{"action":"created","issue":{"url":"https://api.github.com/repos/mumble-voip/mumble/issues/1539","labels_url":"https://api.github.com/repos/mumble-voip/mumble/issues/1539/labels{/name}","comments_url":"https://api.github.com/repos/mumble-voip/mumble/issues/1539/comments","events_url":"https://api.github.com/repos/mumble-voip/mumble/issues/1539/events","html_url":"https://github.com/mumble-voip/mumble/issues/1539","id":55293696,"number":1539,"title":"Replace OCB-AES128 encryption with free alternative","user":{"login":"bontibon","id":110883,"avatar_url":"https://avatars.githubusercontent.com/u/110883?v=3","gravatar_id":"","url":"https://api.github.com/users/bontibon","html_url":"https://github.com/bontibon","followers_url":"https://api.github.com/users/bontibon/followers","following_url":"https://api.github.com/users/bontibon/following{/other_user}","gists_url":"https://api.github.com/users/bontibon/gists{/gist_id}","starred_url":"https://api.github.com/users/bontibon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bontibon/subscriptions","organizations_url":"https://api.github.com/users/bontibon/orgs","repos_url":"https://api.github.com/users/bontibon/repos","events_url":"https://api.github.com/users/bontibon/events{/privacy}","received_events_url":"https://api.github.com/users/bontibon/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-23T15:24:40Z","updated_at":"2015-01-23T18:20:02Z","closed_at":"2015-01-23T18:20:02Z","body":"Mumble currently uses the [OCB](http://web.cs.ucdavis.edu/~rogaway/ocb/) algorithm for the encryption of UDP. Unfortunately, this algorithm is patented in the United States and requires a [license](http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm) when used in commercial software.\r\n\r\nThe licensing does not pose a problem to Mumble directly, but rather to those who implement the Mumble protocol. The restriction means Mumble-related software cannot (a) be compatible with the official Mumble server software and implement UDP audio, and (b) be sold inside the U.S. without purchasing an OCB license.\r\n\r\nI propose that an algorithm that does not have these restrictions be used (or at least be supported by murmur) for UDP encryption. While I have not researched such an algorithm, this link contains the names of several alternatives: [Why is OCB-AES mode not becoming a standard for authenticated encryption?](https://crypto.stackexchange.com/questions/5639/why-is-ocb-aes-mode-not-becoming-a-standard-for-authenticated-encryption)\r\n\r\nI can appreciate that this issue will probably only be solved by someone developing 3rd-party Mumble clients, but I thought I would bring it to attention anyway.\r\n\r\nAny thoughts on this?"},"comment":{"url":"https://api.github.com/repos/mumble-voip/mumble/issues/comments/71238285","html_url":"https://github.com/mumble-voip/mumble/issues/1539#issuecomment-71238285","issue_url":"https://api.github.com/repos/mumble-voip/mumble/issues/1539","id":71238285,"user":{"login":"bontibon","id":110883,"avatar_url":"https://avatars.githubusercontent.com/u/110883?v=3","gravatar_id":"","url":"https://api.github.com/users/bontibon","html_url":"https://github.com/bontibon","followers_url":"https://api.github.com/users/bontibon/followers","following_url":"https://api.github.com/users/bontibon/following{/other_user}","gists_url":"https://api.github.com/users/bontibon/gists{/gist_id}","starred_url":"https://api.github.com/users/bontibon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bontibon/subscriptions","organizations_url":"https://api.github.com/users/bontibon/orgs","repos_url":"https://api.github.com/users/bontibon/repos","events_url":"https://api.github.com/users/bontibon/events{/privacy}","received_events_url":"https://api.github.com/users/bontibon/received_events","type":"User","site_admin":false},"created_at":"2015-01-23T18:20:02Z","updated_at":"2015-01-23T18:20:02Z","body":"> <strike>Actually, I take my comment back. I see that the #2 OCB license does not allow commercial use.</strike>\r\n\r\nI'm glad I wasn't the only one who misread the license wording.\r\n\r\n> Software implementations are free to use OCB in any way they wish (as long as they're not military).\r\n\r\nThat's probably permissive enough not to change the implementation."}}