Cryptography in Op enBSD: An Overview Theo de Raadt, Niklas Hallqvist, Artur Grab owski, Angelos D. Keromytis, Niels Provos fderaadt,niklas,art,angelos,provosg@op enbsd.org The OpenBSD Project Abstract trying to make their use as easy and, where p ossi- ble, transparent to the end user. Thus, more work Cryptographic mechanisms are an imp ortant se- is done in those mechanisms that can be used to curity comp onent of an op erating system in secur- provide transparent security, e.g., IPsec. ing the system itself and its communication paths. With this pap er, weintend to give a good overview Indeed, in many situations, cryptography is the of the cryptography currently distributed and used only to ol that can solve a particular problem, e.g., in Op enBSD, and of our plans for future work. We network-level security. While cryptography by it- hop e this will b e of interest b oth to end-users and ad- self do es not guarantee security, when applied cor- ministrators lo oking for b etter ways to protect their rectly, it can signi cantly improve overall security. host and networks, and to develop ers in other sys- Since one of the main fo ci of the Op enBSD system is tems free or otherwise that are considering sup- security,various cryptographic mechanisms are em- p orting some of these mechanisms. We should again ployed in a numb er of di erent roles. caution the readers, however, that cryptography This pap er gives an overview of the cryptography do es not solve all security problems in an op erat- employed in Op enBSD. We discuss the various com- ing system, and should not b e considered as an end p onents IPsec, SSL libraries, stronger password en- in itself, but rather as an imp ortant piece of the se- cryption, Kerb eros IV, random numb er generators, curity puzzle. etc., their role in system security, and their inter- actions with the rest of the system and, where ap- 1.1 Pap er Organization plicable, the network. The remainder of this pap er is organized as follows: section 2 describ es the various network 1 Intro duction security facilities implemented and supp orted in Op enBSD, section 3 covers the extensive use of ran- An imp ortant asp ect of security in a mo dern op- dom number generators, and section 4 brie y out- erating system is cryptographic services and mecha- lines our future plans in this area. Section 5 con- nisms. While not a security panacea, cryptography cludes the pap er. is sometimes the right to ol in solving certain prob- lems. In particular, cryptography is extremely useful in solving a numb er of security issues in the following 2 Communications Security three areas: In an increasingly networked environment, com- Network security. munications security supp ort in an OS is extremely Secure storage facilities. imp ortant. As there are di erent mechanisms and di erent layers where one may apply security, Pseudo- Random numb er generators. Op enBSD supp orts a number of security proto cols and mechanisms, some of whichwere develop ed or Since one of our goals in the Op enBSD pro ject even designed by our develop ers. In some cases, is to provide strong security,wehave implemented a there is considerable overlap in functionality. One numb er of proto cols and services in the base system. of our goals is to eventually make it transparentto An Op enBSD distribution thus has full supp ort for the end user which such security mechanism is in such mechanisms as IPsec, SSL, Kerb eros, etc, b eing use. una ected by exp ort restriction laws. Simply supp orting these mechanisms, however, is The following sections give a brief overview of not sucient for wide-spread use. We are constantly these mechanisms, some detail of their implemen- tation and integration in Op enBSD, and our plans The proto cols are ESP Encapsulating SecurityPay- for future work. As we already mentioned in sec- load [2, 15] and AH Authentication Header [1,14]. tion 1, we consider IPsec an extremely imp ortant Both provide integrity, authenticity, and replay pro- to ol in network security, b oth b ecause of its p oten- tection, while ESP adds con dentiality to the pic- tial for user-transparency and its exibility. This is ture. IPsec can also be made to protect IP data- re ected by the more thorough coverage of IPsec in grams for other hosts. The IPsec endp oints in this the text that follows. arrangement thereby b ecome security gateways and Other p opular mechanisms, such as SSH [38], are take part in a virtual private network VPN where not covered b ecause they are only part of our p orts ordinary IP packets are tunneled inside IPsec [36]. system. While virtually all the develop ers use SSH, Network-layer securityhasanumberofvery im- there is no free implementation we can add to our p ortant advantages over security at other layers of standard distribution. Furthermore, the currentver- the proto col stack. Network-layer proto cols are gen- sion of SSH is restricted by the RSA patentin the erally hidden from applications, which can there- US. We are waiting for a free implementation to b e- fore automatically and transparently take advantage come available as part of the IETF standardization of whatever network-layer encryption services that pro cess of SSH. Such an implementation would be host provides. Most imp ortantly, network-layer pro- linked with our libssl. to cols o er a remarkable exibility not available at higher or lower layers. They can provide security 2.1 SSL on an end-to-end securing the data between two hosts, route-to-route securing data passing over a In Op enBSD libssl provides a to olkit for the particular set of links, edge-to-edge securing data Secure So cket Layer SSL v2/v3 and Transp ort as it passes from a \secure" network to an \insecure" Layer Security TLS v1 [6] which provide strong one, or a combination of these. cryptographic protection for network communica- tion such as server authentication and data encryp- 2.2.2 Op eration tion. The Secure So cket Layer is currently used by web servers, e.g., Apache as shipp ed with Op enBSD, Central to b oth ESP and AH are an abstraction and browsers like Netscap e Communicator. In the called security asso ciation, or SA. In each SA there future, applications like telnet and ftp will be con- is information algorithm IDs, keys, etc. stored verted to use TLS, p ossibly even during our network describing how the wanted protection should be installation pro cess. setup. For two p eers to be able to communicate Due to patent restrictions, libssl in the they need matching SAs at each end. When de- Op enBSD distribution supp orts only digital signa- ciding what SA should be used for outb ound traf- tures with DSA [27], but an additional package is c, some kind of security p olicy database needs to provided for users outside the USA to add back b e consulted. In Op enBSD, this is currently imple- RSA-signature [19] supp ort. This is implemented mented as an extension to the routing table, where by providing two shared libraries: libssl.so.1.0 source/destination addresses, proto col, and p orts has only function stubs for RSA supp ort, while serve as selectors. libssl.so.1.1 contains full RSA supp ort. Notice Lo oking at the wire format, IPsec works by insert- that shared library minor-version number changes ing an extra header b etween the IP header and the typically indicate interface-transparent bug xes. payload. This header holds IPsec-sp eci c data, such as an anti-replay sequence numb er, cryptographic 2.2 IP Security IPsec synchronization data, and integritycheckvalues. If the security proto col in use is ESP, a cryptographic 2.2.1 Background transform is applied to the payload in-place, e ec- tively hiding the data. As an example, an UDP data- While IP has proven to be an ecient and robust gram protected by ESP is shown in gure 1. proto col when it comes to actually getting data across the Internet, it do es not inherently provide This mo de of op eration is called transp ort mo de, any protection of that data. There are no facili- as opp osed to tunnel mo de which is typically used ties to provide con dentiality, or to ensure the in- when a security gateway is protecting datagrams for tegrity or authenticityofIP[31] datagrams. In or- other hosts. Tunnel mo de di ers from transp ort der to remedy the securityweaknesses of IP, a pair mo de by the addition of a new, outer, IP header con- of proto cols collectively called IP Security, or IPsec sisting of the security gateways' addresses instead of [3, 16] for short, has b een standardized by the IETF. the actual source and destination, as shown in gure that has help ed us signi cantly in nding and xing ating further development. IP ESP UDP UDP bugs, and in motiv tly, the API used to setup and maintain the Header Header Header Data Recen KEY SA database was switched to the standard PF [23]. This API is much more exible than the old PF ENCAP interface. Available algorithms for Encrypted encryption are DES [26], 3DES, Cast-128, Blow- sh [35], and Skip jack supp ort for the latter, de- Figure 1: IPsec Transp ort Mo de spite its known weaknesses, was added after re- quests byUSGovernment agencies using our IPsec k.