[ILUG] Ubuntu/Debian OpenSSL question

[David Golden]

On Saturday 24 May 2008, James McCarthy wrote:

> I have to say I didn't know OpenSSH (default ssh on Linux boxen again)
> used ssl,  I  always thought the OpenBSD guys only used their own
> tools when it  came to encryption.

The OpenBSD project system imports/syncs their system SSL library from 
the OpenSSL project, perhaps with local changes. Hopefully not like the 
Debian local changes, though, and hopefully with the level of auditing 
and paranoia OpenBSD is known for.  Note how it lags several versions
behind (they backport relevant security fixes though).

http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/LICENSE

OpenBSD wasn't written from scratch, it was and is however pored over 
line-by-line trustworthy-enough-for-most-people's-needs* and competent 
individuals.  (The really intensive auditing only applies to the base 
system, not necessarily the packages though).  

Don't confuse 
{portable-openssh and openssl, running on $RANDOM_LINUX_OR_UNIX} 
with 
{openbsd-openssh and openbsd-local-fork-of-openssl, running on openbsd} 

though. Yeah, it's similar code with some of the same people writing it, 
but that "on $RANDOM_LINUX_OR_UNIX" bit sure introduces a whole lot of 
variables...


* Short of building and programming your own computer from scratch,
you tend to end up trusting _someone_.