Date: Mon, 25 Oct 1999 00:04:29 -0600 (MDT)
From: Louis Bertrand <louis@cvs.openbsd.org>
To: Liz Coolbaugh <lwn@lwn.net>
Subject: OpenBSD Press Release: OpenSSH integrated into operating system


P R E S S   R E L E A S E

OpenSSH: Secure Shell integrated into OpenBSD operating system

Source: OpenBSD
Contacts:
 Louis Bertrand, OpenBSD media relations
 Bertrand Technical Services
 Tel: (905) 623-8925  Fax: (905) 623-3852
 mailto:louis@openbsd.org

 Theo de Raadt, OpenBSD lead developer
 mailto:deraadt@openbsd.org

 Project Web site: http://www.openbsd.org/


OpenSSH: Secure Shell integrated into OpenBSD
Secure communications package no longer third-party add-on

[October 25, 1999: Calgary, Canada] -- The OpenBSD developers are
pleased to announce the release of OpenSSH, a free implementation
of the popular Secure Shell encrypted communications package. 
OpenSSH, to be released with OpenBSD 2.6, is compatible with
both SSH 1.3 and 1.5 protocols and dodges most restrictions on the 
free distribution of strong cryptography.

OpenSSH is based on a free release of SSH by Tatu Ylonen, with major
changes to remove proprietary code and bring it up to current
security and functionality standards.  Secure Shell operates like the
popular TELNET remote terminal package but with an encrypted link
between the user and the remote server.  SSH also allows "tunnelling"
of network services through the scrambled connection for added
privacy. OpenSSH has been tested to interoperate with ssh-1.2.27 from 
SSH Communications, and the TTSSH and SecureCRT Windows clients.

"Network sessions involving strong cryptographic security are a
requirement in the modern world," says lead developer Theo de Raadt.
"Everyone needs this.  People using the telnet or rlogin protocols are
not aware of the extreme danger posed by password sniffing and session
hijacking."

In previous releases of OpenBSD, users were urged to download SSH as
soon as possible after installing the OS. Without SSH, terminal
sessions transmitted in clear text allow eavesdroppers on the Internet
to capture user names and password combinations and thus bypass the
security measures in the operating system.

"I asked everyone `what is the first thing you do after installing
OpenBSD?' Everyone gave me the same answer:  they installed ssh," says
de Raadt.  "That's a pain, so we've made it much easier."

All proprietary code in the original distribution was replaced, along
with some libraries burdened with the restrictive GNU Public License
(GPL). Much of of the actual cryptographic code was replaced by calls
to the crypto libraries built into OpenBSD. The source code is now
completely freely re-useable, and vendors are encouraged to re-use it
if they need ssh functionality.

OpenSSH relies on the Secure Sockets Layer library (libssl) which
incorporates the RSA public-key cryptography system. RSA is patented
in the US and OpenBSD developers must work around the patent
restrictions. Users outside the US may download a libssl file based
on the patent-free OpenSSL implementation. For US non-commercial
users, OpenBSD is preparing a libssl based on the patented RSAREF
code. Unfortunately, the US legal framework effectively bans US
commercial users from using OpenSSH, and curtails freedom of choice
in that market.

OpenSSH was developed and integrated into OpenBSD by Niels Provos,
Theo de Raadt, Markus Friedl for cryptographic work; Dug Song, Aaron
Campbell, and others for various non-crypto contributions; and Bob
Beck for helping with the openssl library issues. The original SSH
was written by Tatu Ylonen. Bjoern Groenvall and Holger Trapp did the
initial work to free the distribution.

OpenBSD is an Internet-based volunteer effort to produce a secure
multi-platform operating system with built-in support for
cryptography. It has been described in the press as the world's most
secure operating system. For more information about OpenSSH and 
OpenBSD, see the project Web pages at http://www.OpenBSD.org/.

Source: OpenBSD