualifies as Free, according to the GNU project itself. So yes, OpenSSL is Free software.

        Software doesn't have to be GPL to be free, even RMS openly admits it. GPL is just his favorite brand of "free", since its his.

    • Re:Ironic (Score:3, Insightful)

      by Markus Registrada ( 642224 )
      What's more ironic is that they won't be able to apply fixes, including security fixes, without going through the whole process again. Since they can't afford to do that, they will be running "secure" code with known security holes.

      It's too bad they didn't certify GNU TLS instead.

    • more irony (Score:4, Insightful)

      by akb ( 39826 ) on Sunday July 04, 2004 @01:13PM (#9606689)
      After spending much effort scaring developers in the US out of working on open source crypto with its munitions export laws the DoD is now "importing" and spending money certifying munitions grade encryption from abroad. Same for the NSA with OpenBSD.

  • Govt saving money? OMG! (Score:5, Insightful)

    by SoTuA ( 683507 ) on Sunday July 04, 2004 @12:34PM (#9606462)
    Nice to see somebody put a bit of sense in govt. spending. Why license for thousands what you can get for free? Go OpenSSL!

    BTW, this shows some of the GPL-camp fears: Too-free (as in BSD) code packaged into propietary apps... some people will not realize they can get the exact same code for free.

    (the debate on "in licensing from private outfit you are paying for support of that free code" is left to the reader ;)

    • And how exactly does the GPL prevent those vendors from incorporating GPL material into their products?

      "Derived works", you'll say. Well, the whole point of this certification is that identically the same source is used, and this is checked at runtime by "cryptographic fingerprints". So there is no issue of changing the source code.

      A vendor will not risk submitting their income-producing work to the GPL because of the "derived work" clause, period. They will structure it so it is not derived work; for

      • And how exactly does the GPL prevent those vendors from incorporating GPL material into their products?

        They'll have to use it exactly as it is, or jump through hoops to interface it, or plain old use it without abiding with the terms of the GPL.

        Anyway, my post was not intended to stir controversy or argue the old GPL vs. BSD holy war, just pointing out that one of the GPL zealots' main fear was portrayed in the article.

  • Summary misleading (Score:5, Informative)

    by pavon ( 30274 ) on Sunday July 04, 2004 @12:37PM (#9606484)
    That summary is potentially misleading because it leaves out the reason why he was annoyed. Here is the whole paragraph:

    Because OpenSSL has a BSD-style license, many vendors simply grabbed the source code and incorporated it into their proprietary products. Those vendors wanted literally hundreds of thousands of dollars in licensing fees. As Steve attests, "as a taxpayer, I felt very annoyed. But it made me realize a couple of things. First, if OpenSSL had been validated, then it was possible for us to do it again. Secondly, if we could do it we could save a lot of money for the program."

    So he was annoyed at vendors who he thought were ripping the governent off, not at the wastefullness of the government auditing OpenSSL as I read the summary to say.
    • Validation is an expensive process, the vendors had to pay for it themselves so they were not necessarily 'ripping the government off'.
      • Yes, I'm sure they were just recouping their costs...
        • Heaven forbid someone makes money.
          • "Because OpenSSL has a BSD-style license, many vendors simply grabbed the source code and incorporated it into their proprietary products. Those vendors wanted literally hundreds of thousands of dollars in licensing fees.

            Steve Marquess, the technical manager of DMLSS, had no issue with vendors making money, it was the means they chose that annoyed him. If everyone in government felt as he did, taxpayers like you and me would have a lot more money in our pockets.

            • Re:Summary misleading (Score:4, Insightful)

              by 0racle ( 667029 ) on Sunday July 04, 2004 @01:45PM (#9606871)
              Yes they incorporated it into the product, meaning they aren't simply reselling OpenSSL libraries, but it is a part of a larger whole. Once again, quit whining about someone making money. Taxes won't go down simply because the government isn't spending as much money.
              • [T]hey aren't simply reselling OpenSSL libraries, but it is a part of a larger whole

                In which case how could a validated OpenSSL be an alternative?

              • "Yes they incorporated it into the product, meaning they aren't simply reselling OpenSSL libraries, but it is a part of a larger whole."

                Re-read the article. When the "National Security Agency promulgated a policy that required any military program using information assurance" to have NIST FIPS 140-2 validation, that "...led Steve Marquess, the technical manager of DMLSS, to the job of finding replacements for the OpenSSL libraries so prominently used in DMLSS." The article strongly implies their 'product'

              • They don't need to integrate it into their products. If they had a layered design you could use whatever encryption your organization trusted on top of the third-party software.

                That way these middle-ware companies wouldn't have to approve OpenSSL and they wouldn't have to pass the costs along. Cut out the middleman and everyone is happier because you get more product for less money, meaning you've got a more efficient economy. Considering this is something my taxes pay for, I like that.

                I'm glad to see a g

    • It's not a ripoff. (Score:3, Insightful)

      by Eevee ( 535658 )

      Remember, he spent 18 months getting just the OpenSSL libraries accredidated. If a company had two people assigned to the task of accrediting both product and the incorporated OpenSSL for a year; and if we assume 50K/year per person--that's a hundred-thousand before the company makes any profit. (And we're skipping the overhead of the manager, their office space, etc.)

      The fault here is in the government not having a pre-approved solution for the vendors to use.

      • The fault here is in the government not having a pre-approved solution for the vendors to use.

        Are you seriously suggesting that the government should validate software and then buy a repackaged version from a vendor? Are you a member of Congress?

        • Yes. (Score:2)

          by Eevee ( 535658 )

          That's exactly what I am suggesting.

          However, if you've never dealt with the government, you may be assuming the vendor would charge just as much for a pre-approved version as a version in which they have to redo the validation effort. Strangely enough, the government has a person, the Contracting Officer, who should monitor the contract and will (o.k., should) disallow this. Instead, the vendor would be allowed a modest fee for the cost of documentation and any further required testing.

          • I've worked on a number of federal government contracts. I'm well aware of what contract officers do, and they don't inspect code to determine its origin. Why should the government validate the free software (which is what you are apparently suggesting) and then pay the vendor to hand them a repackaged copy of said software, which is what the article is talking about? The software is free to begin with. If you're not in Congress, you must be CEO of EDS.

            • and they don't inspect code to determine its origin

              You'd have to be pretty dense not to notice the origin of the software if the document the vendor hands you for validation says exactly where it comes from. And even denser to allow a vendor to charge a man-year or two's worth of time for validation efforts if the documentation says the software had already been accreditated by the government for the level of security required by the contract.

              On the other hand, if they don't use the pre-validated softwa

              • You'd have to be pretty dense not to notice the origin of the software if the document the vendor hands you for validation says exactly where it comes from.

                We deliver code to the government all the time, and the government expects it to be ours. From the article:

                Because OpenSSL has a BSD-style license, many vendors simply grabbed the source code and incorporated it into their proprietary products. Those vendors wanted literally hundreds of thousands of dollars in licensing fees.

                Stepping back, we are

    • Re:Summary misleading (Score:4, Interesting)

      by ozbird ( 127571 ) on Sunday July 04, 2004 @06:16PM (#9608724)
      How many more of these rip-off stories before the BSD license is modified (or replaced with the GPL) to prevent commercial exploitation?

      While it may be good karma to freely share your code, there's no obligation for anyone using the code to be a good citizen and give back to the community. How do BSD developers feel about their taxpayer dollars being spent on software that they wrote, but almost certainly won't see one cent of it?
      • The fact that you got scored interesting shows just how culturally distanced the slashdot crowd is from reality.

        GPL isn't against profits. BSD isn't against profits. Many people choose the BSD license because they don't agree fully with the GPL agenda.

        People choose the BSD license because they are truly giving the software away without conditions and stipulations. They do understand that, and they don't mind if someone else turns a profit on it.

        If you've ever given someone money for a gift, do you com

  • I think this is a good thing. (Score:5, Insightful)

    by Mysticalfruit ( 533341 ) on Sunday July 04, 2004 @12:38PM (#9606489) Homepage Journal
    In a lot of cases, when software is been written to do X thing, the DoD will goto lengths to write it from top to bottom.

    OpenSSL has proven itself worthy on the battle field of the internet.

    If by using OpenSSL, the DoD can design better systems faster that allow our troops to be more efficient (i.e. deadlier) and it costs us less money and the DoD returns any bugs it finds to the community, I don't see how this is a bad thing.

  • some thoughts (Score:4, Interesting)

    by zoloto ( 586738 ) on Sunday July 04, 2004 @12:39PM (#9606493)
    With OpenSSL being validated by the government as secure, it makes me wonder when SELinux will have it's own distro (something a bit thinner than fedore). this kind of stuff is great, i love it.

  • good for this Steve guy (Score:3, Insightful)

    by Vlion ( 653369 ) on Sunday July 04, 2004 @12:50PM (#9606572) Journal
    He is working on saving the US government money. Wish there were more guys like him in the US gov. For non-US readers : The US government has issues of spending bloat. They spend way too much on stuff. Us taxpayers don't like that. X_X

  • Code fixes? Trustworthy compiler used? (Score:5, Insightful)

    by chiph ( 523845 ) on Sunday July 04, 2004 @01:20PM (#9606729)
    What happens when OpenSSL makes a code fix? Does it all have to be re-validated? Do they supply a signed MD5 hash that says: "These sources are authorized for compiling a FIPS-140 compliant binary"?

    There was a comment here on slashdot in the past few months (can't find it now) about if you want to create trustworthy code, you first need to trust every layer below it, and every tool used to create it. Did this team use a validated build of gcc to create their OpenSSL binaries?

    Chip H.
    • 'What happens when OpenSSL makes a code fix? Does it all have to be re-validated? Do they supply a signed MD5 hash that says: "These sources are authorized for compiling a FIPS-140 compliant binary"?' and this is different from a proprietary product how?
    • What happens when OpenSSL makes a code fix?

      Probably same thing as when a commercial vendor has to amend their library; you either stick with what you had (if the change is non-critical), revalidate or ignore the issue.

    • The article made it sound like they selected a few critical files(but not all or even most) -- "...sequester the critical parts of the source code so they would not be modified in the course of routine maintenance." .

      It also sounds like the used MD5 or SHA1 to validate what exactly must not change -- "...produce a mechanism by which cryptographic fingerprints could be chained from the original source code all the way to the final runtime executable.".

      And nope they did not test gcc or validate that the cod
    • OpenSSL is not gcc-dedpendant. Pretty much any C compiler will work. I'm sure there are compilers out there that are already proven for DoD use.

      -molo

  • cryptographic fingerprints (Score:4, Interesting)

    by artg ( 24127 ) on Sunday July 04, 2004 @01:30PM (#9606781)
    "Usually with FIPS 140 validation the vendor supplies binary code that is validated as if it were distributed to customers. FIPS 140 requires a runtime integrity check of the binary code. But open-source software is distributed in source code form. The trick here, then, was to produce a mechanism by which cryptographic fingerprints could be chained from the original source code all the way to the final runtime executable."

    This sounds a very useful technique for any software that's verified in source form but deployed in binary form : voting machines and Formula 1 ECUs come to mind. Anybody know if there are more details of how they solved it ?

  • Source code validated (Score:5, Insightful)

    by JDisk ( 82627 ) on Sunday July 04, 2004 @01:46PM (#9606879)
    First, kudos to the guy who took the hard way just to save the taxpayer some money. We need more people like him.

    But technically the interesting point of the certification id that they managed to get the source code certified. There is at least one other open souce product Crypto++ [cryptopp.com] that is also FIPS 140.2 validated [nist.gov] (Certificate #343 [nist.gov]). But they only managed to get a compiled package validated, which does help me to trust the code but not really to "sell" the library to PHBs. The article doesn't really go into how they did get NIST to validate the source code. Anybody know more details?

    • BTW, is it true that once you certify source code it means you have to also certify the compiler and the OS (host and target) to make it useful? Smth leads me to assume that linux+gcc combination has a long way to go towards this... :(

  • Too bad the Army can't use it: (Score:3, Insightful)

    by mgargett ( 114224 ) on Sunday July 04, 2004 @02:04PM (#9607010)
    It's too bad that the Army still won't be able to use it. If you look at Army Regulation 25-2 [army.mil] Section II, subsection 4-6, subsection k states:

    k. Use of "shareware" or "freeware" is prohibited unless specifically approved through IA personnel and by the DAA for a specific operational mission requirement and length of time when no approved IA product exists. Notify NETCOM RCIOs and the supporting RCERT/TNOSC of local software use approval.

    Thus, unless the local designating approving authority (DAA) is willing to accept the risk of the software, and it is a mission requirement when no approved software exists (which SSL does), the DA won't be using it anytime soon. The biggest problem will be that the DAA's will not want to accept local risk when another product that will do the job, and is approved will work.

    This regulation, while good intentioned, is really difficult to live with. Try finding a good non-freeware spyware remover. It's not easy.

Slashdot Top Deals

"An ounce of prevention is worth a ton of code." -- an anonymous programmer

Close