openssh unix dev - Dec 2000 - [Re: openSSH/openSSL question.]

Damien Miller <djm at mindrot.org> wrote:
On 29 Dec 2000, sunil vallamkonda wrote:
> Hello,
> 
> Looking at:
> http://www.openssh.com/features.html
> 
> Under 'Free Licensing' section:
> 
> "any licensed or patented components are chosen from
> external libraries (e.g. OpenSSL)"
> 
> Can someone please enlighten me which
> components specifically have patent/
> licensing restrictions from openSSL that
> are being used by openSSH ?
This is not legal advice.

OpenSSH uses the following cryptographic primitives: 

DES (1DES and 3DES), Blowfish, CAST128, Rijndael, RC4, RSA, DSA,
Diffie-Hellman, MD5, SHA1, HMAC.

^^^^^^^^^^^^^^^^^^^^^

Thank you for your email.

In openSSH INSTALL, requires openSSL.
The above mentioned crypto primitives are they derived from 
openssl library ?


Also I see that:

"....OpenSSH does allow "Arcfour",
        which is widely believed
  http://home.earthlink.net/~neilbawd/arcfour.html
        to be equivalent to the RSA RC4*
        algorithm,
..."

does openSSH use RC4 or Arcfour ?


Thank you



I may have missed some.
> Are any of these restricted by US export laws ?
Speak to a lawyer.

-d

-- 
| ``We've all heard that a million monkeys banging on | Damien Miller -
| a million typewriters will eventually reproduce the | <djm at
mindrot.org>
| works of Shakespeare. Now, thanks to the Internet, / 
| we know this is not true.'' - Robert Wilensky UCB /
http://www.mindrot.org



____________________________________________________________________
Get your own FREE, personal Netscape WebMail account today at
http://home.netscape.com/webmail

On 30 Dec 2000, sunil vallamkonda wrote:
> This is not legal advice.
> 
> OpenSSH uses the following cryptographic primitives: 
> 
> DES (1DES and 3DES), Blowfish, CAST128, Rijndael, RC4, RSA, DSA,
> Diffie-Hellman, MD5, SHA1, HMAC.
> 
> ^^^^^^^^^^^^^^^^^^^^^
> 
> Thank you for your email.
> 
> In openSSH INSTALL, requires openSSL.
> The above mentioned crypto primitives are they derived from 
> openssl library ?
These all come from the OpenSSL library.
> Also I see that:
> 
> "....OpenSSH does allow "Arcfour",
>         which is widely believed
>   http://home.earthlink.net/~neilbawd/arcfour.html
>         to be equivalent to the RSA RC4*
>         algorithm,
> ..."
> 
> does openSSH use RC4 or Arcfour ?
They are the same.

-d

-- 
| ``We've all heard that a million monkeys banging on | Damien Miller -
| a million typewriters will eventually reproduce the | <djm at
mindrot.org>
| works of Shakespeare. Now, thanks to the Internet, / 
| we know this is not true.'' - Robert Wilensky UCB /
http://www.mindrot.org