<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Given that I’m very new to the FRR dev community, I was hesitant to respond. However, I agree completely with Jafar. I’d add that OpenSSL is heavily tested by a large user community and CERTS are fixed very quickly. Additionally, if we ever implement BGP security features such as RPKI, we’ll use additional OpenSSL functionality. <div><br></div><div>Thanks,</div><div>Acee <div><br></div><div><br><div><div><br><blockquote type="cite"><div>On Jun 2, 2023, at 11:12, Jafar Al-Gharaibeh via dev <dev@lists.frrouting.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b><br class="Apple-interchange-newline">From:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">Jafar Al-Gharaibeh <<a href="mailto:jafar@atcorp.com" style="color: blue; text-decoration: underline;">jafar@atcorp.com</a>><br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>Subject:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;"><b>Re: [dev] Updating internal crypto implementation</b><br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>Date:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">June 2, 2023 at 11:12:40 EDT<br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>To:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">"Ward, David - 0665 - MITLL" <<a href="mailto:david.ward@ll.mit.edu" style="color: blue; text-decoration: underline;">david.ward@ll.mit.edu</a>><br></span></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px;"><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif; color: rgb(127, 127, 127);"><b>Cc:<span class="Apple-converted-space"> </span></b></span><span style="font-family: -webkit-system-font, "Helvetica Neue", Helvetica, sans-serif;">"<a href="mailto:dev@lists.frrouting.org" style="color: blue; text-decoration: underline;">dev@lists.frrouting.org</a>" <<a href="mailto:dev@lists.frrouting.org" style="color: blue; text-decoration: underline;">dev@lists.frrouting.org</a>>, Donald Sharp <<a href="mailto:donaldsharp72@gmail.com" style="color: blue; text-decoration: underline;">donaldsharp72@gmail.com</a>>, Christian Hopps <<a href="mailto:chopps@chopps.org" style="color: blue; text-decoration: underline;">chopps@chopps.org</a>><br></span></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">With OpenSSL 3.0+, the license is no longer an issue. Of course we still support a wide of older platforms where OpenSSL 3.0 isn't available out of the box.<span class="Apple-converted-space"> </span><br></p><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">I don't see a good reason why one would write/maintain their own crypto functions when libraries are available.</p><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">I can't think of a better option than OpenSSL when it comes to wide availability on systems we care about.</p><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">--Jafar<br></p><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></p><div class="moz-cite-prefix" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">On 6/1/23 08:27, Ward, David - 0665 - MITLL wrote:<br></div><blockquote type="cite" cite="mid:8bbb0f9205bf43a79677953b4fb6796d@BN2P110MB1730.NAMP110.PROD.OUTLOOK.COM" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I was actually intentionally vague, because I was first trying to elicit history, opinions, etc. about the current state of things.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">In particular:<o:p></o:p></div><ul type="disc" style="margin-bottom: 0in; margin-top: 0in;"><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Am I correct in understanding the background behind OpenSSL and Zebra/Quagga/FRR? Is it believed that licensing issues which prevented redistribution in the past are resolved now?<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Is there a common expectation as to whether FRR is generally built with, or without, OpenSSL linkage today? (Distribution packaging varies: for example in Fedora this build flag is enabled, but in Debian it is disabled.)<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Are there strong feelings for or against having cryptographic algorithms embedded in the FRR source code? (Faster execution by using a specific implementation; larger security footprint to be concerned with monitoring within this project; easier to build and port FRR to other platforms by reducing the number of external dependencies; trickier to avoid potential function name collisions between FRR and system libraries; etc.)<o:p></o:p></li><li class="MsoListParagraph" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Are there strong feelings for or against the use of OpenSSL specifically in FRR today? (It’s a widely installed dependency of other software; it’s overkill for the very limited degree to which FRR uses it; it is likely to be ported to platforms that other libraries are not; it has a more involved API that has changed over time; etc.)<o:p></o:p></li></ul><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">(So far it seems like – all other things being equal – there would generally be a preference against embedding and maintaining these algorithms in FRR.)<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks,<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">David<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><b>From:</b><span class="Apple-converted-space"> </span>Donald Sharp<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:donaldsharp72@gmail.com" style="color: blue; text-decoration: underline;"><donaldsharp72@gmail.com></a><span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, June 1, 2023 7:20 AM<br><b>To:</b><span class="Apple-converted-space"> </span>Christian Hopps<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:chopps@chopps.org" style="color: blue; text-decoration: underline;"><chopps@chopps.org></a><br><b>Cc:</b><span class="Apple-converted-space"> </span>Ward, David - 0665 - MITLL<span class="Apple-converted-space"> </span><a class="moz-txt-link-rfc2396E" href="mailto:david.ward@ll.mit.edu" style="color: blue; text-decoration: underline;"><david.ward@ll.mit.edu></a>;<span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:dev@lists.frrouting.org" style="color: blue; text-decoration: underline;">dev@lists.frrouting.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [dev] Updating internal crypto implementation<o:p></o:p></div></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">In theory, I am more than happy with having more security options in FRR, especially if some generic functions we are using can be taken out of FRR and the code maintenance can be taken care of by some other library.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I guess where I have been hesitating to respond is the sentence `Can we update...`. I am not sure if I should read the sentence as either:<o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">a) David Ward is saying I will do the work to update this code<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">b) The we implies that someone should just pick this up from the community and run with the idea.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">If (a) then I say go for it, David! For this work, though, I would want to see a plan of action for how this is going to be done in the code base. Mainly so that the 2-3 people within the FRR community who really really care about how this is done won't come back and say do it completely differently and your and our time is not wasted.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">if (b) then I say that's a great idea! Unfortunately due to how open source development is done, until some business has a use case for this expanded functionality, this idea is going to languish.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Finally if you are going to do option (a), please feel free to privately send me email( or come talk to us on slack ) and we can get the ball rolling on helping you get the work done.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">thanks!<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">donald<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Thu, Jun 1, 2023 at 6:31 AM Christian Hopps <<a href="mailto:chopps@chopps.org" moz-do-not-send="true" class="moz-txt-link-freetext" style="color: blue; text-decoration: underline;">chopps@chopps.org</a>> wrote:<o:p></o:p></div></div><blockquote style="border-width: medium medium medium 1pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor rgb(204, 204, 204); border-image: none; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br>Hi David,<br><br>Add "Is there someone will to do the work and maintain the code?" to the non-library options. The answer to that q. very well could be "no" in which case the library is definitely the way to go. :)<br><br>Thanks,<br>Chris.<br><br>"Ward, David - 0665 - MITLL" <<a href="mailto:david.ward@ll.mit.edu" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext" style="color: blue; text-decoration: underline;">david.ward@ll.mit.edu</a>> writes:<br><br>> FRR has an "internal" implementation of the MD5 and SHA-256 algorithms,<br>> including HMAC functions for both. [1] This code is under a BSD license, and<br>> provides an alternative to linking FRR against OpenSSL, for which there were<br>> historical (?) issues around GPL incompatibility. Several routing protocols use<br>> one of these hash algorithms.<br>><br>> ospf6d was extended last year to support the OSPFv3 Authentication Trailer (RFC 7166), which may use any of HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512. [2] The choice of algorithm is limited unless FRR has been compiled with OpenSSL support.<br>><br>> Can we update FRR's internal crypto implementation in order to overcome this limitation? For example:<br>> * Gnulib provides a drop-in version of each of the algorithms mentioned above for inclusion in open-source projects, available under LGPL 2.1.<br>> * FreeBSD has adapted Colin Percival's SHA-256 implementation to support the other SHA-2 algorithms (but without the HMAC functions - which would seem straightforward to adapt).<br>> * Or should FRR rely on an external library for these functions instead? Should it allow the use of something other than OpenSSL, such as Libgcrypt?<br>><br>> Thanks in advance,<br>><br>> David<br>><br>><br>> [1] The SHA-256 implementation was written by Colin Percival, originally for FreeBSD. His current version seems to be here:<br>><span class="Apple-converted-space"> </span><a href="https://github.com/Tarsnap/libcperciva/blob/master/alg/sha256.c" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext" style="color: blue; text-decoration: underline;">https://github.com/Tarsnap/libcperciva/blob/master/alg/sha256.c</a><br>><br>> [2] ospf6d also supports the use of HMAC-MD5 here, despite this not being specified in RFC 7166.<o:p></o:p></div></blockquote></div></div><br><fieldset class="moz-mime-attachment-header"></fieldset><pre class="moz-quote-pre" wrap="">_______________________________________________
dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:dev@lists.frrouting.org" style="color: blue; text-decoration: underline;">dev@lists.frrouting.org</a>
<a class="moz-txt-link-freetext" href="https://lists.frrouting.org/listinfo/dev" style="color: blue; text-decoration: underline;">https://lists.frrouting.org/listinfo/dev</a>
</pre></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">dev mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:dev@lists.frrouting.org" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">dev@lists.frrouting.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.frrouting.org/listinfo/dev" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.frrouting.org/listinfo/dev</a></div></blockquote></div><br></div></div></div></body></html>