1. Government gag order? I'd call this a "good reason", but it wouldn't clear my conscience.
2. Disclosure to or interception by malicious parties? I can't imagine that the best solution would be STO.
Long Answer: It's complicated and I do not understand the whole picture myself.
I can however outline two things that likely exasperate the situation.
a) OpenSSH is used by nearly everyone. Nearly every unix-like installation includes a copy of OpenSSH. Most companies which do business on the internet use a unix-like operating system in some way.
The OpenBSD Foundation has had trouble obtaining funding to cover operating costs in the past. Included in these operating costs is support and auditing of OpenSSH.
b) There has been a long and colored history between FreeBSD and OpenBSD. A lot of code and features developed under OpenBSD has been ported over to FreeBSD such as the OpenBSD Packet Filter (PF).
Juniper uses FreeBSD and PF in their routers and have donated in various ways to FreeBSD. For example, Juniper donated three EX3200s with full contracts to FreeBSD for use in their datacenter.
The OpenBSD Foundation on the other hand has not really seen the same support.
Just dropping that hint is ambiguous drama baiting.
I have a feeling it has less to do with something sinister, and more to do with Theo's very vocal stance on the security situation in FreeBSD.
http://www.itwire.com/business-it-news/open-source/62641-cry...
Most likely the FreeBSD kernel or libraries are doing something in a certain way that Theo finds insecure/insufficient. (Justified or not)
It really does seem like De Raadt's just being really petty to me. But if this is an actual hole and he doesn't want to say what it is, that is worrisome. Doesn't he insinuate the rest of FreeBSD does not know about the hole?
It's possible that he knows of a real exploitable problem.
It's possible that he is trying to boast about his prowess with things "security".
It's possible the "hole" is a design feature in FreeBSD that he just doesn't like. (And hence, considers to be a security problem.)
It's possible that he is bitter that FreeBSD has gotten more attention than OpenBSD.
It's possible that he said it to spur FreeBSD take more interest in security. (Justifiably or not...)
It's possible that he wanted to cause a commotion.
It's possible that more than one of the above is true. :) He is under no obligation to make a disclosure of an exploit that he finds. Does it make him a bad net-denizen? Perhaps. But it's his prerogative.
I can't imagine a government gag order that allows you to publicly hint that there's a problem.
It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
OpenSSL is an encryption API maintained by an entirely different group of people.
EDIT: Modified my reply. OpenSSH at some point moved it's "restrictively licenced software" (RSA, DES, etc) out of it's codebase and now depends on OpenSSL according to it's license. http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENC...
It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSH consumers - only when they have a fix?
It could be best fixed in OpenSSH itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
DSA I believe is still patent encumbered.
NIST made the DSA patent available worldwide royalty-free. In fact, DSA was unencumbered by patents before RSA, which is why SSH version 2 incorporated it.
I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code.
I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/
Its clear, however, that the only way to get to the bottom of this is to become a big contributor to OpenSSH.