From owner-freebsd-current@freebsd.org Tue Jul 12 09:16:07 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7F034B92C1C for ; Tue, 12 Jul 2016 09:16:07 +0000 (UTC) (envelope-from mailing-machine@vniz.net) Received: from mail-lf0-f54.google.com (mail-lf0-f54.google.com [209.85.215.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 0A50A16DE for ; Tue, 12 Jul 2016 09:16:06 +0000 (UTC) (envelope-from mailing-machine@vniz.net) Received: by mail-lf0-f54.google.com with SMTP id h129so7061276lfh.1 for ; Tue, 12 Jul 2016 02:16:06 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=7mFkpnZ5a93UhuiXrpWQwfdsIA/0kVasU08CbrFi/4w=; b=WqdCLhstT2X3YYLy9hNLjX+an8ockORHKUfuyWSW3JKhNRVCmE+/HXgyoe0sGBc+Km p4+1XaPNKoT4GXZZ3VV36iXdUlYl8TaQzl2UgrN0sBU4Jjk9JR0ekfqhblWDh7a+5oeW +JDsbHHGjp4zYR/iOMtI5OEDEriz1X9M9IdqL0wSKXXo+JYp4jYOd/JVARHHmBo20Luj ZoN5451R9zrEHW1LqZP+mnRHe4FtyQdpwv4Wivalqy3qk3QHfp4FNQMTkUTnbRdwqnHV 6Q/Ys7jCGbRJCCdCKc0U12A3iFEVrkNvZrwDGWkH94SGoGhzy9bg1HWxlYi6kssF+nE6 a+Sw== X-Gm-Message-State: ALyK8tKfxmT2a2221BHI+5zapom4UhJuJKXwsn2iPcUKgZ9owrcQt1bjUq/vUKNkOHng1Q== X-Received: by 10.25.213.198 with SMTP id m189mr464942lfg.130.1468314964409; Tue, 12 Jul 2016 02:16:04 -0700 (PDT) Received: from [192.168.1.2] ([89.169.173.68]) by smtp.gmail.com with ESMTPSA id o7sm5741847lfg.45.2016.07.12.02.16.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 12 Jul 2016 02:16:03 -0700 (PDT) Subject: Re: GOST in OPENSSL_BASE To: Kevin Oberman References: <20160710133019.GD20831@zxy.spb.ru> <20160711184122.GP46309@zxy.spb.ru> <98f27660-47ff-d212-8c50-9e6e1cd52e0b@freebsd.org> Cc: Slawa Olhovchenkov , Jung-uk Kim , freebsd-security@freebsd.org, FreeBSD Current From: Andrey Chernov Message-ID: <673ea9f5-e5e5-91e0-5bd1-2119c2f7b493@freebsd.org> Date: Tue, 12 Jul 2016 12:16:02 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2016 09:16:07 -0000 On 12.07.2016 8:48, Kevin Oberman wrote: > >> May be need file PR for dns/bind910? > >> > >> # grep -3 BROK /poudriere/ports/default/dns/bind910/Makefile > >> .include > > >> > >> .if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && > ${SSL_DEFAULT} == base > >> BROKEN= OpenSSL from the base system does not support GOST, add \ > >> DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and > rebuild everything \ > >> that needs SSL. > >> .endif > >> > > > > I dislike idea to use GOST in the bind, it is unneeded there, DNSSEC > > don't use GOST, so I vote for removing GOST option from there. > > > > I need to note that RFC exists, proposing GOST (old version) for DNSSEC: > https://tools.ietf.org/html/rfc5933 > but nobody really use it. > > In case people are not aware of it, Russian law now requires ALL > encrypted traffic must either be accessible by the FSB or that the > private keys must be available to the FSB. It is not quite so. All traffic must be available for 6 months and they express intention to ask big companies for their private keys, but later is not required by the law (not yet...) > I have always assumed that > GOST has a hidden vulnerability/backdoor that the FSB is already using, I already answer this question elsewhere in this thread with the reference. > but this makes it mandatory. Putin gave the FSB 2 weeks to implement the > law, which is clearly impossible, but I suspect that there will be a > huge effort to pick all low-hanging fruit. As a result, I suspect no one > outside of Russia will touch GOST. (Not that they do now, either.) I'd > hate to see its support required for any protocol except in Russia as > someone will be silly enough to use it. I already explain required GOST usage pattern in this thread.