Yes, It Is Legal To Use Cryptographic Signature on Amateur Radio. And That’s Important!

It seems there is widespread confusion about using cryptographic signature on Amateur Radio. Cryptographic signature is a way to “sign” a message that remains in the clear, authenticating the sender’s identity and that the text of the message is exactly what the sender wrote. Can you use it on the air? The uninformed say “you can’t use cryptography on the air”, but the truth is more nuanced.

Part 97, in several places, prohibits messages encoded for the purpose of obscuring their meaning. This is either using spread spectrum or an undisclosed code. Exceptions are made for satellite control.

Is cryptographic signature obscuring the meaning of the message? NO! It leaves the message text in the clear, and adds authenticating data. Thus, you may use cryptographic signature on the air. The message itself and identity of the sender MUST be clearly readable by everyone.

Yes, there is a secret in cryptographic signature, which is some private key used for either public-key or symmetrical encryption. But nothing in the cryptographic signature conveys that secret. The cryptographic signature is just a number that, when matched with another number, says “someone who knew a particular secret authored this message, with this exact text”. That doesn’t obscure anything.

This is actually REALLY important for modern Amateur radio. With new digital satellites, we will be able to use digital signature to authenticate that all of the users are actually hams, and we’ll be able to keep the non-hams off of the satellite. This is already in development at Open Research Institute, and elsewhere.

Did you know that ARRL is already ready for hams to use digital signature? LOTW is a certification authority! You can extract an X.509 private and public key from your LOTW certificate, load it into your web browser, and authenticate yourself with it to any software that has the ARRL CA certificate loaded. Don’t do that over the air, the HTTPS protocol implemented in browsers definitely obscures the message. But you can use the same certificate to sign a message and leave the message contents in the clear.

Did you know that there is even a registered extension to X.509 for callsigns?

This also gives us a way to control systems over the air without encrypting the control message, and without allowing unauthorized persons to control those same systems. Wouldn’t you like to use that when you convert your repeater, etc., from touch-tone to digital control?

Slims will be non-existent or not last long. If they steal your key, you can repudiate it.

HT of the Future – New Design

A few years back, Chris Testa and I tried to make a mobile SDR called “Whitebox” or “HT of the Future”. That didn’t work out because the design was too noisy, and we made some mistakes, but we learned a lot.

A few years later, I’m ready to do a new design. It’s a smartphone-controlled 40 mW single-band transceiver based on the AX5043 from On Semiconductor. The hardware design and software are 100% Open Source. You connect to it using a web browser over WiFi, and it takes over your phone’s microphone and speaker, runs a codec in webassembly, and provides a completely-portable UI that runs on Android, Mac, Windows, and anything that runs an un-handicapped version of Chrome or Firefox (which may still not be Apple iPhone). It will be dirt-cheap, and should be able to do FM, packet (1200 and 9600), digital voice using Codec2 (with the codec running in the smartphone), and many experimental modes with data from 0.1 to 125 kilobits per second. It has WiFi (client and standalone access point simultaneously) to connect to your phone and the internet. and Bluetooth Low-Energy.

There is also a cryptographic coprocessor on the board. It cost less than $2. Under FCC rules, we can use digital signature to authenticate hams over the air, as long as the message content is not encrypted. So, there will be lots of interesting applications. But my main reason is that I don’t want to support clones. So, your radio can authenticate itself over the internet. It also provides support for SSL/TLS with a hardware-sequestered key, and lots of interesting general-purpose cryptographic power.

The overall bill of materials is under $25. So, I might be able to create the Baofeng of digital modes.

Here’s my first pass at a schematic. This is my first time using KiCad, and I’m not an electrical engineer or an RF head at all, so expect mistakes.

This simple design can obviously be enhanced, but I like how simple it is because it will hopefully be easy to get it working.  For example, the radio chip is so cheap (under $2 in quantity) that it works best to do multiband with one chip per band – and thus one separate working radio per band.


Want to chat? Email bruce at perens dot com

Bruce Perens featured in new IBM ad, during Oscars TV Program

Here’s the IBM ad used to open their Think 2019 conference, featuring Buzz Aldrin, Arianna Huffington, Janelle Monae, Miaym Bialik, more illustrious celebrities, and astonishingly: me. A shorter version will run on the Oscars TV program.

Dramatis Personae

Music composed and performed by Philip Glass.

Director: Mark Romanek

Production Company: Anonymous Content

Ad Agency: Ogilvy USA

ARRL Web Site Publishes Questionable Virus Notice

ARRL should not be publishing this sort of notice,  because ARRL does not have the expertise to determine its legitimacy or correctness. In the case of Linux, virus warnings should come only from the producer of your Linux system: Ubuntu, Debian, Red Hat, etc. These people are responsible for removing any holes that allow a virus in, and will tell you how to update your system correctly. Linux is not Windows, and does not depend on third-party virus scanners for its security.

The company that published the virus warning has a commercial interest, in that it produces commercial virus and security programs and services, and these notices have the purpose of promoting their expertise (if they are right) and thus selling their products and services. The Open Source developer community provides these products and services at no cost, and the providers of your Linux distribution generally use the Open Source ones. They will update their systems as necessary to remove the threat, and will publish their own warnings as appropriate.

If you would like to learn more about this issue, please read this guide to responsible disclosure of security issues.

If you trust unauthorized sources to instruct you on the security of your Linux, Windows, or Mac systems, it will be a short time before one of them instructs you to perform some action which defeats your security. ARRL should know better.


    Bruce Perens K6BP (Co-founder of the Open Source movement in software.)

The Day Microsoft Disclosed its Plans to Sue Open Source Projects

Of course these days Microsoft has made its peace with Open Source. They are a member of the Open Source Initiative and actually support my work on Open Source and Standards. It wasn’t always that way. There’s something I need to get off of my chest:

One day in the early 2000’s while I was working for HP, Microsoft met with HP management and disclosed to HP their plans to sue major Open Source projects. An HP vice president documented the meeting and sent an email about it suggesting that HP back off of its involvement with Linux, which was forwarded to me. My HP manager at the time was Martin Fink, a section manager at that time and later HP CTO. Martin told me to destroy the email.

Microsoft did not carry out the disclosed plans to bring those suits, but was subsequently documented to have been “backstop” of one of the investors of SCO while they brought their lawsuits. All of this time, I was aware of Microsoft’s plans and unable to talk about them due to an NDA. Other Open Source folks associated with HP were probably also aware and limited by their NDAs: Jeremy Allison said at the time: “please subpoena me”, meaning that he knew something he wished to have in the public but was constrained from talking about it.

Obviously, it’s not the same Microsoft today. However, I have been bothered now for decades about having to keep this secret from the Open Source community, to whom I owed a much greater loyalty than I could ever owe to HP. Obviously any legal binding that HP ever had upon me has expired.

Was Eric Raymond One Of The Authors of the Open Source Definition?

Eric’s memory is imperfect, I doubt deliberately, we’re just old. The Open Source Definition was created as the Debian Free Software Guidelines about 9 months before the formation of the Open Source Initiative. Eric wasn’t a Debian developer and had nothing to do with the creation of the document. On the formation of OSI, only the name of the document was changed. Much later, OSI added rule #10, which IMO was not necessary as it was implied by rule #6.

Shunning? Really?

Eric Raymond wrote a blog post about the Lerna license, the license I commented upon yesterday in my post When Licenses Discriminate. Eric says non-discrimination is a core value of Open Source, which of course I agree with.

Eric takes it a bit over the top, though. He writes “Lerna has defected from the open-source community and should be shunned by anyone who values the health of that community.” Yes, over the top.

It’s OK to create a non-Open-Source paradigm. Lots of people do so, including me.  Just don’t call it Open Source. Lerna, for a day, wasn’t an Open Source project. Contributors who didn’t approve the license change also had their copyrights infringed, but that’s been taken care of because the license change has already been backed out and Lerna is back to being an Open Source project.

It’s true these non-Open-Source paradigms are often boring and non-productive, but people have a right to waste their own time on what they wish.

It also seems over the top that the Lerna project expelled the developer behind the license change. If the developer wanted to leave, fine, but if the developer was willing to stay with the project without this change, expulsion seems over the top.

We can follow the ethos of Open Source perfectly, without being draconian. Please try to do so.

When Licenses Discriminate

A long time ago, well-meaning people at the University of California, Berkeley created a license for their SPICE electronic simulation software that prohibited use by the Police of South Africa. This was, of course, during Apartheid.

Years later, Apartheid ended. The Police of South Africa now included Blacks and Whites with the same duties and powers. And they were still prohibited from using Berkeley SPICE. Getting the University of California to change the license, so that the software could be carried in Debian as “Free Software”, was impossible at the time.

I took this example (among others) and wrote into the Open Source Definition (then the Debian Free Software Guidelines) that licenses could not discriminate against persons or groups, or against fields of endeavor.

This implements a major principle of Free Software. Freedom means Freedom for Everyone, not Freedom For People I Approve Of. Even when those folks abuse the freedom of others.

Someone recently created a license that discriminates against companies that have contracts with the U.S. Immigration and Customs Enforcement (ICE), a division of the Department of Homeland Security. Ironically, this is called “Moral Programming” or “Moral Licensing”. I have to object to it on moral grounds.

I don’t approve of the recent conduct of ICE under the direction of Donald Trump and his gang. Far, far from it. I am happy to say so, to participate in protests, and most importantly, I will not vote Republican in upcoming elections.

But if you insist on denying them the right to run your software in your license, please be careful not to call it Open Source or Free Software. Because your license will not comply with the Open Source Definition or the Four Freedoms of the Free Software Foundation. Which protect Freedom for everyone.

Redis, The Commons Clause, and Adding Clauses To Open Source Licenses

Redis has recently created something called the “Commons Clause”, which takes the Apache license and makes it a non-Open-Source license. And they still call it the Apache license. This is a problem. Someone creating yet another non-Open-Source paradigm is not a problem, if they do it correctly.

Redis doesn’t deny that it’s not an Open Source license any longer once their clause is added.

It’s a bad idea to add a any text whatsoever to an Open Source license, and still call that license by it’s old name. Once the Commons Clause is added, it’s no longer the Apache license, and calling it so confuses people about what is Open Source and what isn’t. Hopefully that’s not meant deliberately. Now stop it. Take the license and the clause together, and title it the Redis license or another name of your choice that doesn’t confuse people that it’s an Open Source license. “Commons” is the name of an Apache project, so that is probably a bad choice for the name of the overall license.

You’ll note that I worked on the Business Source License with MariaDB. They paid a day’s consulting fee. I made it very clear that they were not to tell people it was Open Source, and I made changes that made the license less ambiguous and confusing than their previous version. Please follow that example.