BSD project leader Theo de Raadt received an email from former NETSEC CTO Gregory Perry in which Perry claims he helped FBI to plant backdoors in OpenBSD Cryptographic Framework:

My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI.»

Some say the leaking mechanisms could be placed on the IPSEC stack.

If this didn’t look bad enough, Perry also suggests that DARPA withdrew his funding on OpenBSD because of this.

From openbsd-tech, via arstechnica.

If you haven’t read this, it’s never too late…

P.S: see SNAFU principle.

UPDATE:

Jason Wright’s response and clear denial.

I’ll put my money where my mouth is.

IPsec gossip.

OpenBSD is a great product, but y’all are too easily trolled.

His NDA with the FBI *expired* so he 1) discloses information that’s
privileged at the very least and a political stick of dynamite at
worst, 2) discloses it in a private forum to an individual known for
his transparency and total lack of tact, 3) doesn’t bother contacting
anyone in the press about it, 4) claims to know various other pundits
are «on the FBI payroll,» and 5) claims that the FBI deliberately
compromised an open source project in order to spy on its parent
organization and other government agencies.

Here’s a tip: when a government organization works with private
contractors to help them spy on other government organizations, those
NDAs don’t fucking expire.

Jesus.»

See original message.

LATERAL:

_NSAKEY.

New UPDATE:

OpenBSD code audit uncovers bugs, but no evidence of backdoor (arstechnica). It does not mean that the audit of the thousands of lines of code involved is over. We’ll have to wait for some months to get a reliable result.

More:

how i stopped worrying and loved the backdoor.

My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI.