RFC 1969
The PPP DES Encryption Protocol (DESE)
RFC 1969 💖 The PPP DES Encryption Protocol (DESE)
Okay bestie, here's the header rundown 🎀 This one comes from the Network Working Group (Request for Comments: 1969). K. Sklower (University of California, Berkeley) and G. Meyer (Spider Systems) wrote it in June 1996. It's Informational, so it's giving "here's some info" energy, not an official Internet standard 📚. The header has no Obsoletes or Updates lines, so this doc doesn't replace or patch anything else ✨.
Status of This Memo ✨
This memo is here to provide information for the Internet community 🌸. It does not specify an Internet standard of any kind 🙈. Distribution of this memo is unlimited 🦋.
Abstract 💜
Okay so the Point-to-Point Protocol (PPP) [1] gives everyone a standard way to carry multi-protocol datagrams over point-to-point links 🔥.
The PPP Encryption Control Protocol (ECP) [2] is the part that lets two sides negotiate and use encryption protocols over PPP-encapsulated links 💅.
This document gets into the nitty-gritty. It gives the specific details for using the DES standard [5, 6] to encrypt PPP-encapsulated packets 🧚.
Acknowledgements 🫶
Huge thank-you to Fred Baker of Cisco for helping make the document way clearer 🌈.
Table of Contents 📋
1. Introduction ................................................ 2
1.1. Motivation ................................................ 2
1.2. Conventions ............................................... 2
2. General Overview ............................................ 2
3. Structure of This Specification ............................. 3
4. DESE Configuration Option for ECP ........................... 4
5. Packet Format for DESE ...................................... 5
6. Encryption .................................................. 6
6.1. Padding Considerations .................................... 6
6.2. Generation of the Ciphertext .............................. 7
6.3. Retrieval of the Plaintext ................................ 8
6.4. Recovery after Packet Loss ................................ 8
7. MRU Considerations .......................................... 8
8. Security Considerations ..................................... 9
9. References .................................................. 9
10. Authors' Addresses ......................................... 10
11. Expiration Date of this Draft .............................. 101. Introduction ✨
1.1. Motivation
The point of this memo is two things 💜. First, it shows how to spell out the necessary details of a "data" or "bearer" protocol when you're working within the generic PPP Encryption Control Protocol. Second, it gives at least one commonly understood way to do secure data transmission between PPP implementations 🔐.
DES is a well-studied, well-understood, widely implemented encryption algorithm 👑. The DES cipher was built for efficient implementation in hardware, so it can be relatively expensive to implement in software 💀. Still, it's so pervasive that it makes sense as a "model" encryption protocol 🍓.
Source code implementing DES in the "Electronic Code Book Mode" can be found in [7]. US export laws forbid including compilation-ready source code in this document 🙅.
1.2. Conventions 📖
Here's the vocab this spec uses for its items:
- MUST, SHALL or MANDATORY -- the item is an absolute requirement of the specification.
- SHOULD or RECOMMENDED -- the item should generally be followed for all but exceptional circumstances.
- MAY or OPTIONAL -- the item is truly optional and can be followed or ignored according to the needs of the implementor.
2. General Overview 🌙
The whole point of encrypting packets exchanged between two PPP implementations is to keep the communication between them private 🔒. The encryption process depends on an encryption algorithm and a shared secret (usually involving at least a key) that both the sender and receiver know.
Generally, the encryptor takes a PPP packet, protocol field included, runs the chosen encryption algorithm on it, and puts the resulting cipher text (plus, in this spec, an explicit sequence number) into the information field of another PPP packet 💌. The decryptor applies the inverse algorithm and then interprets the resulting plain text as if it had arrived directly on the interface 🪄.
How the secret becomes known to both communicating elements is out of scope here. Usually some form of manual configuration is involved 🛠️. Implementations might use PPP authentication, or the EndPoint Identifier Option from PPP Multilink [3], as factors in picking the shared secret. If the secret can be deduced by analyzing the communication between the two parties, then no privacy is guaranteed 🚨.
The US Data Encryption Standard (DES) algorithm [5, 6] has multiple modes of use, but this spec picks just one mode to use with the PPP Encryption Control Protocol (ECP): Cipher Block Chaining (CBC) mode 🔗. Besides the US Government publications above, CBC mode is also discussed in [7], although no C source code is provided for it per se.
The initialization vector for this mode is deduced from an explicit 64-bit nonce, which is exchanged in the clear during the negotiation phase 🌸. The 56-bit key required by all DES modes is established as a shared secret between the implementations.
Why chaining? It's generally thought to take more computation resources to deduce a 64 bit key used for DES encryption by analyzing the encrypted stream when chaining is used, compared with encrypting each block separately with no chaining 🧠. Also, if chaining isn't used, the communication may be subject to replay attacks even if the key is never deduced 😱.
However, if chaining is going to extend beyond packet boundaries, both the sender and receiver have to agree on the order the packets were encrypted 📦. So this spec includes an explicit 16 bit sequence number to sequence the decryption of the packets 🔢. This mode of operation even allows recovery from occasional packet loss, and the details are below too ✨.
3. Structure of This Specification 🧩
The PPP Encryption Control Protocol (ECP) provides a framework for negotiating encryption parameters, like choosing the algorithm 🎛️. It also specifies the assigned numbers to be used as PPP protocol numbers for the "data packets" carried as the associated "data protocol", and it describes the state machine.
So a specification that fits into that matrix only needs to describe any additional configuration options required for a particular algorithm, plus the process for encrypting and decrypting the information once the Opened state has been achieved 💖.
4. DESE Configuration Option for ECP 🎀
Description
The ECP DESE Configuration Option means the issuing implementation is offering to use this specification for decrypting communications on the link. It can be thought of as a request for its peer to encrypt packets this way 💅.
The ECP DESE Configuration Option has the following fields, which are transmitted from left to right:
Figure 1: ECP DESE Configuration Option
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Initial Nonce ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Type: 1, to indicate the DESE protocol.
Length: 10
Initial Nonce: This field is an 8 byte quantity that the peer implementation uses to encrypt the first packet transmitted after the sender reaches the opened state 🌙.
To guard against replay attacks, the implementation SHOULD offer a different value during each ECP negotiation 🛡️. An example might be to use the number of seconds since Jan 1st, 1970 (GMT/UT) in the upper 32 bits, and the current number of nanoseconds relative to the last second mark in the lower 32 bits.
Its formulaic role is described in the Encryption section below 🧮.
5. Packet Format for DESE 📦
Description
The DESE packets themselves have the following fields 💌:
Figure 2: DES Encryption Protocol Packet Format
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Address | Control | 0000 | Protocol ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Seq. No. High | Seq. No. Low | Ciphertext ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Address and Control: These fields MUST be present unless the PPP Address and Control Field Compression option (ACFC) has been negotiated.
Protocol ID: The value of this field is 0x53 or 0x55. The latter indicates that the ciphertext includes headers for the Multilink Protocol, and it requires that the Individual Link Encryption Control Protocol has reached the opened state 🔥. The leading zero MAY be absent if the PPP Protocol Field Compression option (PFC) has been negotiated.
Sequence Number: These 16-bit numbers are assigned by the encryptor sequentially, starting with 0 for the first packet transmitted once ECP has reached the opened state 🔢.
Ciphertext: The generation of this data is described in the next section 🔐.
6. Encryption 🔑
Once the ECP has reached the Opened state, the sender MUST NOT apply the encryption procedure to LCP packets nor ECP packets 🚫.
If the async control character map option has been negotiated on the link, the sender applies mapping after the encryption algorithm has been run 🧩.
The encryption algorithm generally pads the Protocol and Information fields of a PPP packet to some multiple of 8 bytes, then applies DES in Chaining Block Cipher mode with a 56-bit key K 💖.
There are a lot of details about what counts as the Protocol and Information fields, whether Multilink is present or not, whether the ACFC and PFC options have been negotiated, and the sort of padding chosen 🤓.
Regardless of whether ACFC has been negotiated on the link, the sender applies the encryption procedure to only the portion of the packet that excludes the address and control field 🎯.
If the Multilink Protocol has been negotiated and encryption is to be construed as being applied to each link separately, then the encryption procedure is applied to the (possibly extended) protocol and information fields of the packet in the Multilink Protocol 🌈.
If the Multilink Protocol has been negotiated and encryption is to be construed as being applied to the bundle, then the multilink procedure is applied to the resulting DESE packets 🧚.
6.1. Padding Considerations 🎀
okay bestie, DES works on blocks of 8 octets, so any packet that isn't a multiple of 8 octets has to be padded 🫶. That can be genuinely messy for protocols that don't have an explicit length field in their headers 😭. Also, extra padding for HDLC hardware that wants an even number of bytes should not be necessary, because the information field is now a multiple of 8, and you can force an even length just by using or leaving out a leading zero in the protocol field 🌸.
For protocols that DO have an explicit length field, like IP, IPX, XNS, and CLNP, you can pad by adding random trailing garbage 💅. Even with the Multilink protocol, you're fine if it only gets applied to packets with explicit length fields and you're careful that every non-terminating fragment (i.e., those not bearing the (E)nd bit) has a length divisible by 8. Then garbage padding on the terminating fragments causes no ill effects 🦋.
For some cases, like PPP bridging when the trailing CRC is forwarded, or any bridging applied to protocols without explicit length fields, adding garbage changes how the packet gets interpreted 🙈. The self-describing padding option [4] lets you remove the padded bytes unambiguously ✨. But it should only be used when absolutely necessary, because it can inadvertently make you add as many as 8 octets to packets that could otherwise be left alone 💀.
Picture a packet that, by unlucky circumstance, is already a multiple of 8 octets but ends in0x1, 0x2. Self-describing padding would otherwise strip those trailing two bytes. For coexisting with archaic HDLC chips that need packets of even length, you'd normally only have to add two octets (0x1, 0x2), which could then be removed. But since the packet was already a multiple of 8 bytes, you'd need to add an additional 8 bytes 😭
6.2. Generation of the Ciphertext 🔐
okay so here's the vibe 💜. E[k] is the basic DES cipher determined by a 56-bit key k, acting on 64 bit blocks, and D[k] is the matching decryption mechanism. The padded plaintext from the last section becomes a sequence of 64 bit blocks P[i], where i goes from 1 to n. The circumflex character ^ means the bit-wise exclusive-or operation applied to 64-bit blocks.
When you encrypt the first packet sent in the opened state, C[0] is the result of applying E[k] to the Initial Nonce received in the peer's ECP DESE option 🧚. Otherwise, C[0] is the final block of the previously transmitted packet.
The ciphertext for the packet is generated by this iterative process, for i running between 1 and n:
C[i] = E[k](P[i] ^ C[i-1])6.3. Retrieval of the Plaintext ✨
When you decrypt the first packet received in the opened state, C[0] is the result of applying E[k] to the Initial Nonce transmitted in the ECP DESE option 🪄. That first packet has sequence number zero. For subsequent packets, C[0] is the final block of the previous packet in sequence space. Decryption then happens like this, for i running between 1 and n:
P[i] = C[i-1] ^ D[k](C[i]),6.4. Recovery after Packet Loss 🌈
Packet loss gets detected when there's a discontinuity in the sequence numbers of consecutive packets. Say packet number N - 1 has an unrecoverable error or is otherwise lost, but packets N and N + 1 come through correctly 🙈.
Here's the tea 🍵: the algorithm in the previous section needs C[0] for packet N to be C[last] for packet N - 1, so it's impossible to decode packet N. BUT all packets N + 1 and following can be decoded the usual way, because all that's needed is the last block of ciphertext from the previous packet (in this case packet N, which WAS received) 👑.
7. MRU Considerations 🎀
Because padding can happen, and because there's an extra protocol field in effect, implementations should take into account how the packets grow 📦. As an example, say PFC was negotiated, and the MRU before was exactly a multiple of 8. Then the plaintext that combines a full-sized data packet with a one byte protocol field would require an additional 7 bytes of padding, and the sequence number would be an additional 2 bytes. So the information field in the DESE protocol ends up 10 bytes larger than the one in the original packet 😭.
Because the convention is that PPP options are independent of each other, negotiating DESE does not, by itself, automatically increase the MRU value 💅.
8. Security Considerations 🔒
Security issues are the primary subject of this memo 🚨. This proposal relies on exterior and unspecified methods for authentication and retrieval of shared secrets. Yikes, that's a lot of trust to hand off to something outside the spec 💀.
It proposes no new technology for privacy. It just describes a convention for applying the DES cipher to data transmission between PPP implementation 🫣.
Any methodology for the protection and retrieval of shared secrets, and any limitations of the DES cipher, are relevant to the use described here. So if you're using this, you need to think about all of it, no skipping the boring parts 🥹.
9. References 📚
[1] Simpson, W., Editor, "The Point-to-Point Protocol (PPP)", STD 51, RFC 1661, Daydreamer, July 1994.
[2] Meyer, G., "The PPP Encryption Protocol", RFC 1968, Spider Systems, June 1996.
[3] Sklower, K., Lloyd, B., McGregor, G., and D. Carr, "The PPP Multilink Protocol (MP)", RFC 1717, UC Berkeley, November 1994.
[4] Simpson, W., Editor, "PPP LCP Extensions", RFC 1570, Daydreamer, January 1994.
[5] National Bureau of Standards, "Data Encryption Standard", FIPS PUB 46 (January 1977).
[6] National Bureau of Standards, "DES Modes of Operation", FIPS PUB 81 (December 1980).
[7] Schneier, B., "Applied Cryptography - Protocols Algorithms, and source code in C", John Wiley & Sons, Inc. 1994. There is an errata associated with the book, and people can get a copy by sending e-mail to schneier@counterpane.com.
10. Authors' Addresses 🦋
Keith Sklower
Computer Science Department
384 Soda Hall, Mail Stop 1776
University of California
Berkeley, CA 94720-1776
Phone: (510) 642-9587
EMail: sklower@CS.Berkeley.EDUGerry M. Meyer
Spider Systems
Stanwell Street
Edinburgh EH6 5NG
Scotland, UK
Phone: (UK) 131 554 9424
Fax: (UK) 131 554 0649
EMail: gerry@spider.co.uk📦 where this page comes from
- ietf: rfc1969 1996-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms