Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenSSL Gets Cryptography Gift From Sun

Posted by timothy on from the curvaceousness dept.

Kataire writes "C|Net posted this story about how Sun Microsystems' has donated 'elliptic curve' encryption technology, (developed by Whitfield Diffie of Diffie-Hellman public key fame) to the OpenSSL project. This potentially means better encryption for lighter-weight systems such as PDAs."

18 of 217 comments (clear)

  1. Great! by mdechene · · Score: 4, Funny

    Now I can keep my pesky roommates out of my palms oh-so-full social calendar.

    --

    Karma: Not Particularly Funny.
    1. Re:Great! by Soko · · Score: 4, Funny

      Now I can keep my pesky roommates out of my palms oh-so-full social calendar.

      You mean right now you let *your* palm *date* your friends? Ewww....

      --
      "Depression is merely anger without enthusiasm." - Anonymous
    2. Re:Great! by Darkforge · · Score: 5, Interesting
      Actually, there is a real use for widespread heavy-duty crypto, even on a PDA: encrypted money tokens.

      If strong encrypted money tokens were to be implemented on a wide scale for, say, Palm PocketPC, Zaurus, and maybe a special purpose StrongARM device, you could expect to see a cheap widespread secure electronic payment mechanism that you can use for micropayments.

      Aside from the novelty of buying lunch with your PDA, this could be the next step towards truly secure electronic transfers. You can say goodbye to corporate privacy violations when you can pay for your online goods with secure anonymous electronic cash.

      Imagine paying your peers in a P2P system for MP3s/OGGs/whatever. Providing fat bandwidth for P2P would be a potential money-maker, not merely a labor of love. Throw in an anonymizing protocol and you're selling MP3 bandwidth online securely and untraceably; the RIAA couldn't shut you down, because there'd be no way to figure out who you were.

      That's the power of widespread strong crypto, especially in small devices.

      --

      When I moderate, I only use "-1, Overrated". That way, I never get meta-moderated!

  2. It's not really that surprising by bsharitt · · Score: 5, Insightful

    Sun is basically "arming the rebels" so they can better fight Microsoft. Even though they may have other motives, it's nice of them anyway.

    1. Re:It's not really that surprising by Billly+Gates · · Score: 4, Interesting
      "Sun is basically "arming the rebels""



      No. I think it this move was designed to improve Apache's security and make it a greater e-commerce tool on solaris( and unix). Sun relizes that more sun webservers use apache then Iplanet so they are donating the code to openssl since apache uses it by default. And not to just attack Microsoft. However I do question the timing since newly discovered ssl flaw recently in IIS/IE is making headline news and CIO's nervous.

      Something like this may have an impact in e-commerce purchasing decisions. .NET has made alot of hype and headway into the ecommerce market because its so easy to write a vb.net ecommerce site these days. In VB.NEt you can declare a subroutine as a webservice or applet(never used it but seen it)and it instantly becomes a servlet. This is something Sun has to fight. Windows Developers are really rallying upon .NET because thats all they know. Same reason why SQL-Server is getting popular. With palladium security will be a non issue so who knows what will happen. I do not see how sun could fight this unless use the more open TCPA standard. At least that one is not owned by Microsoft like palladium.

      --
      http://saveie6.com/
    2. Re:It's not really that surprising by AntiTuX · · Score: 4, Interesting

      okay, I know this is a personal thing, but it's iPlanet, not Iplanet, or IPlanet. I used to work there, and it drove me nuts when someone would misspell it.

      I'll probably get modded out of commision for this, but I just really get tired of misspellings.
      Even though I was on the netscape side, and got laid off, I'm still loyal to iPlanet. They gave me my start in the IT world (head Sysadmin for iPlanet Learning Solutions), and I can't thank them enough for it.

  3. Shouldn't this be placed under a different section by questionlp · · Score: 4, Interesting

    Although I use and keep up with the BSD side of things, but I think this affects the entire open source community as a whole, including xBSD, Linux, Apache+SSL, and gobs of other software that utilizes SSL for security.

    Nonetheless, it is great to see Sun contributing back to the community.

    This does bring up one question in my mind though... could this be used in SSL acceleration cards to improve the effiency of the SSL 'processor' (i.e.: keep the same performance level while reducing the amount of power necessary)?

  4. Offering from large companies by phorm · · Score: 5, Interesting

    Has anybody noticed a trend lately of large corporations or companies making offers to the public source movements. Is this a play between them for notice, or are they finally starting to figure out that it's better to play nice with open source than fight against it?

    1. Re:Offering from large companies by kevin+lyda · · Score: 4, Interesting

      sun has been contributing to free software for decades. they didn't make a big production of it, but it's been happening anyway. now yes, for the past few years they've been rather obnoxious on certain fronts, but for the most part they've done their bit.

      denegrating this contribution as if it's a new position sun isn't very fair to their company or their developers.

      --
      US Citizen living abroad? Register to vote!
  5. Re:Shouldn't this be placed under a different sect by JDizzy · · Score: 4, Interesting

    OpenSSL is not the child of OpenBSD, nor a cousin of OpenSSH. OpenSSL is an independant project.

    OpenSSH is a baby of openBSD, and OpenSSH depends on OpenSSL.

    The Eliptic curve stuff was donated to OpenSSH team, not the OpenSSL group. So dreaming about this in your ssl accelerated card of the future is a bit silly. However, if openSSH team open sources the tech, and that tech is under bsd lisence, then maybe it will work its way down into the chip makers crypto designes.

    --
    It isn't a lie if you belive it.
  6. Re:Good for more then PDA's by jbrandon · · Score: 5, Informative

    That's just not true; Shor's algorithm transfers quite nicely to solving what is essentially the discrete log problem in a group. IOW: Elliptic curve cryto is not any safer. See This

  7. Bush's advisor present, official government suppor by Anonymous Coward · · Score: 5, Funny

    You know what that tells us, right?

    The NSA can already crack it. :)

  8. Wrong. OpenSSL != OpenSSH by plcurechax · · Score: 5, Informative

    OpenSSL is written by the OpenBSD people

    Not quite.

    OpenSSL is maintained by OpenSSL core members: Ralf S. Engelschall, Ben Laurie, Mark J. Cox, Dr. Stephen Henson, and others developers.

    OpenSSH was written by OpenBSD members (Theo de Raadt, Niels Provos, Markus Friedl, Dug Song, and others). OpenSSH uses OpenSSL as a cryptographic library source (it is highly optimized for many processors).

  9. Re:NeXT, did NOT invent ECC. by plcurechax · · Score: 4, Informative

    ...given that it was invented by NeXT?

    Sorry, Ellipitic curve cryptography was invented independantly by Neal Koblitz, Professor of Mathematics at the University of Washington and Victor Miller who was then at IBM.
    (Source)

  10. Whitfield Diffie did NOT invent ECC by plcurechax · · Score: 5, Informative

    'elliptic curve' encryption technology, (developed by Whitfield Diffie of Diffie-Hellman public key fame)

    Elliptic curve cryptography was indepentantly
    invented by Neal Koblitz, Professor of Mathematics at the University of Washington and Victor Miller who was then at IBM.
    (Source)

    Whitfield Diffie is Sun's chief security officer, and co-invented public-key cryptography.

  11. Sounds like something 'the tick' would say by ocie · · Score: 4, Funny

    Well Arthur, it looks like this elipse has come full circle.

    --
    JET Program: see Japan, meet intere
  12. License? by rweir · · Score: 4, Interesting

    Is it under a 4-clause or 3-clause BSD license? OpenSSL is _still_ under the 4-clause license, with the `obnoxious advertising clause' which says that you have to mention the developers in all advertising materials.
    Not such a big deal, you might say, but there are two big problems with this: 1) It's incompatible with GNU GPL, so no straight GPL software can use OpenSSL, and 2) it causes huge practical problems.

    Theses issues are a big problems for Debian, in particular.

  13. Merkle invented public-key cryptography (too) by Ungrounded+Lightning · · Score: 5, Informative

    Whitfield Diffie is Sun's chief security officer, and co-invented public-key cryptography.

    Actually, Ralph Merkle invented public-key cryptography (too). Merkle's article was SUBMITTED first, though the Diffie-Hellman article was PUBLISHED first while Merkle's was still going through the review process.

    Not to disparage any of 'em. Merkle and Diffie & Hellman both invented it separately.

    And for you people who follow Nanotech and/or Cryonics, yes it's THAT Ralph Merkle (who didn't invent either cryonics or nanotech, though he does much great work to advance them).

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way