I wonder if the same issue is true for the openssl implementation we ship.

*** Bug 3690 has been marked as a duplicate of this bug. ***

 It appears that the IDEA cipher is shipped with Globus openssl as well:

openssl ciphers -v 'IDEA'
IDEA-CBC-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=IDEA(128) Mac=SHA1
IDEA-CBC-MD5            SSLv2 Kx=RSA      Au=RSA  Enc=IDEA(128) Mac=MD5

I think there is a compile option to avoid idea - something like "-DNO_IDEA".

Cheking with out legal team if just carrying the code around is an issue, even 
if it is not used. 

What is the status of your check with legal experts?

This issue has come up again, this time in EGEE, and we need to find a way to
resolve it. 

Thanks,
-alain

Alain,

I am in touch with our lawyers currently and will post updates on this bug as
soon as we have a resolution.

Rachana

Two questions:

1) Is Globus using the IDEA algorithm?

2) Can you recommend how we can build Globus with IDEA disabled? Then we can
remove worries while we wait for legal advice. 

Thanks,
-alain

(1) No, we are not using IDEA algorithms in globus.

(2) We'll get back to you on this.

Here is patch for building OpenSSL without the algorithm:

Index: configure.in
===================================================================
RCS file: /home/globdev/CVS/globus-packages/gsi/openssl_gpt/configure.in,v
retrieving revision 1.15
diff -u -r1.15 configure.in
--- configure.in    9 Nov 2004 20:07:33 -0000    1.15
+++ configure.in    16 Oct 2007 17:43:49 -0000
@@ -36,6 +36,7 @@

 LAC_COMPILER

+
 # On solaris openssl needs the socket and nsl library

 CHECK_NEED_LSOCKET
@@ -48,6 +49,10 @@

 GPT_SET_LIBS([[$EXTERNAL_LIBS]])    

+# Turn off IDEA and RC5
+CFLAGS="-DOPENSSL_NO_IDEA -DOPENSSL_NO_RC5 $CFLAGS"
+AC_DEFINE(OPENSSL_NO_IDEA)
+AC_DEFINE(OPENSSL_NO_RC5)

 GLOBUS_FINALIZE

Index: crypto/Makefile.am
===================================================================
RCS file:
/home/globdev/CVS/globus-packages/gsi/openssl_gpt/crypto/Makefile.am,v
retrieving revision 1.5
diff -u -r1.5 Makefile.am
--- crypto/Makefile.am    31 Jul 2003 04:01:26 -0000    1.5
+++ crypto/Makefile.am    16 Oct 2007 17:43:50 -0000
@@ -5,7 +5,7 @@

 SUBDIRS = \
     md2 md4 md5 sha mdc2 hmac ripemd  \
-    des rc2 rc4 rc5 idea bf cast      \
+    des rc2 rc4 bf cast      \
     bn rsa dsa dh dso buffer bio      \
     stack lhash rand err objects      \
     evp asn1 pem x509 x509v3 conf     \
@@ -59,8 +59,6 @@
     des/libdes_$(GLOBUS_FLAVOR_NAME).la \
     rc2/librc2_$(GLOBUS_FLAVOR_NAME).la \
     rc4/librc4_$(GLOBUS_FLAVOR_NAME).la \
-    rc5/librc5_$(GLOBUS_FLAVOR_NAME).la \
-    idea/libidea_$(GLOBUS_FLAVOR_NAME).la \
     bf/libbf_$(GLOBUS_FLAVOR_NAME).la \
     cast/libcast_$(GLOBUS_FLAVOR_NAME).la \
     bn/libbn_$(GLOBUS_FLAVOR_NAME).la \
Index: test/Makefile.am
===================================================================
RCS file: /home/globdev/CVS/globus-packages/gsi/openssl_gpt/test/Makefile.am,v
retrieving revision 1.6
diff -u -r1.6 Makefile.am
--- test/Makefile.am    31 Jul 2003 04:03:01 -0000    1.6
+++ test/Makefile.am    16 Oct 2007 17:44:01 -0000
@@ -38,7 +38,6 @@
 Test_Programs = \
     exptest \
     bntest \
-    ideatest \
     shatest \
     sha1test \
     mdc2test \
@@ -49,7 +48,6 @@
     hmactest \
     rc2test \
     rc4test \
-    rc5test \
     bftest \
     casttest \
     destest \

We have discussed this with our lawyers. Based on the 2.0 section in
http://www.bouncycastle.org/specifications.html#install, we don't need any
additional steps for using the libraries. We don’t use the algorithm in the
toolkit and it is up to individuals who use the toolkit to seek their own legal
advice for the use of the library in their use case. We have updated the
license page to explicitly indicate this
(http://www.globus.org/toolkit/legal/4.0/licenses4.html)

As mentioned in previous comments, the software shipped with Globus Toolkit
does not use IDEA algorithm. We have tested build of OpenSSL with -noidea flag
and the patch is provided in the previous comment. On the Java side of things,
Bouncy Castle carries the algorithm, but testing the Java WS Core container
shows that the IDEA algorithm is not added to the JCE Provider. So unless
explicitly added, this cannot be used in the container via JCE, although the
engine is part of the jar

Subject: Re:  Possible royalty / patent issue with BouncyCastle jar IDEA
Algorithm

> Here is patch for building OpenSSL without the algorithm:

I don't think your patch works. More accurately, it allows OpenSSL to  
build with IDEA, but when other code builds against Globus's OpenSSL,  
it will fail.

It fails because all code that links against OpenSSL needs to define  
OPENSSL_NO_RC5 and OPENSSL_NO_IDEA at compile time. This is because  
openssl/evp.h has:

#ifndef OPENSSL_NO_RC5
#include <openssl/rc5.h>
#endif

#ifndef OPENSSL_NO_IDEA
#include <openssl/idea.h>
#endif

This doesn't just affect other applications, it affects the Globus  
build. For example, when building openssl_error:

make[2]: Entering directory `/home/condor/execute/dir_25535/userdir/ 
globus-installer/source-trees-th
r/gsi/openssl_error/source/library'
/bin/sh /home/condor/execute/dir_25535/userdir/install/sbin/libtool- 
gcc64dbgpthr --mode=compile /usr
/bin/gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION= 
\"\" -DPACKAGE_STRING=\"\" -DP
ACKAGE_BUGREPORT=\"\" -DPACKAGE=\"globus_gsi_openssl_error\" - 
DVERSION=\"0.13\"  -I. -I/home/condor/
execute/dir_25535/userdir/globus-installer/source-trees-thr/gsi/ 
openssl_error/source/library -I.. -I
/home/condor/execute/dir_25535/userdir/install/include/ 
gcc64dbgpthr    -I/home/condor/execute/dir_25
535/userdir/install/include -I/home/condor/execute/dir_25535/userdir/ 
install/include/gcc64dbgpthr  -
g    -Wall -c -o globus_error_openssl.lo globus_error_openssl.c
mkdir .libs
/usr/bin/gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" - 
DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\
" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"globus_gsi_openssl_error\" - 
DVERSION=\"0.13\" -I. -I/home/con
dor/execute/dir_25535/userdir/globus-installer/source-trees-thr/gsi/ 
openssl_error/source/library -I.
. -I/home/condor/execute/dir_25535/userdir/install/include/ 
gcc64dbgpthr -I/home/condor/execute/dir_2
5535/userdir/install/include -I/home/condor/execute/dir_25535/userdir/ 
install/include/gcc64dbgpthr -
g -Wall -c globus_error_openssl.c  -fPIC -DPIC -o .libs/ 
globus_error_openssl.o
In file included from /home/condor/execute/dir_25535/userdir/install/ 
include/gcc64dbgpthr/openssl/x5
09.h:67,
                  from /home/condor/execute/dir_25535/userdir/install/ 
include/gcc64dbgpthr/openssl/ss
l.h:177,
                  from globus_error_openssl.c:28:
/home/condor/execute/dir_25535/userdir/install/include/gcc64dbgpthr/ 
openssl/evp.h:102:25: openssl/rc
5.h: No such file or directory
/home/condor/execute/dir_25535/userdir/install/include/gcc64dbgpthr/ 
openssl/evp.h:111:26: openssl/id
ea.h: No such file or directory
make[2]: *** [globus_error_openssl.lo] Error 1
make[2]: Leaving directory `/home/condor/execute/dir_25535/userdir/ 
globus-installer/source-trees-thr
/gsi/openssl_error/source/library'
make[1]: *** [all-recursive] Error 1

This is going to break anyone that includes $GLOBUS_LOCATION/include/ 
<flavor>/openssl/ssl.h unless they define it.

It seems unrealistic to change all of Globus and external  
applications to pass the right flag. Should we just hack out the  
#includes from evp.h?

-alain

Subject: Re:  Possible royalty / patent issue with BouncyCastle jar IDEA
Algorithm

> It seems unrealistic to change all of Globus and external  
> applications to pass the right flag. Should we just hack out the  
> #includes from evp.h?

This is the approach that RedHat takes when they build the OpenSSL  
RPM: they just hack out the chunks of evp.h that include the idea and  
rc5 header files. I propose that this is what we should do: should I  
donate back the tested patch, or do you think we need to do something  
else?

-alain

I thought that patchset had made its way through the whole toolkit when I
tested it - I know I had openssl_error problems until I was done.  I might have
injected by-hand changes, though, so I trust your results.  Hacking out the
evp.h ifndef sections sounds like a fine solution to me.

FYI here is my patch for the issue (it does I believe solve the header issue):

diff -u -r ../../../gt_405/gsi/openssl_gpt/aclocal/ac_crypto.m4
./aclocal/ac_crypto.m4
--- ../../../gt_405/gsi/openssl_gpt/aclocal/ac_crypto.m4        2007-10-03
06:49:13.000000000 -0700
+++ ./aclocal/ac_crypto.m4      2007-10-03 06:44:01.000000000 -0700
@@ -44,6 +44,8 @@
     LAC_DEFINE_VAR(RC2_INT)
     LAC_DEFINE_VAR(MD2_INT)
     LAC_DEFINE_VAR(IDEA_INT)
+    lac_CFLAGS="-DOPENSSL_NO_IDEA $CFLAGS"
+    LAC_SUBSTITUTE_VAR(CFLAGS)
 ])


diff -u -r ../../../gt_405/gsi/openssl_gpt/crypto/Makefile.am
./crypto/Makefile.am
--- ../../../gt_405/gsi/openssl_gpt/crypto/Makefile.am  2007-10-03
06:49:11.000000000 -0700
+++ ./crypto/Makefile.am        2007-10-03 06:44:00.000000000 -0700
@@ -5,7 +5,7 @@

 SUBDIRS = \
        md2 md4 md5 sha mdc2 hmac ripemd  \
-       des rc2 rc4 rc5 idea bf cast      \
+       des rc2 rc4 rc5 bf cast           \
        bn rsa dsa dh dso buffer bio      \
        stack lhash rand err objects      \
        evp asn1 pem x509 x509v3 conf     \
@@ -60,7 +60,6 @@
        rc2/librc2_$(GLOBUS_FLAVOR_NAME).la \
        rc4/librc4_$(GLOBUS_FLAVOR_NAME).la \
        rc5/librc5_$(GLOBUS_FLAVOR_NAME).la \
-       idea/libidea_$(GLOBUS_FLAVOR_NAME).la \
        bf/libbf_$(GLOBUS_FLAVOR_NAME).la \
        cast/libcast_$(GLOBUS_FLAVOR_NAME).la \
        bn/libbn_$(GLOBUS_FLAVOR_NAME).la \
diff -u -r ../../../gt_405/gsi/openssl_gpt/crypto/opensslconf.h.in
./crypto/opensslconf.h.in
--- ../../../gt_405/gsi/openssl_gpt/crypto/opensslconf.h.in     2007-10-03
06:49:11.000000000 -0700
+++ ./crypto/opensslconf.h.in   2007-10-03 06:44:00.000000000 -0700
@@ -11,6 +11,12 @@
 #   define OPENSSL_NO_KRB5 1
 #endif

+/* don't build IDEA ciphers */
+
+#ifndef OPENSSL_NO_IDEA
+#   define OPENSSL_NO_IDEA 1
+#endif
+
 #ifdef HEADER_CRYPTLIB_H
 #   ifndef OPENSSLDIR
 #       undef OPENSSLDIR
diff -u -r ../../../gt_405/gsi/openssl_gpt/test/Makefile.am ./test/Makefile.am
--- ../../../gt_405/gsi/openssl_gpt/test/Makefile.am    2007-10-03
06:48:55.000000000 -0700
+++ ./test/Makefile.am  2007-10-03 06:43:59.000000000 -0700
@@ -38,7 +38,6 @@
 Test_Programs = \
        exptest \
        bntest \
-       ideatest \
        shatest \
        sha1test \
        mdc2test \
@@ -65,7 +64,6 @@

 Test_Targets = \
        test_des \
-       test_idea \
        test_sha \
        test_md4 \
        test_md5 \
@@ -108,7 +106,6 @@

 nodist_exptest_SOURCES = exptest.c
 nodist_bntest_SOURCES = bntest.c
-nodist_ideatest_SOURCES = ideatest.c
 nodist_shatest_SOURCES = shatest.c
 nodist_sha1test_SOURCES = sha1test.c
 nodist_mdc2test_SOURCES = mdc2test.c
@@ -138,9 +135,6 @@
 test_des:
        ./destest

-test_idea:
-       ./ideatest
-
 test_sha:
        ./shatest
        ./sha1test

Subject: Re:  Possible royalty / patent issue with BouncyCastle jar IDEA
Algorithm

Sam's patch is a bit different from the first one. Do you (plural)  
recommend anything in particular?

I modified the first patch in this ticket to remove the #includes for  
idea and rc5. Is there any reason I shouldn't use this patch for my  
builds? (See below)

Thanks,
-alain

--- source-trees/gt2-cvs/gsi/openssl_gpt/configure.in   Tue Nov  9  
14:07:33 2004
+++ source-trees/gt2-cvs/gsi/openssl_gpt/configure.in   Mon Oct 22  
22:43:46 2007
@@ -48,6 +48,10 @@
GPT_SET_LIBS([[$EXTERNAL_LIBS]])
+# Turn off IDEA and RC5
+CFLAGS="-DOPENSSL_NO_IDEA -DOPENSSL_NO_RC5 $CFLAGS"
+AC_DEFINE(OPENSSL_NO_IDEA)
+AC_DEFINE(OPENSSL_NO_RC5)
GLOBUS_FINALIZE
--- source-trees/gt2-cvs/gsi/openssl_gpt/crypto/Makefile.am Mon Oct  
22 22:36:11 2007
+++ source-trees/gt2-cvs/gsi/openssl_gpt/crypto/Makefile.am Mon Oct  
22 22:40:51 2007
@@ -5,7 +5,7 @@
SUBDIRS = \
     md2 md4 md5 sha mdc2 hmac ripemd  \
-   des rc2 rc4 rc5 idea bf cast      \
+   des rc2 rc4 bf cast      \
     bn rsa dsa dh dso buffer bio      \
     stack lhash rand err objects      \
     evp asn1 pem x509 x509v3 conf     \
@@ -59,8 +59,6 @@
     des/libdes_$(GLOBUS_FLAVOR_NAME).la \
     rc2/librc2_$(GLOBUS_FLAVOR_NAME).la \
     rc4/librc4_$(GLOBUS_FLAVOR_NAME).la \
-   rc5/librc5_$(GLOBUS_FLAVOR_NAME).la \
-   idea/libidea_$(GLOBUS_FLAVOR_NAME).la \
     bf/libbf_$(GLOBUS_FLAVOR_NAME).la \
     cast/libcast_$(GLOBUS_FLAVOR_NAME).la \
     bn/libbn_$(GLOBUS_FLAVOR_NAME).la \
--- source-trees/gt2-cvs/gsi/openssl_gpt/test/Makefile.am   Mon Oct  
22 22:36:11 2007
+++ source-trees/gt2-cvs/gsi/openssl_gpt/test/Makefile.am   Mon Oct  
22 22:41:34 2007
@@ -38,7 +38,6 @@
Test_Programs = \
     exptest \
     bntest \
-   ideatest \
     shatest \
     sha1test \
     mdc2test \
@@ -49,7 +48,6 @@
     hmactest \
     rc2test \
     rc4test \

Alain, I don't see the difference between your most recent patch and the patch
in comment #9.

Sam's patch would appear to handle the evp.h situation, so I'm happy to
recommend you use it.  It doesn't remove rc5, so if you care about that also
you'll need to extend it appropriately.

Maybe I missed something. Why are we turning off rc5 as well? Similar issue?

Subject: Re:  Possible royalty / patent issue with BouncyCastle jar IDEA
Algorithm

> Maybe I missed something. Why are we turning off rc5 as well?  
> Similar issue?

Yes.

http://en.wikipedia.org/wiki/RC5#_note-0

http://patft.uspto.gov/netacgi/nph-Parser? 
Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO% 
2Fsrchnum.htm&r=1&f=G&l=50&s1=5724428.PN.&OS=PN/5724428&RS=PN/5724428