RFC 2451
The ESP CBC-Mode Cipher Algorithms
RFC 2451: The ESP CBC-Mode Cipher Algorithms 🎀
okay bestie, this is RFC 2451 💅 It's called The ESP CBC-Mode Cipher Algorithms, and it came out in November 1998.
The authors are R. Pereira from TimeStep Corporation and R. Adams from Cisco Systems Inc. 💖 It's a Standards Track document in the Network Working Group. The header doesn't list anything it obsoletes or updates, so nothing is being replaced or changed here. 🦋
Status of this Memo ✨
This document specifies an Internet standards track protocol for the Internet community, and asks for discussion and suggestions for improvements. 🫶 If you want to know where this protocol stands in standardization, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. 🌸
Copyright Notice 🌈
Copyright (C) The Internet Society (1998). All Rights Reserved. 💜
Abstract 🧚
okay so the abstract is giving very clear main-character energy 👑 It explains how to use CBC-mode cipher algorithms with the IPSec ESP (Encapsulating Security Payload) Protocol. It doesn't just tell you how to use certain cipher algorithms. It also covers how to use all CBC-mode cipher algorithms. 🔥
Table of Contents 🍓
1. Introduction...................................................2
1.1 Specification of Requirements...............................2
1.2 Intellectual Property Rights Statement......................2
2. Cipher Algorithms..............................................2
2.1 Mode........................................................3
2.2 Key Size....................................................3
2.3 Weak Keys...................................................4
2.4 Block Size and Padding......................................5
2.5 Rounds......................................................6
2.6 Backgrounds.................................................6
2.7 Performance.................................................8
3. ESP Payload....................................................8
3.1 ESP Environmental Considerations............................9
3.2 Keying Material.............................................9
4. Security Considerations........................................9
5. References....................................................10
6. Acknowledgments...............................................11
7. Editors' Addresses............................................12
8. Full Copyright Statement......................................141. Introduction 🎀
okay so the Encapsulating Security Payload (ESP) [Kent98] is the thing that gives confidentiality to IP datagrams. It does this by encrypting the payload data that needs protecting. This spec is all about how ESP uses CBC-mode cipher algorithms. 🔐
Now, this document doesn't cover the default cipher algorithm DES, so you should already be familiar with that one. [Madson98] 🫠
It's assumed you already know the terms and concepts from the "Security Architecture for the Internet Protocol" [Atkinson95], the "IP Security Document Roadmap" [Thayer97], and the "IP Encapsulating Security Payload (ESP)" [Kent98] documents. 📚
Also, this document is a companion to [Kent98], so you MUST read it in that context. 🫶
1.1 Specification of Requirements ✨
The keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and "MAY" that show up in this document should be read as described in [Bradner97]. 💅
1.2 Intellectual Property Rights Statement 💖
Lowkey, this part is about lawyer stuff 🙈 The IETF doesn't take a position on whether any intellectual property or other rights claimed for this technology are valid or in scope. It also doesn't say whether a license under those rights is or isn't available, and it hasn't tried to find out whether any such rights exist.
If you want to know how the IETF handles rights for standards-track and standards-related documents, look at BCP-11. Copies of any rights claims that were made available for publication, and any assurances of licenses that will be made available, can be obtained from the IETF Secretariat. The same goes for the result of any attempt to get a general license or permission to use proprietary rights, whether that's by implementers or users of this specification. 🌸
2. Cipher Algorithms 🦋
Every symmetric block cipher algorithm shares the same basic traits and variables. Those are mode, key size, weak keys, block size, and rounds. We'll go through all of them below. 💜
This document shows some specific cipher algorithms, like Blowfish [Schneier93], CAST-128 [Adams97], 3DES, IDEA [Lai] [MOV], and RC5 [Baldwin96]. But any other block cipher algorithm can be used with ESP, as long as all of the variables described in this document are clearly defined. 🧚
2.1 Mode 🌈
Every symmetric block cipher algorithm described or insinuated in this document uses Cipher Block Chaining (CBC) mode. This mode needs an Initialization Vector (IV) that's the same size as the block size. Using a randomly generated IV stops identical ciphertext from being generated for packets that have identical data spanning the first block of the cipher algorithm's blocksize. 🔥
Here's how it works: the IV gets XOR'd with the first plaintext block before that block is encrypted. After that, each successive block gets the previous ciphertext block XOR'd with the current plaintext before it's encrypted. 🫶
If you want more info on CBC mode, check out [Schneier95]. 📚
2.2 Key Size 👑
Some cipher algorithms allow variable-sized keys, and others only allow one specific key size. The length of the key is tied to how strong the algorithm is. Bigger keys are always harder to break than smaller ones, so it's giving security 💪
This document stipulates that all key sizes MUST be a multiple of 8 bits. 🙈
This document does specify the default key size for each cipher algorithm. The sizes were picked by asking experts on each algorithm, and by balancing strength against performance. ✨
+==============+==================+=================+==========+
| Algorithm | Key Sizes (bits) | Popular Sizes | Default |
+==============+==================+=================+==========+
| CAST-128 [1] | 40 to 128 | 40, 64, 80, 128 | 128 |
+--------------+------------------+-----------------+----------+
| RC5 | 40 to 2040 | 40, 128, 160 | 128 |
+--------------+------------------+-----------------+----------+
| IDEA | 128 | 128 | 128 |
+--------------+------------------+-----------------+----------+
| Blowfish | 40 to 448 | 128 | 128 |
+--------------+------------------+-----------------+----------+
| 3DES [2] | 192 | 192 | 192 |
+--------------+------------------+-----------------+----------+Notes:
[1] With CAST-128, keys shorter than 128 bits MUST be padded with zeros in the rightmost (least significant) positions out to 128 bits. That's because the CAST-128 key schedule expects an input key of 128 bits. So if you have an 80-bit key 3B5D831CFE, it gets padded to a 128-bit key 3B5D831CFE000000. 🍓
[2] The first 3DES key comes from the first 64 bits, the second from the next 64 bits, and the third from the last 64 bits. Implementations MUST take the parity bits into consideration when they first accept a new set of keys. Each of the three keys is actually 56 bits long, and the extra 8 bits are for parity. 💅
The reader should note that the minimum key size for all of the algorithms above is 40 bits. The authors strongly advise that implementations do NOT use key sizes smaller than 40 bits. 🚨
2.3 Weak Keys 💀
Weak key checks SHOULD be performed. If a weak key is found, it SHOULD be rejected and a new SA requested. Some cipher algorithms have weak keys, or keys that MUST not be used because they're weak. 🙅♀️
New weak keys might be discovered, so this document doesn't contain every possible weak key for these ciphers. For more weak keys, check other cryptography sources like [MOV] and [Schneier]. 🔍
CAST-128: No known weak keys. 🌸
RC5: No known weak keys when used with 16 rounds. 🦋
IDEA: IDEA has been found to have weak keys. Check [MOV] and [Schneier] for more info. 🫠
Blowfish: Weak keys for Blowfish have been discovered. Weak keys are keys that produce identical entries in a given S-box. The annoying part is that there's no way to test for weak keys before the S- box values are generated. Thankfully, the chances of randomly generating one are small. 🧚
3DES: DES has 64 known weak keys, including so-called semi-weak keys and possibly-weak keys [Schneier95, pp 280-282]. The odds of picking one at random are negligible. 🍓
For DES-EDE3, there's no known need to reject weak or complementation keys. Any weakness is covered by using multiple keys. 💜
Still, if the first two or last two independent 64-bit keys are equal (k1 == k2 or k2 == k3), then the 3DES operation is just the same as DES. Implementers MUST reject keys that have this property. 🚫
2.4 Block Size and Padding 🎀
All of the algorithms in this document use a block size of eight octets (64 bits). 🌈
Padding is used to line up the payload type and pad length octets, as specified in [Kent98]. The padding must be enough to align the data to be encrypted to an eight-octet (64-bit) boundary. ✨
2.5 Rounds 💖
This variable decides how many times a block gets encrypted. While this variable MAY be negotiated, a default value MUST always exist for when it isn't negotiated. 🔥
+====================+============+======================+
| Algorithm | Negotiable | Default Rounds |
+====================+============+======================+
| CAST-128 | No | key<=80 bits, 12 |
| | | key>80 bits, 16 |
+--------------------+------------+----------------------+
| RC5 | No | 16 |
+--------------------+------------+----------------------+
| IDEA | No | 8 |
+--------------------+------------+----------------------+
| Blowfish | No | 16 |
+--------------------+------------+----------------------+
| 3DES | No | 48 (16x3) |
+--------------------+------------+----------------------+2.6. Backgrounds ✨
Okay bestie, let's get into the backstory of each cipher, because every one of these has a whole origin story 🎀
CAST-128: 🌸
The CAST design procedure was originally developed by Carlisle Adams and Stafford Tavares at Queen's University, Kingston, Ontario, Canada. Later enhancements came from Carlisle Adams and Michael Wiener of Entrust Technologies. CAST-128 is the result of applying the CAST Design Procedure as outlined in [Adams97]. Iconic glow-up energy 💅
RC5: 🦋
The RC5 encryption algorithm was developed by Ron Rivest for RSA Data Security Inc. It was built to meet the need for a high-performance software and hardware ciphering alternative to DES, which is giving practical and fast 🔥 It is patented (pat.no. 5,724,428). A description of RC5 may be found in [MOV] and [Schneier].
IDEA: 💜
Xuejia Lai and James Massey developed the IDEA (International Data Encryption Algorithm) algorithm. It is described in detail in [Lai], [Schneier] and [MOV].
Heads up: IDEA is patented in Europe and in the United States, with a patent application pending in Japan. Licenses are required for commercial uses of IDEA. 🙈
For patent and licensing information, contact:
Ascom Systec AG, Dept. CMVV
Gewerbepark, CH-5506
Magenwil, Switzerland
Phone: +41 64 56 59 83
Fax: +41 64 56 59 90
idea@ascom.ch
http://www.ascom.ch/Web/systec/policy/normal/exhibit1.htmlBlowfish: 🫧
Bruce Schneier of Counterpane Systems developed the Blowfish block cipher algorithm. It is described in detail in [Schneier93], [Schneier95] and [Schneier]. Main character energy 👑
3DES: 🍓
This DES variant, colloquially known as "Triple DES" or as DES-EDE3, processes each block three times, each time with a different key. This technique of using more than one DES operation was proposed in [Tuchman79].
P1 P2 Pi
| | |
IV->->(X) +>->->->(X) +>->->->(X)
v ^ v ^ v
+-----+ ^ +-----+ ^ +-----+
k1->| E | ^ k1->| E | ^ k1->| E |
+-----+ ^ +-----+ ^ +-----+
| ^ | ^ |
v ^ v ^ v
+-----+ ^ +-----+ ^ +-----+
k2->| D | ^ k2->| D | ^ k2->| D |
+-----+ ^ +-----+ ^ +-----+
| ^ | ^ |
v ^ v ^ v
+-----+ ^ +-----+ ^ +-----+
k3->| E | ^ k3->| E | ^ k3->| E |
+-----+ ^ +-----+ ^ +-----+
| ^ | ^ |
+>->->+ +>->->+ +>->->
| | |
C1 C2 CiThe DES-EDE3-CBC algorithm is a simple variant of the DES-CBC algorithm [FIPS-46]. The "outer" chaining technique is used.
In DES-EDE3-CBC, an Initialization Vector (IV) is XOR'd with the first 64-bit (8 byte) plaintext block (P1). The keyed DES function is iterated three times, an encryption (Ek1) followed by a decryption (Dk2) followed by an encryption (Ek3), and generates the ciphertext (C1) for the block. Each iteration uses an independent key: k1, k2 and k3.
For successive blocks, the previous ciphertext block is XOR'd with the current plaintext (Pi). The keyed DES-EDE3 encryption function generates the ciphertext (Ci) for that block.
To decrypt, the order of the functions is reversed: decrypt with k3, encrypt with k2, decrypt with k1, and XOR the previous ciphertext block.
Note that when all three keys (k1, k2 and k3) are the same, DES-EDE3-CBC is equivalent to DES-CBC. This property allows the DES-EDE3 hardware implementations to operate in DES mode without modification. ✨
For more explanation and implementation information for Triple DES, see [Schneier95].
2.7. Performance 🏎️
For a comparison table of the estimated speed of any of these and other cipher algorithms, please see [Schneier97], or for an up-to-date performance comparison, please see [Bosselaers].
3. ESP Payload 📦
The ESP payload is made up of the IV followed by raw cipher-text. Thus the payload field, as defined in [Kent98], is broken down according to the following diagram:
+---------------+---------------+---------------+---------------+
| |
+ Initialization Vector (8 octets) +
| |
+---------------+---------------+---------------+---------------+
| |
~ Encrypted Payload (variable length) ~
| |
+---------------------------------------------------------------+
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8The IV field MUST be same size as the block size of the cipher algorithm being used. The IV MUST be chosen at random. Common practice is to use random data for the first IV and the last block of encrypted data from an encryption process as the IV for the next encryption process.
Including the IV in each datagram ensures that decryption of each received datagram can be performed, even when some datagrams are dropped, or datagrams are re-ordered in transit. 🦋
To avoid ECB encryption of very similar plaintext blocks in different packets, implementations MUST NOT use a counter or other low-Hamming distance source for IVs. 🔐
3.1. ESP Environmental Considerations 🌿
Currently, there are no known issues regarding interactions between these algorithms and other aspects of ESP, such as use of certain authentication schemes. 💖
3.2. Keying Material 🗝️
The minimum number of bits sent from the key exchange protocol to this ESP algorithm must be greater or equal to the key size.
The cipher's encryption and decryption key is taken from the first <x> bits of the keying material, where <x> represents the required key size.
4. Security Considerations 🚨
Implementations are encouraged to use the largest key sizes they can when taking into account performance considerations for their particular hardware and software configuration. Note that encryption necessarily impacts both sides of a secure channel, so such consideration must take into account not only the client side, but the server as well.
For information on the case for using random values, please see [Bell97].
For further security considerations, the reader is encouraged to read the documents that describe the actual cipher algorithms.
5. References 📚
[Adams97] Adams, C, "The CAST-128 Encryption Algorithm",
RFC2144, 1997.
[Atkinson98]Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[Baldwin96] Baldwin, R. and R. Rivest, "The RC5, RC5-CBC, RC5-CBC-
Pad, and RC5-CTS Algorithms", RFC 2040, October 1996.
[Bell97] S. Bellovin, "Probable Plaintext Cryptanalysis of the IP
Security Protocols", Proceedings of the Symposium on
Network and Distributed System Security, San Diego, CA,
pp. 155-160, February 1997 (also
http://www.research.att.com/~smb/probtxt.{ps, pdf}).
[Bosselaers]A. Bosselaers, "Performance of Pentium implementations",
http://www.esat.kuleuven.ac.be/~bosselae/
[Bradner97] Bradner, S., "Key words for use in RFCs to indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[Crypto93] J. Daemen, R. Govaerts, J. Vandewalle, "Weak Keys for
IDEA", Advances in Cryptology, CRYPTO 93 Proceedings,
Springer-Verlag, pp. 224-230.
[FIPS-46] US National Bureau of Standards, "Data Encryption
Standard", Federal Information Processing Standard (FIPS)
Publication 46, January 1977.
[Kent98] Kent, S. and R. Atkinson, "IP Encapsulating Security
Payload (ESP)", RFC 2406, November 1998.
[Lai] X. Lai, "On the Design and Security of Block Ciphers",
ETH Series in Information Processing, v. 1, Konstanz:
Hartung-Gorre Verlag, 1992.
[Madson98] Madson, C. and N. Dorswamy, "The ESP DES-CBC Cipher
Algorithm With Explicit IV", RFC 2405, November 1998.
[MOV] A. Menezes, P. Van Oorschot, S. Vanstone, "Handbook of
Applied Cryptography", CRC Press, 1997. ISBN 0-8493-
8523-7
[Schneier] B. Schneier, "Applied Cryptography Second Edition", John
Wiley & Sons, New York, NY, 1995. ISBN 0-471-12845-7
[Schneier93]B. Schneier, "Description of a New Variable-Length Key,
64-Bit Block Cipher", from "Fast Software Encryption,
Cambridge Security Workshop Proceedings", Springer-
Verlag, 1994, pp. 191-204.
http://www.counterpane.com/bfsverlag.html
[Schneier95]B. Schneier, "The Blowfish Encryption Algorithm - One
Year Later", Dr. Dobb's Journal, September 1995,
http://www.counterpane.com/bfdobsoyl.html
[Schneier97]B. Scheier, "Speed Comparisons of Block Ciphers on a
Pentium." February 1997,
http://www.counterpane.com/speed.html
[Thayer97] Thayer, R., Doraswamy, N. and R. Glenn, "IP Security
Document Roadmap", RFC 2411, November 1998.
[Tuchman79] Tuchman, W, "Hellman Presents No Shortcut Solutions to
DES", IEEE Spectrum, v. 16 n. 7, July 1979, pp. 40-41.6. Acknowledgments 💜
This document is a merger of most of the ESP cipher algorithm documents. This merger was done to facilitate greater understanding of the commonality of all of the ESP algorithms and to further the development of these algorithm within ESP. 🫶
The content of this document is based on suggestions originally from Stephen Kent and subsequent discussions from the IPSec mailing list as well as other IPSec documents.
Special thanks to Carlisle Adams and Paul Van Oorschot, both of Entrust Technologies, who provided input and review of CAST.
Thanks to all of the editors of the previous ESP 3DES documents: W. Simpson, N. Doraswamy, P. Metzger, and P. Karn.
Thanks to Brett Howard from TimeStep for his original work on ESP-RC5.
Thanks to Markku-Juhani Saarinen, Helger Lipmaa and Bart Preneel for their input on IDEA and other ciphers. 🌈
7. Editors' Addresses 💌
Roy Pereira
TimeStep Corporation
Phone: +1 (613) 599-3610 x 4808
EMail: rpereira@timestep.com
Rob Adams
Cisco Systems Inc.
Phone: +1 (408) 457-5397
EMail: adams@cisco.com
Contributors:
Robert W. Baldwin
RSA Data Security, Inc.
Phone: +1 (415) 595-8782
EMail: baldwin@rsa.com or baldwin@lcs.mit.edu
Greg Carter
Entrust Technologies
Phone: +1 (613) 763-1358
EMail: carterg@entrust.com
Rodney Thayer
Sable Technology Corporation
Phone: +1 (617) 332-7292
EMail: rodney@sabletech.com
The IPSec working group can be contacted via the IPSec working
group's mailing list (ipsec@tis.com) or through its chairs:
Robert Moskowitz
International Computer Security Association
EMail: rgm@icsa.net
Theodore Y. Ts'o
Massachusetts Institute of Technology
EMail: tytso@MIT.EDU8. Full Copyright Statement ✨
Copyright (C) The Internet Society (1998). All Rights Reserved. 🎀
okay so this part is the legal bit, but it's actually kinda iconic 💅 Anyone can copy and share this document, and people can even write derivative works that comment on it or explain it or help people implement it, as long as they keep the copyright notice and this paragraph on every copy. They can publish and distribute it too, in whole or in part, with no restriction of any kind. 🦋
However, the document itself can't be modified in any way, like you can't remove the copyright notice or the references to the Internet Society or other Internet organizations. 🙅♀️ The exceptions are when it's needed for developing Internet standards (then the copyright procedures in the Internet Standards process have to be followed), or when it's translated into languages other than English 🌍
The permissions above are perpetual, which means the Internet Society or its successors or assigns won't ever take them back. 💜
Last bit, the disclaimer. The document and its info are provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 😭 No cap, it's a lot of caps, but it's the legal vibe. 🌸
📦 where this page comes from
- ietf: rfc2451 1998-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms