Slashdot Log In
OpenSSL Gets Cryptography Gift From Sun
Posted by
timothy
on Thu Sep 19, 2002 04:08 PM
from the curvaceousness dept.
from the curvaceousness dept.
Kataire writes "C|Net posted this story about how Sun Microsystems' has donated 'elliptic curve' encryption technology, (developed by Whitfield Diffie of Diffie-Hellman public key fame) to the OpenSSL project. This potentially means better encryption for lighter-weight systems such as PDAs."
This discussion has been archived.
No new comments can be posted.
OpenSSL Gets Cryptography Gift From Sun
|
Log In/Create an Account
| Top
| 217 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Great! (Score:4, Funny)
Re:Great! (Score:4, Funny)
You mean right now you let *your* palm *date* your friends? Ewww....
Re:Great! (Score:5, Interesting)
If strong encrypted money tokens were to be implemented on a wide scale for, say, Palm PocketPC, Zaurus, and maybe a special purpose StrongARM device, you could expect to see a cheap widespread secure electronic payment mechanism that you can use for micropayments.
Aside from the novelty of buying lunch with your PDA, this could be the next step towards truly secure electronic transfers. You can say goodbye to corporate privacy violations when you can pay for your online goods with secure anonymous electronic cash.
Imagine paying your peers in a P2P system for MP3s/OGGs/whatever. Providing fat bandwidth for P2P would be a potential money-maker, not merely a labor of love. Throw in an anonymizing protocol and you're selling MP3 bandwidth online securely and untraceably; the RIAA couldn't shut you down, because there'd be no way to figure out who you were.
That's the power of widespread strong crypto, especially in small devices.
Is this the same as featured before? (Score:1)
It's not really that surprising (Score:5, Insightful)
Re:It's not really that surprising (Score:4, Interesting)
No. I think it this move was designed to improve Apache's security and make it a greater e-commerce tool on solaris( and unix). Sun relizes that more sun webservers use apache then Iplanet so they are donating the code to openssl since apache uses it by default. And not to just attack Microsoft. However I do question the timing since newly discovered ssl flaw recently in IIS/IE is making headline news and CIO's nervous.
Something like this may have an impact in e-commerce purchasing decisions.
Re:It's not really that surprising (Score:4, Interesting)
I'll probably get modded out of commision for this, but I just really get tired of misspellings.
Even though I was on the netscape side, and got laid off, I'm still loyal to iPlanet. They gave me my start in the IT world (head Sysadmin for iPlanet Learning Solutions), and I can't thank them enough for it.
Ugggh.. (Score:2)
Shouldn't this be placed under a different section (Score:4, Interesting)
Nonetheless, it is great to see Sun contributing back to the community.
This does bring up one question in my mind though... could this be used in SSL acceleration cards to improve the effiency of the SSL 'processor' (i.e.: keep the same performance level while reducing the amount of power necessary)?
Re:Shouldn't this be placed under a different sect (Score:4, Interesting)
OpenSSH is a baby of openBSD, and OpenSSH depends on OpenSSL.
The Eliptic curve stuff was donated to OpenSSH team, not the OpenSSL group. So dreaming about this in your ssl accelerated card of the future is a bit silly. However, if openSSH team open sources the tech, and that tech is under bsd lisence, then maybe it will work its way down into the chip makers crypto designes.
Wrong. OpenSSL != OpenSSH (Score:5, Informative)
Not quite.
OpenSSL is maintained by OpenSSL core members: Ralf S. Engelschall, Ben Laurie, Mark J. Cox, Dr. Stephen Henson, and others developers. [openssl.org]
OpenSSH was written by OpenBSD members (Theo de Raadt, Niels Provos, Markus Friedl, Dug Song, and others). OpenSSH uses OpenSSL as a cryptographic library source (it is highly optimized for many processors).
When cryptography is outlawed, (Score:2, Insightful)
Kudos to Sun (Score:1)
Another fine donation by Sun. Congratulations to them for the offering.
Good for more then PDA's (Score:3, Insightful)
Re:Good for more then PDA's (Score:5, Informative)
elliptic curves? (Score:1)
so now (Score:1)
Offering from large companies (Score:5, Interesting)
Re:Offering from large companies (Score:4, Interesting)
denegrating this contribution as if it's a new position sun isn't very fair to their company or their developers.
Certicom SecureMemo? (Score:1)
Unfortunately, I think Certicom pulled the app from their site. Nice app.
Please say it's patented.. (Score:2, Flamebait)
Or... was that a rather evil thought? I'm not sure anymore, I'm so blinded by my zealotism.
Nice - but is it really necessary? (Score:1)
The article cites that current encryption technology is based on 17th and 18th century mathematics - so is quite a lot of other things that work very well indeed. Mathematics don't deteriorate.
Of course this is a Good Thing (tm), but I honestly don't think that many people will ever notice a difference.
Just what was donated? (Score:2)
8-10 years from now? (Score:2)
Supposedly, this offers encryption with less computational demand. And, supposedly, it's not going to be in use for 5 to 10 years.
If that's the case, my quesion is this: Why bother? Moore's law says that in the 10 years that it will take to get this implemented, CPU's will be *64 times faster* than they are today.
Just think: "Wow! With this new encryption technology, encrypted 100 megabit networking only takes 0.05% of my processer instead of 0.1%!"
steve
Certicom has done commercial ECC for years (Score:2)
Securing edge of network devices (Score:2, Insightful)
As it stands now, having a wireless network could be a blessing. Information available at your finger tips. PDAs have never been a strong focal point for security in my experience. It will be great to see a network that can be truly encrypted end to end.
Now if only the user friendliness of this made it so that even the ordinary citizen could use it.
Bush's advisor present, official government suppor (Score:5, Funny)
The NSA can already crack it.
Why don't they release a OPENSSL patch for Cobalts (Score:2, Offtopic)
The BSD license is evil (Score:1, Flamebait)
Whitfield Diffie did NOT invent ECC (Score:5, Informative)
Elliptic curve cryptography was indepentantly
invented by Neal Koblitz [washington.edu], Professor of Mathematics at the University of Washington and Victor Miller who was then at IBM.
(Source [certicom.com])
Whitfield Diffie is Sun's chief security officer, and co-invented public-key cryptography.
Merkle invented public-key cryptography (too) (Score:5, Informative)
Actually, Ralph Merkle invented public-key cryptography (too). Merkle's article was SUBMITTED first, though the Diffie-Hellman article was PUBLISHED first while Merkle's was still going through the review process.
Not to disparage any of 'em. Merkle and Diffie & Hellman both invented it separately.
And for you people who follow Nanotech and/or Cryonics, yes it's THAT Ralph Merkle (who didn't invent either cryonics or nanotech, though he does much great work to advance them).
Sounds like something 'the tick' would say (Score:4, Funny)
not to sound bitter... (Score:2, Interesting)
My crypto lib has supported [non-P1363] ECC crypto since quite sometime now. Big deal.
http://libtomcrypt.sunsite.dk
or
http://tom.i
I use ECC in the traditional ElGamal method without standard packet formats. But the idea is the same...
Tom
License? (Score:4, Interesting)
Not such a big deal, you might say, but there are two big problems with this: 1) It's incompatible with GNU GPL, so no straight GPL software can use OpenSSL, and 2) it causes huge practical problems [gnu.org].
Theses issues are a big [debian.org] problems [debian.org] for [debian.org] Debian [debian.org], in particular.
I'm really unclear what Sun is 'gifting' here... (Score:2)
sun labs (Score:3, Informative)
encryption (Score:1)
Three types of elliptic curves (Score:3, Insightful)
I wonder which curves can be used with the code offered by Sun.
Theo's take (Score:1)
From: Theo de Raadt
To: misc@cvs.openbsd.org
Subject: openssl
some of you asked us what that ECC donation from Sun to OpenSSL means.
so what does it mean?
it means that OpenSSL is becoming a non-free software project, because
the code from Sun contains licenses which invoke patent litigation;
the licence on the new code basically builds a contract that says "if
you use this code, you cannot sue Sun".
In such a way, by means of the slippery slope, a free software project
becomes not as free, and eventually, less and less free.
Before anyone speaks up about and says "that restriction does not
affect me". It does indirectly affect you. It means that some other
vendor that uses this code, and subsequently ends up having a spat
with Sun, ends up wasting money on legal efforts, and our entire
society pays for that. My take on it, is that this is the way the
legal industry ensures itself future work.
On the other hand, here in OpenBSD land we will continue to strive to
make our software more and more free. We've been squishing odd
license terms which contain non-free restrictions throughout the
source tree for about 2 years now.
once again, i think it is time to fork OpenSSL. It's obviously run by
a bunch of people who don't think through the legal implications of
their actions. they should NOT have accepted that code without it
being 100% free.
This donation is not free code. Shame on you Sun, and double shame on
you OpenSSL.
Sun FAQ (Score:2)
http://research.sun.com/projects/crypto/Frequenly
It includes technical information and answers questions some people had about licensing.
Re:If only Pocket IE supports it... (Score:1)
Re:Get some PRIORITIES! (Score:1)
Re:This rocks (Score:1)
Re:NeXT, did NOT invent ECC. (Score:4, Informative)
Sorry, Ellipitic curve cryptography was invented independantly by Neal Koblitz, Professor of Mathematics at the University of Washington and Victor Miller who was then at IBM.
(Source [certicom.com])
Re:Why is this significant? (Score:3, Interesting)
ECC uses smaller keys, which is suitable for very small networked devices like network appliances, that use cheap (<$1) 8-bit microprocessors with very small amounts of NVRAM.
Is eliptic curve cryptography actually faster than RSA?
Yes, which is the major advantage over RSA, more important in most applications than the storage of smaller keys. I don't know exactly but I estimate in the area of 10 to 100 times faster for "equal" level of confidence in security.
And if it IS faster, wouldn't it be much more useful for web servers than for PDAs?
Think mobile phones, or cheap network household appliances with 8 and 16-bit microprocessors with clock speeds less than 12MHz. It also means lower power comsumption which is important for most battery powered devices.
Re:BSD?? (Score:2, Informative)
Re:Why is *Sun* getting the nod for this technolog (Score:1)