Misplaced Pages

#255744

52-479: DJB may refer to: Daniel J. Bernstein (born 1971), American mathematician. DJB Foundation Enough is Enough ( Dosta je bilo ), a political party in Serbia IATA code for Sultan Thaha Airport German Judo Federation ( Deutscher Judo-Bund ) Topics referred to by the same term [REDACTED] This disambiguation page lists articles associated with

104-605: A Ph.D. in mathematics from the University of California, Berkeley (1995), where he studied under Hendrik Lenstra . The export of cryptography from the United States was controlled as a munition starting from the Cold War until recategorization in 1996, with further relaxation in the late 1990s. In 1995, Bernstein brought the court case Bernstein v. United States . The ruling in the case declared that software

156-601: A basis for elliptic curve cryptography ; it is employed in Ed25519 implementation of EdDSA . In February 2015, Bernstein and others published a paper on a stateless post-quantum hash-based signature scheme called SPHINCS. In July 2022, SPHINCS+, a signature scheme adapted from SPHINCS by Bernstein and others, was one of four algorithms selected as winners of the NIST Post-Quantum Cryptography Standardization competition. It

208-402: A bug is found, including examining the entire source tree for the same and similar issues, "try[ing] to find out whether the documentation ought to be amended", and investigating whether "it's possible to augment the compiler to warn against this specific problem." The OpenBSD website features a prominent reference to the system's security record. Until June 2002, it read: Five years without

260-398: A new one from scratch. OpenBSD has its own NTPd, SMTPd and, more recently, HTTPd. They work great". As a result, OpenBSD is relatively prolific in creating components that become widely reused by other systems. OpenBSD runs nearly all of its standard daemons within chroot and privsep security structures by default, as part of hardening the base system. The Calgary Internet Exchange

312-691: A proposal," which suggested that, if physical hardware implementations could be brought close to their theoretical efficiency, the then-popular estimates of adequate security parameters might be off by a factor of three. Since 512-bit RSA was breakable at the time, so might be 1536-bit RSA. Bernstein was careful not to make any actual predictions, and emphasized the importance of correctly interpreting asymptotic expressions. Several prominent researchers (among them Arjen Lenstra , Adi Shamir , Jim Tomlinson, and Eran Tromer ) disagreed strongly with Bernstein's conclusions. Bernstein has received funding to investigate whether this potential can be realized. Bernstein

364-632: A public high school on Long Island , graduating in 1987 at the age of 15. The same year, he ranked fifth in the Westinghouse Science Talent Search . In 1987 (at the age of 16), he achieved a Top 10 ranking in the William Lowell Putnam Mathematical Competition , and was a member of the second-place team from Princeton University the following year. Bernstein earned a B.A. in mathematics from New York University (1991) and

416-574: A remote hole in the default install! In June 2002, Mark Dowd of Internet Security Systems disclosed a bug in the OpenSSH code implementing challenge–response authentication . This vulnerability in the OpenBSD default installation allowed an attacker remote access to the root account, which was extremely serious not only to OpenBSD, but also to the large number of other operating systems that were using OpenSSH by that time. This problem necessitated

468-673: A security flaw in djbdns . In August 2008, Bernstein announced DNSCurve , a proposal to secure the Domain Name System . DNSCurve applies techniques from elliptic curve cryptography with the goal of providing a vast increase in performance over the RSA public-key algorithm used by DNSSEC . It uses the existing DNS hierarchy to propagate trust by embedding public keys into specially formatted, backward-compatible DNS records. Bernstein proposed Internet Mail 2000 , an alternative system for electronic mail, which he intended to replace

520-469: A significant part of them are "useless at best and based on pure luck and superstition", arguing for a more rational approach when it comes to designing them. Many open source projects started as components of OpenBSD, including: Some subsystems have been integrated into other BSD operating systems, and many are available as packages for use in other Unix-like systems. Linux administrator Carlos Fenollosa commented on moving from Linux to OpenBSD that

572-439: A song. OpenBSD is known for its high-quality documentation. When OpenBSD was created, De Raadt decided that the source code should be available for anyone to read. At the time, a small team of developers generally had access to a project's source code. Chuck Cranor and De Raadt concluded this practice was "counter to the open source philosophy" and inconvenient to potential contributors. Together, Cranor and De Raadt set up

SECTION 10

#1732779596256

624-609: A talk at the CCC as well as DEF CON , entitled "Are all BSDs created equally? — A survey of BSD kernel vulnerabilities", in which he stated that although OpenBSD was the clear winner of the BSDs in terms of security, "Bugs are still easy to find in those kernels, even in OpenBSD". Two years later, in 2019, a talk named "A systematic evaluation of OpenBSD's mitigations" was given at the CCC, arguing that while OpenBSD has some effective mitigations,

676-425: Is also the author of the mathematical libraries DJBFFT, a fast portable FFT library, and primegen , an asymptotically fast small prime sieve with low memory footprint based on the sieve of Atkin (rather than the more usual sieve of Eratosthenes ). Both have been used effectively in the search for large prime numbers . In 2007, Bernstein proposed the use of a (twisted) Edwards curve , Curve25519 , as

728-417: Is based on the original SSH . It first appeared in OpenBSD 2.6 and is now by far the most popular SSH client and server, available on many operating systems. The project has a policy of continually auditing source code for problems, work that developer Marc Espie has described as "never finished ... more a question of process than of a specific bug being hunted." He went on to list several typical steps once

780-499: Is continuous, and team management is open and tiered. Anyone with appropriate skills may contribute, with commit rights being awarded on merit and De Raadt acting as coordinator. Two official releases are made per year, with the version number incremented by 0.1, and these are each supported for twelve months (two release cycles). Snapshot releases are also available at frequent intervals. Maintenance patches for supported releases may be applied using syspatch , manually or by updating

832-532: Is divided into small sections and each section is encrypted with its own key, ensuring that sensitive data does not leak into an insecure part of the system. OpenBSD randomizes various behaviors of applications, making them less predictable and thus more difficult to attack. For example, PIDs are created and associated randomly to processes; the bind system call uses random port numbers ; files are created with random inode numbers; and IP datagrams have random identifiers. This approach also helps expose bugs in

884-507: Is hard to determine how widely OpenBSD is used, because the developers do not publish or collect usage statistics. In September 2005, the BSD Certification Group surveyed 4330 individual BSD users, showing that 32.8% used OpenBSD, behind FreeBSD with 77%, ahead of NetBSD with 16.3% and DragonFly BSD with 2.6% . However, the authors of this survey clarified that it is neither "exhaustive" nor "completely accurate", since

936-492: Is strongly recommended for end users, in contrast to operating systems that recommend user kernel customization. Packages outside the base system are maintained by CVS through a ports tree and are the responsibility of the individual maintainers, known as porters. As well as keeping the current branch up to date, porters are expected to apply appropriate bug-fixes and maintenance fixes to branches of their package for OpenBSD's supported releases. Ports are generally not subject to

988-474: Is supported for one year. On 25 July 2007, OpenBSD developer Bob Beck announced the formation of the OpenBSD Foundation , a Canadian non-profit organization formed to "act as a single point of contact for persons and organizations requiring a legal entity to deal with when they wish to support OpenBSD." In 2024, it announced that the project has modified all files since the original import. It

1040-517: Is widely used for Internet security. Many protocols based on his works have been adopted by various standards organizations and are used in a variety of applications , such as Apple iOS , the Linux kernel, OpenSSH , and Tor . In spring 2005, Bernstein taught a course on "high speed cryptography." He introduced new cache attacks against implementations of AES in the same time period. In April 2008, Bernstein's stream cipher " Salsa20 "

1092-563: The IPsec codebase. De Raadt's response was skeptical of the report and he invited all developers to independently review the relevant code. In the weeks that followed, bugs were fixed but no evidence of backdoors was found. De Raadt stated "I believe that NetSec was probably contracted to write backdoors as alleged. If those were written, I don't believe they made it into our tree. They might have been deployed as their own product." In December 2017, Ilja van Sprundel, director at IOActive , gave

SECTION 20

#1732779596256

1144-665: The National Security Agency , and researchers discovered a backdoor in the Agency's Dual EC DRBG algorithm. These events raised suspicions of the elliptic curve parameters proposed by NSA and standardized by NIST . Many researchers feared that the NSA had chosen curves that gave them a cryptanalytic advantage. Google selected ChaCha20 along with Bernstein's Poly1305 message authentication code for use in TLS , which

1196-626: The NetBSD project, was asked to resign from the NetBSD core team over disagreements and conflicts with the other members of the NetBSD team. In October 1995, De Raadt founded OpenBSD, a new project forked from NetBSD 1.0. The initial release, OpenBSD 1.2, was made in July 1996, followed by OpenBSD 2.0 in October of the same year. Since then, the project has issued a release every six months, each of which

1248-686: The Simple Mail Transfer Protocol (SMTP), the Post Office Protocol (POP3) and the Internet Message Access Protocol (IMAP). Bernstein is also known for his string hashing function djb2 and the cdb database library. Bernstein has published a number of papers on mathematics and computation . Many of his papers deal with algorithms or implementations. In 2001, Bernstein circulated "Circuits for integer factorization :

1300-573: The Windows operating system to provide Unix-like functionality, use much of the OpenBSD code base that is included in the Interix interoperability suite, developed by Softway Systems Inc., which Microsoft acquired in 1999. Core Force, a security product for Windows, is based on OpenBSD's pf firewall . The pf firewall is also found in other operating systems: including FreeBSD , and macOS . OpenBSD ships with Xenocara , an implementation of

1352-407: The X Window System , and is suitable as a desktop operating system for personal computers , including laptops. As of September 2018 , OpenBSD includes approximately 8000 packages in its software repository , including desktop environments such as Lumina , GNOME , KDE Plasma , and Xfce , and web browsers such as Firefox and Chromium . The project also includes three window managers in

1404-483: The elliptic curve Curve25519 as a basis for public-key schemes. He worked as the lead researcher on the Ed25519 version of EdDSA . The algorithms made their way into popular software. For example, since 2014, when OpenSSH is compiled without OpenSSL they power most of its operations, and OpenBSD package signing is based on Ed25519. Nearly a decade later, Edward Snowden disclosed mass surveillance by

1456-489: The file system , prohibiting it from accessing areas that contain private or system files. Developers have applied these enhancements to OpenBSD versions of many common applications, such as tcpdump , file , tmux , smtpd , and syslogd . OpenBSD developers were instrumental in the creation and development of OpenSSH (aka OpenBSD Secure Shell), which is developed in the OpenBSD CVS repositories. OpenBSD Secure Shell

1508-412: The principle of least privilege , where a program is split into two or more parts, one of which performs privileged operations and the other—almost always the bulk of the code—runs without privilege. Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of

1560-444: The adjustment of the slogan on the OpenBSD website to: One remote hole in the default install, in nearly 6 years! The quote remained unchanged as time passed, until on 13 March 2007, when Alfredo Ortega of Core Security Technologies disclosed a network-related remote vulnerability. The quote was subsequently changed to: Only two remote holes in the default install, in a heck of a long time! This statement has been criticized because

1612-627: The class published security advisories about the issues. OpenBSD OpenBSD is a security-focused , free software , Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. The OpenBSD project emphasizes portability , standardization , correctness , proactive security , and integrated cryptography . The OpenBSD project maintains portable versions of many subsystems as packages for other operating systems. Because of

DJB - Misplaced Pages Continue

1664-405: The default install contains few running services, and many use cases require additional services. Also, because the ports tree contains unaudited third-party software , it is easy for users to compromise security by installing or improperly configuring packages. However, the project maintains that the slogan is intended to refer to a default install and that it is correct by that measure. One of

1716-433: The first public, anonymous revision control system server. De Raadt's decision allowed users to "take a more active role", and established the project's commitment to open access. OpenBSD is notable for its continued use of CVS (more precisely an unreleased, OpenBSD-managed fork named OpenCVS), when most other projects that used it have migrated to other systems. OpenBSD does not include closed source binary drivers in

1768-399: The focus of the OpenBSD project. OpenBSD includes numerous features designed to improve security, such as: To reduce the risk of a vulnerability or misconfiguration allowing privilege escalation , many programs have been written or adapted to make use of privilege separation , privilege revocation and chrooting . Privilege separation is a technique, pioneered on OpenBSD and inspired by

1820-426: The fundamental ideas behind OpenBSD is a drive for systems to be simple, clean, and secure by default. The default install is quite minimal, which the project states is to ensure novice users "do not need to become security experts overnight", which fits with open-source and code auditing practices considered important elements of a security system. Additional services are to be enabled manually to make users think of

1872-537: The kernel and in user space programs. The OpenBSD policy on openness extends to hardware documentation: in the slides for a December 2006 presentation, De Raadt explained that without it "developers often make mistakes writing drivers", and pointed out that "the [oh my god, I got it to work] rush is harder to achieve, and some developers just give up." He went on to say that vendor-supplied binary drivers are unacceptable for inclusion in OpenBSD, that they have "no trust of vendor binaries running in our kernel" and that there

1924-511: The leading DNS package at the time, BIND , and wrote djbdns as a DNS package with security as a primary goal. Bernstein offers "security guarantees" for qmail and djbdns in the form of monetary rewards for the identification of flaws. A purported exploit targeting qmail running on 64-bit platforms was published in 2005, but Bernstein believes that the exploit does not fall within the parameters of his qmail security guarantee. In March 2009, Bernstein awarded $ 1000 to Matthew Dempsky for finding

1976-408: The main distribution: cwm , FVWM (part of the default configuration for Xenocara), and twm . OpenBSD features a full server suite and can be configured as a mail server , web server , FTP server , DNS server , router , firewall , NFS file server , or any combination of these. Since version 6.8, OpenBSD has also shipped with native in-kernel WireGuard support. Shortly after OpenBSD

2028-473: The name OpenBSD refers to the availability of the operating system source code on the Internet , although the word "open" in the name OpenSSH means "OpenBSD". It also refers to the wide range of hardware platforms the system supports. OpenBSD supports a variety of system architectures including x86-64 , IA-32 , ARM , PowerPC , and 64-bit RISC-V . In December 1994, Theo de Raadt , a founding member of

2080-533: The project's preferred BSD license, which allows binary redistributions without the source code, many components are reused in proprietary and corporate-sponsored software projects. The firewall code in Apple 's macOS is based on OpenBSD's PF firewall code, Android 's Bionic C standard library is based on OpenBSD code, LLVM uses OpenBSD's regular expression library, and Windows 10 uses OpenSSH (OpenBSD Secure Shell) with LibreSSL . The word "open" in

2132-583: The same continuous auditing as the base system due to lack of manpower. Binary packages are built centrally from the ports tree for each architecture. This process is applied for the current version, for each supported release, and for each snapshot. Administrators are recommended to use the package mechanism rather than build the package from the ports tree, unless they need to perform their own source changes. OpenBSD's developers regularly meet at special events called hackathons , where they "sit down and code", emphasizing productivity. Most new releases include

DJB - Misplaced Pages Continue

2184-623: The security implications first. On 11 December 2010, Gregory Perry, a former technical consultant for the Federal Bureau of Investigation (FBI), emailed De Raadt alleging that the FBI had paid some OpenBSD ex-developers 10 years prior to insert backdoors into the OpenBSD Cryptographic Framework . De Raadt made the email public on 14 December by forwarding it to the openbsd-tech mailing list and suggested an audit of

2236-523: The source tree, nor does it include code requiring the signing of non-disclosure agreements . According to the GNU Project , OpenBSD includes small "blobs" of proprietary object code as device firmware. Since OpenBSD is based in Canada, no United States export restrictions on cryptography apply, allowing the distribution to make full use of modern algorithms for encryption. For example, the swap space

2288-892: The survey was spread mainly through mailing lists, forums and word of mouth. This combined with other factors, like the lack of a control group, a pre-screening process or significant outreach outside of the BSD community, makes the survey unreliable for judging BSD usage globally. OpenBSD features a robust TCP/IP networking stack, and can be used as a router or wireless access point . OpenBSD's security enhancements , built-in cryptography , and packet filter make it suitable for security purposes such as firewalls , intrusion-detection systems , and VPN gateways . Several proprietary systems are based on OpenBSD, including devices from Armorlogic (Profense web application firewall), Calyptix Security, GeNUA, RTMX, and .vantronix. Some versions of Microsoft 's Services for UNIX , an extension to

2340-534: The system against the patch branch of the CVS source repository for that release. Alternatively, a system administrator may opt to upgrade to the next snapshot release using sysupgrade , or by using the -current branch of the CVS repository, in order to gain pre-release access to recently added features. The sysupgrade tool can also upgrade to the latest stable release version. The generic OpenBSD kernel provided by default

2392-473: The system is faithful to the Unix philosophy of small, simple tools that work together well: "Some base components are not as feature-rich, on purpose. Since 99% of the servers don't need the flexibility of Apache, OpenBSD's httpd will work fine, be more secure, and probably faster". He characterized the developer community's attitude to components as: "When the community decides that some module sucks, they develop

2444-542: The title DJB . If an internal link led you here, you may wish to change the link to point directly to the intended article. Retrieved from " https://en.wikipedia.org/w/index.php?title=DJB&oldid=1113040375 " Category : Disambiguation pages Hidden categories: Short description is different from Wikidata All article disambiguation pages All disambiguation pages Daniel J. Bernstein Bernstein attended Bellport High School ,

2496-705: Was protected speech under the First Amendment , which contributed to regulatory changes reducing controls on encryption. Bernstein was originally represented by the Electronic Frontier Foundation . He later represented himself . Bernstein designed the Salsa20 stream cipher in 2005 and submitted it to eSTREAM for review and possible standardization. He later published the ChaCha20 variant of Salsa in 2008. In 2005, he proposed

2548-438: Was created, De Raadt was contacted by a local security software company named Secure Networks (later acquired by McAfee ). The company was developing a network security auditing tool called Ballista, which was intended to find and exploit software security flaws. This coincided with De Raadt's interest in security, so the two cooperated leading up to the release of OpenBSD 2.3. This collaboration helped to define security as

2600-475: Was formed in 2012, in part to serve the needs of the OpenBSD project. In 2017, Isotop, a French project aiming to adapt OpenBSD to desktops and laptops, using xfce then dwm , started to be developed. OpenBSD includes a number of third-party components , many with OpenBSD-specific patches, such as X.Org , Clang (the default compiler on several architectures ), GCC , Perl , NSD , Unbound , ncurses , GNU binutils , GDB , and AWK . Development

2652-552: Was selected as a member of the final portfolio of the eSTREAM project, part of a European Union research directive. In 2011, Bernstein published RFSB, a variant of the Fast Syndrome Based Hash function. He is one of the editors of the 2009 book Post-Quantum Cryptography . Starting in the mid-1990s, Bernstein wrote a number of security-aware programs, including qmail , ezmlm , djbdns , ucspi-tcp , daemontools , and publicfile . Bernstein criticized

SECTION 50

#1732779596256

2704-436: Was the only hash-based algorithm of the four winners. In April 2017, Bernstein and others published a paper on Post-Quantum RSA that includes an integer factorization algorithm claimed to be "often much faster than Shor's ". In 2004, Bernstein taught a course on computer software security where he assigned each student to find ten vulnerabilities in published software. The 25 students discovered 44 vulnerabilities, and

#255744