RFC 1829
The ESP DES-CBC Transform
RFC 1829: The ESP DES-CBC Transform 🎀
okay bestie, this is RFC 1829, dated August 1995 and filed under the Standards Track category 💅 It was written by P. Karn (Qualcomm), P. Metzger (Piermont), and W. Simpson (Daydreamer). Its header doesn't list anything it obsoletes or updates, so it's standing on its own 🦋
Status of this Memo 📜
this one is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 for the current standardization state and status, check the "Internet Official Protocol Standards" (STD 1). distribution of this memo is unlimited, so share the tea 🍓
Abstract ✨
this doc describes the DES-CBC security transform for the IP Encapsulating Security Payload (ESP). that's the whole vibe 💖
Table of Contents 🌸
1. Introduction .......................................... 1
1.1 Keys ............................................ 1
1.2 Initialization Vector ........................... 1
1.3 Data Size ....................................... 2
1.4 Performance ..................................... 2
2. Payload Format ........................................ 3
3. Algorithm ............................................. 5
3.1 Encryption ...................................... 5
3.2 Decryption ...................................... 5
SECURITY CONSIDERATIONS ...................................... 6
ACKNOWLEDGEMENTS ............................................. 7
REFERENCES ................................................... 8
AUTHOR'S ADDRESS ............................................. 101. Introduction 🧚
okay so ESP [RFC-1827] is the thing that gives IP datagrams confidentiality by encrypting the payload data you want to protect 🔐 this spec is about how ESP uses Cipher Block Chaining (CBC) mode with the US Data Encryption Standard (DES) algorithm [FIPS-46, FIPS-46-1, FIPS-74, FIPS-81] 💜
any implementation that claims conformance or compliance with the Encapsulating Security Payload spec MUST implement this DES-CBC transform. no skipping it, periodt 💅
you should also read "Security Architecture for the Internet Protocol" [RFC-1825] first. it's the overall security plan for IP and gives you the background you need for this spec 📚
1.1. Keys 🗝️
the secret DES key shared between the two parties is eight octets long 🌈 it's a 56-bit quantity that DES actually uses. the 56-bit key gets stored as a 64-bit (eight octet) quantity, and the least significant bit of each octet is a parity bit ✨
1.2. Initialization Vector 🎀
this DES mode needs an Initialization Vector (IV) that's eight octets long 🦋
every datagram carries its own IV 💖 that's what makes it possible to decrypt each received datagram even when other datagrams get dropped or re-ordered in transit. the way that works is so iconic 🙈
how you pick IV values is up to the implementation 🫶
Notes: A counter that starts at a randomly chosen value is a common, acceptable technique. it's an easy way to avoid repetition and it's robust enough for practical use. but cryptanalysis could take advantage of the rare coincidence where a matching bit position in the first DES block increments in exactly the same way. Other implementations get unpredictability, usually from a pseudo-random number generator. be careful that the period of the generator is long enough to avoid repetition during the lifetime of the session key 🌸
1.3. Data Size 🍓
DES works on blocks of eight octets, so you often need padding after the end of the unencrypted payload data 🧸
the input and output have the same number of octets, which makes in-place encryption and decryption possible 💅
on receipt, if the data to be decrypted isn't an integral multiple of eight octets, an error is indicated, as described in [RFC-1825] 😭
1.4. Performance 🔥
at the time of writing, at least one hardware implementation can encrypt or decrypt at about 1 Gbps [Schneier94, p. 231] 👑
2. Payload Format 🦋
here's the layout of the packet:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Security Parameters Index (SPI) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Initialization Vector (IV) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Payload Data ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
... Padding | Pad Length | Payload Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Security Parameters Index (SPI) 🔑
this is a 32-bit value that identifies the Security Parameters for this datagram. it MUST NOT be zero, so don't even try it 🙅
Initialization Vector (IV) 🎀
the size of this field is variable, but it's constant for all DES-CBC datagrams with the same SPI and IP Destination. octets go out in network order (most significant octet first) [RFC-1700] ✨
the size MUST be a multiple of 32-bits. sizes of 32 and 64 bits are required to be supported. using any other sizes is beyond the scope of this spec. the key management mechanism is expected to indicate the size 🧚
when the size is 32-bits, a 64-bit IV gets formed from the 32-bit value, followed by (concatenated with) the bit-wise complement of that 32-bit value. this is the most common field size, because it lines up the Payload Data for both 32-bit and 64-bit processing 💖
all conformant implementations MUST also correctly process a 64-bit field size. this gives strict compatibility with existing hardware implementations 🫶
It is the intent that the value not repeat during the lifetime of the encryption session key. even when a full 64-bit IV is used, the session key SHOULD be changed at least as frequently as 2**32 datagrams. 😳
Payload Data 🎁
the size of this field is variable 🌈
before encryption and after decryption, this field begins with the IP Protocol/Payload header named in the Payload Type field. quick heads-up: with IP-in-IP encapsulation (Payload Type 4), this will be another IP header 🧸
Padding 🌸
the size of this field is variable too 🍓
before encryption, it's filled with unspecified, implementation dependent (preferably random) values, so the Pad Length and Payload Type fields land on an eight octet boundary 💅
after decryption, it MUST be ignored. no peeking 🙈
Pad Length 🔢
this field tells you the size of the Padding field. it doesn't count the Pad Length and Payload Type fields themselves 💜 the value typically ranges from 0 to 7, but it may be up to 255 to help hide the actual data length 🕵️♀️
this field is opaque. that means the value gets set before encryption and only gets examined after decryption 🔒
Payload Type 🧁
this field tells you what the Payload Data field holds, using the IP Protocol/Payload value. the up-to-date values are in the most recent "Assigned Numbers" [RFC-1700] 📖
this field is opaque too. the value is set before encryption and only examined after decryption 🫠
For example, when encrypting an entire IP datagram (Tunnel-Mode), this field will contain the value 4, which indicates IP-in-IP encapsulation. 🦋
3. Algorithm 💅
in DES-CBC, the base DES encryption function gets applied to the XOR of each plaintext block with the previous ciphertext block, and that gives you the ciphertext for the current block. this is what provides re-synchronization when datagrams are lost 🔄
for more explanation and implementation info on DES, check out [Schneier94] 📚
3.1. Encryption 🔐
first, append zero or more octets of (preferably random) padding to the plaintext, so its modulo 8 length equals 6. for example, if the plaintext length is 41, 5 octets of padding get added ✨
next, append a Pad Length octet containing the number of padding octets you just added 🔢
then append a Payload Type octet holding the IP Protocol/Payload value that identifies the protocol header that begins the payload 🧁
provide an Initialization Vector (IV) of the size the SPI indicates 🎀
encrypt the payload with DES in CBC mode. this gives you a ciphertext of the same length 💖
octets get mapped to DES blocks in network order (most significant octet first) [RFC-1700]. octet 0 (modulo 8) of the payload lines up with bits 1-8 of the 64-bit DES input block, and octet 7 (modulo 8) lines up with bits 57-64 of that block 🧠
construct an appropriate IP datagram for the target Destination, with the indicated SPI, IV, and payload 🦋
the Total/Payload Length in the encapsulating IP Header reflects the length of the encrypted data, plus the SPI, IV, padding, Pad Length, and Payload Type octets 📦
3.2. Decryption 🔓
first, the SPI field gets removed and examined. it's used as an index into the local Security Parameter table, which finds the negotiated parameters and decryption key 🗝️
the negotiated form of the IV determines the size of the IV field. those octets get removed, and an appropriate 64-bit IV value is constructed 🎀
the encrypted part of the payload is decrypted using DES in CBC mode 💜
the Payload Type gets removed and examined. if it's unrecognized, the payload is discarded with an appropriate ICMP message 🙅♀️
the Pad Length gets removed and examined. the specified number of pad octets are removed from the end of the decrypted payload, and the IP Total/Payload Length is adjusted to match 🌸
finally, the IP Header(s) and the remaining portion of the decrypted payload get passed to the protocol receive routine specified by the Payload Type field 🎉
Security Considerations 🔐
okay bestie, this part is serious, so pay attention 💀 the security you get from this spec depends COMPLETELY on a few things: how strong DES is, whether DES gets implemented correctly, how the key management works (and how it's implemented), how strong your key is [CN94], and whether every participating node implements all of it correctly. it's all connected, no cap 🫶
Applications might wanna avoid picking weak keys ✨ the odds of grabbing one at random are low, but it's still worth thinking about [Schneier94, p 233].
The cut and paste attack from [Bell95] is lowkey scary 😭 it abuses how every Cipher Block Chaining algorithm works. When a block gets damaged in transit, decryption garbles that block and the one right after it, but every block after that decrypts just fine. If an attacker legitimately has the same key, they can use that to insert or replay previously encrypted data from other users of the same engine, which reveals the plaintext. The usual transport checksum (ICMP, TCP, UDP) can catch this, but on its own it is not considered cryptographically strong. So in this situation, user or connection oriented integrity checking is needed [RFC-1826] 🧚
At the time this document was written, [BS93] showed a differential cryptanalysis based chosen-plaintext attack that needs 2^47 plaintext-ciphertext pairs. [Matsui94] showed a linear cryptanalysis based known-plaintext attack that only needs 2^43 plaintext-ciphertext pairs. These attacks aren't considered practical, but they must be taken into account 🙈
Now the really unhinged part 💀 [Weiner94] showed a DES cracking machine that costs $1 Million and can crack one key every 3.5 hours. That is an extremely practical attack. Iconic villain behavior.
One or two blocks of known plaintext are enough to recover a DES key. IP datagrams usually start with a block of known and/or guessable header text, so frequent key changes won't protect you from this attack 😭
DES isn't a good encryption algorithm for protecting even moderate value information when this kind of equipment exists. Triple DES is probably a better choice for that stuff 🔥
BUT, despite all these risks, the level of privacy you get from ESP DES-CBC on the Internet is still WAY better than sending the datagram as cleartext 💖
Acknowledgements 🎀
This document was reviewed by the IP Security Working Group of the Internet Engineering Task Force (IETF). Comments should be sent to the ipsec@ans.net mailing list 💌
Some of the text in this spec came from work by Randall Atkinson for the SIP, SIPP, and IPv6 Working Groups 🌸
The use of DES for confidentiality is closely modeled on the work done for SNMPv2 [RFC-1446] ✨
Steve Bellovin, Steve Deering, Karl Fox, Charles Lynn, Craig Metz, Dave Mihelcic and Jeffrey Schiller gave really useful critiques of earlier versions of this draft. Iconic reviewers, honestly 👑
References 📚
[Bell95] Bellovin, S., "An Issue With DES-CBC When Used Without Strong Integrity", Proceedings of the 32nd IETF, Danvers, MA, April 1995.
[BS93] Biham, E., and Shamir, A., "Differential Cryptanalysis of the Data Encryption Standard", Berlin: Springer-Verlag, 1993.
[CN94] Carroll, J.M., and Nudiati, S., "On Weak Keys and Weak Data: Foiling the Two Nemeses", Cryptologia, Vol. 18 No. 23 pp. 253-280, July 1994.
[FIPS-46] US National Bureau of Standards, "Data Encryption Standard", Federal Information Processing Standard (FIPS) Publication 46, January 1977.
[FIPS-46-1] US National Bureau of Standards, "Data Encryption Standard", Federal Information Processing Standard (FIPS) Publication 46-1, January 1988.
[FIPS-74] US National Bureau of Standards, "Guidelines for Implementing and Using the Data Encryption Standard", Federal Information Processing Standard (FIPS) Publication 74, April 1981.
[FIPS-81] US National Bureau of Standards, "DES Modes of Operation" Federal Information Processing Standard (FIPS) Publication 81, December 1980.
[Matsui94] Matsui, M., "Linear Cryptanalysis method dor DES Cipher," Advances in Cryptology -- Eurocrypt '93 Proceedings, Berlin: Springer-Verlag, 1994.
[RFC-1446] Galvin, J., and McCloghrie, K., "Security Protocols for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC-1446, DDN Network Information Center, April 1993.
[RFC-1700] Reynolds, J., and Postel, J., "Assigned Numbers", STD 2, RFC-1700, USC/Information Sciences Institute, October 1994.
[RFC-1800] Postel, J., "Internet Official Protocol Standards", STD 1, RFC-1800, USC/Information Sciences Institute, July 1995.
[RFC-1825] Atkinson, R., "Security Architecture for the Internet Protocol", RFC-1825, Naval Research Laboratory, July 1995.
[RFC-1826] Atkinson, R., "IP Authentication Header", RFC-1826, Naval Research Laboratory, July 1995.
[RFC-1827] Atkinson, R., "IP Encapsulating Security Protocol (ESP)", RFC-1827, Naval Research Laboratory, July 1995.
[Schneier94] Schneier, B., "Applied Cryptography", John Wiley & Sons, New York, NY, 1994. ISBN 0-471-59756-2
[Weiner94] Wiener, M.J., "Efficient DES Key Search", School of Computer Science, Carleton University, Ottawa, Canada, TR-244, May 1994. Presented at the Rump Session of Crypto '93.
Author's Address 💅
Questions about this memo can also be directed to:
Phil Karn Qualcomm, Inc. 6455 Lusk Blvd. San Diego, California 92121-2779
karn@unix.ka9q.ampr.org
Perry Metzger Piermont Information Systems Inc. 160 Cabrini Blvd., Suite #2 New York, NY 10033
perry@piermont.com
William Allen Simpson Daydreamer Computer Systems Consulting Services 1384 Fontaine Madison Heights, Michigan 48071
Bill.Simpson@um.cc.umich.edu bsimpson@MorningStar.com
📦 where this page comes from
- ietf: rfc1829 1995-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms