# OpenSSH/Why Use Encryption

Encryption has been a hot topic in computing for a long time. It became
a high priority item in national and international politics in 1991 when
Dr. Phil Zimmermann at the Massachusetts Institute of Technology (MIT)
first published Pretty Good Privacy (PGP). With the arrival of the first
web shops, encryption went from a specialty to a requirement and
increasing volumes of money changed hands online. By 1996, encryption
became essential for e-business. By 2000, it became recognized as a
general, essential prerequisite in electronic communication. Currently,
in 2010, there is almost no chance of maintaining control over or
integrity of any networked machine for more than a few minutes without
the help of encryption.

Nowadays, much communication over computer networks is still done
without encryption. That would be most communication, if inadequate
encryption is also taken into account. This is despite years of
warnings, government recommendations, best practice guidelines and
incidents. As a result, any machine connected to the network can
intercept communication that passes over that network. The eavesdroppers
are many and varied. They include administrators, staff, employers,
criminals, corporate spies, and even governments. Corporate espionage
alone has become an enormous burden and barrier.

Businesses are well aware of dumpster diving and take precautions to
shred all paper documents. But what about electronic information?
Contracts and negotiations, trade secrets, patent applications,
decisions and minutes, customer data and invoicing, personnel data,
financial and tax records, calendars and schedules, product designs and
production notes, training materials, and even regular correspondence go
over the net daily. Archived materials, even if they are not accessed
directly, are usually on machines that are available and accessed for
other reasons.

Many company managers and executives are still unaware that their
communications and documents are so easily intercepted, in spite of
apparent and expensive access restrictions. In many cases these can be
shown to be ineffectual and at best purely cosmetic. Security Theater is
one obstacle and in the field of security it is more common to find
snake oil than authentic solutions. Still, there is little public
demonstration of awareness of the magnitude of corporate espionage
nowadays or the cost of failure. Even failure to act has its costs. Not
only is sensitive data available if left unencrypted, but also trends in
less sensitive data can be spotted with a large enough sampling. A very
large amount of information can be inferred even from lesser
communications. Data mining is now a well-known concept as is the
so-called wireless wiretap. With the increase in online material and
activity, encryption is more relevant than ever even if many years have
passed since the issues were first brought into the limelight.

## Excerpt of ssh-1.0.0 README from July 12, 1995

Tatu Ylönen, then at the Helsinki University of Technology, wrote the
README[^1] accompanying the early versions of his Open Source software,
SSH. The following is an excerpt about why encryption is important.

## Phil Zimmermann on encryption and privacy, from 1991, updated 1999

Phil Zimmermann wrote the encryption tool Pretty Good Privacy (PGP) in
1991 to promote privacy and to help keep encryption, and thus privacy,
legal around the world. Considerable difficulty occurred in the United
States until PGP was published outside and re-imported in a very
visible, public manner.

## Original Press Release for OpenSSH

Below is the original press release for OpenSSH sent back in 1999.[^2]

cvs.openbsd.org\>\
To: Liz Coolbaugh \<lwn{{@}}lwn.net\>\
Subject: OpenBSD Press Release: OpenSSH integrated into operating system

PRESS RELEASE

OpenSSH: Secure Shell integrated into OpenBSD operating system

Source: OpenBSD\
Contacts:

:   Louis Bertrand, OpenBSD media relations
:   Bertrand Technical Services
:   Tel: (905) 623-8925 Fax: (905) 623-3852
:   louis{{@}}openbsd.org

```{=html}
<!-- -->
```

:   Theo de Raadt, OpenBSD lead developer
:   deraadt{{@}}openbsd.org

Project Web site: <http://www.openbsd.org/>

OpenSSH: Secure Shell integrated into OpenBSD Secure communications
package no longer third-party add-on

\[October 25, 1999: Calgary, Canada\] \-- The OpenBSD developers are
pleased to announce the release of OpenSSH, a free implementation of the
popular Secure Shell encrypted communications package. OpenSSH, to be
released with OpenBSD 2.6, is compatible with both SSH 1.3 and 1.5
protocols and dodges most restrictions on the free distribution of
strong cryptography.

OpenSSH is based on a free release of SSH by Tatu Ylonen, with major
changes to remove proprietary code and bring it up to current security
and functionality standards. Secure Shell operates like the popular
TELNET remote terminal package but with an encrypted link between the
user and the remote server. SSH also allows \"tunnelling\" of network
services through the scrambled connection for added privacy. OpenSSH has
been tested to interoperate with ssh-1.2.27 from SSH Communications, and
the TTSSH and SecureCRT Windows clients.

\"Network sessions involving strong cryptographic security are a
requirement in the modern world,\" says lead developer Theo de Raadt.
\"Everyone needs this. People using the telnet or rlogin protocols are
not aware of the extreme danger posed by password sniffing and session
hijacking.\"

In previous releases of OpenBSD, users were urged to download SSH as
soon as possible after installing the OS. Without SSH, terminal sessions
transmitted in clear text allow eavesdroppers on the Internet to capture
user names and password combinations and thus bypass the security
measures in the operating system.

\"I asked everyone \`what is the first thing you do after installing
OpenBSD?\' Everyone gave me the same answer: they installed ssh,\" says
de Raadt. \"That\'s a pain, so we\'ve made it much easier.\"

All proprietary code in the original distribution was replaced, along
with some libraries burdened with the restrictive GNU Public License
(GPL). Much of of the actual cryptographic code was replaced by calls to
the crypto libraries built into OpenBSD. The source code is now
completely freely re-useable, and vendors are encouraged to re-use it if
they need ssh functionality.

OpenSSH relies on the Secure Sockets Layer library (libssl) which
incorporates the RSA public-key cryptography system. RSA is patented in
the US and OpenBSD developers must work around the patent restrictions.
Users outside the US may download a libssl file based on the patent-free
OpenSSL implementation. For US non-commercial users, OpenBSD is
preparing a libssl based on the patented RSAREF code. Unfortunately, the
US legal framework effectively bans US commercial users from using
OpenSSH, and curtails freedom of choice in that market.

OpenSSH was developed and integrated into OpenBSD by Niels Provos, Theo
de Raadt, Markus Friedl for cryptographic work; Dug Song, Aaron
Campbell, and others for various non-crypto contributions; and Bob Beck
for helping with the openssl library issues. The original SSH was
written by Tatu Ylonen. Bjoern Groenvall and Holger Trapp did the
initial work to free the distribution.

OpenBSD is an Internet-based volunteer effort to produce a secure
multi-platform operating system with built-in support for cryptography.
It has been described in the press as the world\'s most secure operating
system. For more information about OpenSSH and OpenBSD, see the project
Web pages at <http://www.OpenBSD.org/>.

Source: OpenBSD\
<http://lwn.net/1999/1028/a/openssh.html> }}

## The European Union (EU) on Encryption

During 2000, the European Commission investigated the state of
international and industrial electronic espionage. Counter-measures and
solutions were investigated as well as the risks. The result was a
resolution containing a summary of the findings and a series of
recommended actions for Member States to carry out and goals to meet.
Recommendations to EU Member States from the European Parliament
resolution ECHELON, A5-0264/2001 (emphasis added):

:   \"29. Urges the Commission and Member States to devise appropriate
    measures to promote, develop and manufacture European encryption
    technology and software and above all to support projects at
    developing user-friendly **open-source encryption** software;\"
:   . . .
:   \"33. Calls on the Community institutions and the public
    administrations of the Member States to provide training for their
    staff and make their staff familiar with new **encryption
    technologies and techniques** by means of the necessary practical
    training and courses;\"[^3]

It was found during the investigation that businesses were the most at
risk and the most vulnerable and that widespread use of open source
encryption technology is to be encouraged. The same can be said even
today.


## References



[^1]:
    
[^2]:
    
[^3]:
    