search

mumble-voip / mumble

Mumble is an open-source, low-latency, high quality voice chat software.
https://www.mumble.info
Other
6.41k stars 1.12k forks source link

Replace OCB-AES128 encryption with free alternative #1539

Closed ghost closed 9 years ago

ghost commented 9 years ago

Mumble currently uses the OCB algorithm for the encryption of UDP. Unfortunately, this algorithm is patented in the United States and requires a license when used in commercial software.

The licensing does not pose a problem to Mumble directly, but rather to those who implement the Mumble protocol. The restriction means Mumble-related software cannot (a) be compatible with the official Mumble server software and implement UDP audio, and (b) be sold inside the U.S. without purchasing an OCB license.

I propose that an algorithm that does not have these restrictions be used (or at least be supported by murmur) for UDP encryption. While I have not researched such an algorithm, this link contains the names of several alternatives: Why is OCB-AES mode not becoming a standard for authenticated encryption?

I can appreciate that this issue will probably only be solved by someone developing 3rd-party Mumble clients, but I thought I would bring it to attention anyway.

Any thoughts on this?

mkrautz commented 9 years ago

The OCB license was actually made quite a bit less strict a couple of years ago, so it is not as bad as you portray.

However, I agree with the sentiment.

Some time ago, I implemented XSalsa20-Poly1305 support in Grumble (the server, not your Grumble!)

See https://github.com/mumble-voip/grumble/tree/master/pkg/cryptstate

It also includes some negotiation logic for selecting the supported crypto modes.

I know @hacst is not fond of implementing an additional mode. I've previously voiced my support of doing it, though.

mkrautz commented 9 years ago

Actually, I take my comment back. I see that the #2 OCB license does not allow commercial use.

Edit: Only hardware implementations require a separate license. Software implementations are free to use OCB in any way they wish (as long as they're not military).

ghost commented 9 years ago

Actually, I take my comment back. I see that the #2 OCB license does not allow commercial use.

I'm glad I wasn't the only one who misread the license wording. Thanks for the clarification.

Software implementations are free to use OCB in any way they wish (as long as they're not military).

That's probably permissive enough not to change the implementation.