RFC 2773
Encryption using KEA and SKIPJACK
RFC 2773: Encryption using KEA and SKIPJACK 🎀
okay bestie, let's start with the title block 💖
- Network Working Group 🌸
- Request for Comments: 2773 📄
- Updates: 959 (so this one builds on RFC 959 🧚)
- Category: Experimental 🧪
- Authors: R. Housley, P. Yee (SPYRUS), and W. Nace (NSA) 👑
- Date: February 2000 🗓️
Status of This Memo 💅
so this memo defines an Experimental Protocol for the Internet community 🦋 It is NOT an Internet standard of any kind, just a fun experiment! We're also asking for your thoughts and suggestions to make it better 🫶 Distribution of this memo is unlimited 🌈
Copyright Notice ✨
Copyright (C) The Internet Society (2000). All Rights Reserved. 💜
Abstract 🔥
okay so this doc is all about encrypting a file transfer 🔐 It builds on the FTP spec, STD 9, RFC 959, "File Transfer Protocol (FTP)", (October 1985) [3] and RFC 2228, "FTP Security Extensions" (October 1997) [1] 📚 The Key Exchange Algorithm (KEA) handles mutual authentication and sets up the data encryption keys 🤝 Then SKIPJACK encrypts the file data and the FTP command channel 💅
1.0 Introduction ✨
ngl, FTP has basically no security 😭 The only protection is a user authentication password, and that gets sent in the clear 🙈 On top of that, the protocol doesn't protect the file transfer session once the original authentication phase is over 💀
The Internet Engineering Task Force (IETF) Common Authentication Technology (CAT) Working Group proposed security extensions to FTP, and they're giving main character energy 👑 They let the protocol use more flexible security schemes, including different levels of protection for the FTP command and data connections 🌸 This document is a profile for those FTP Security Extensions, showing how the mechanisms can be set up using KEA together with the SKIPJACK symmetric encryption algorithm 🦋
The FTP Security Extensions [1] give you:
- user authentication, which adds to the normal password mechanism 🔑
- server authentication, which usually happens alongside user authentication 🖥️
- session parameter negotiation, especially encryption keys and attributes 🎀
- command connection protection, meaning integrity, confidentiality, or both 🛡️
- data transfer protection, which works the same way as command connection protection 📦
To support all of that, the two FTP entities negotiate a mechanism 🤝 This process is open-ended. It ends once both entities agree on a mechanism they're happy with, or once the initiating party (always the client) can't suggest one that works 😭 After they agree on a mechanism, they can start authentication and/or parameter negotiation 🧚
Authentication and parameter negotiation happen through an unbounded series of exchanges 🌀 When those exchanges wrap up, the entities are either authenticated (unilaterally or mutually), and may also be ready to protect FTP commands and data 💖
After that, the entities negotiate the size of the buffers they'll use to protect the commands and data that follow 🍓 This happens in two steps: the client offers a suggested buffer size, and the server can refuse it, counter it, or accept it 💅
Now the entities can send protected commands, as long as they stay within the parameters negotiated during the security exchanges ✨ To make one, you apply the required protection services to the normal command and then Base64 encode the result 🫧 The encoded result goes in the data field of an ENC (integrity and confidentiality) command 🎀 Base64 is a way to map binary data onto a textual character set so it can pass through most 7-bit systems without getting mangled 🦋 The server sends back responses using new result codes, which let the same protections and Base64 encoding be applied to the results 🔥
Protection for the data transfers can be set with the PROT command, which supports the same protections as the other FTP commands 🌈 PROT commands may be sent on a transfer-by-transfer basis, but the session parameters may not be changed within a session 🙈
2.0 Key Exchange Algorithm (KEA) Profile ✨
this part is where the magic happens 🪄 It profiles KEA with SKIPJACK to get certain security services when it's used with the FTP Security Extensions framework 👑 FTP entities can use KEA to get mutual authentication and to establish data encryption keys 🤝 We specify a simple token format and a set of exchanges to deliver these services 💜 Functions that may be performed by the Fortezza Crypto Card. 🔐
The reader should already know the extensions to follow the protocol steps 📚 In the context of the FTP Security Extensions, we suggest using KEA with SKIPJACK for authentication, integrity, and confidentiality 💖
A client may mutually authenticate with a server 🫶 The protocol steps below are what's needed to do KEA authentication under the FTP Security Extensions framework 🧚 When failure modes come up, the return codes follow the ones specified in the Extensions 🙌 They aren't listed in this document, since they're the same across all the mechanisms used 💅 The certificates are ASN.1 encoded 🎀
The exchanges below assume you already know the FTP Security Extensions 🌸 The notation for concatenation is || 🍓 Decrypting encrypted data and validating the certification path are implicitly assumed, but they aren't shown 🫧
---------------------------------------------------------------------
Client Server
AUTH KEA-SKIPJACK -->
<-- 334 ADAT=Base64( Certb || Rb )
ADAT Base64( Certa || Ra ||
WMEK || IV || Encrypt(
Label-Type || Label-Length ||
Label-List || pad || ICV ) ) -->
<-- 235 ADAT=Base64( IV )Figure 1
The server and client certificates carry KEA public keys 🔑. The client and server use KEA to generate a shared SKIPJACK symmetric key called the TEK ✨. Then the client uses the random number generator to make a second SKIPJACK key, the MEK 💖. The MEK gets wrapped in the TEK before it goes to the server 🎀. The client also makes an initialization vector (IV) tied to the MEK and sends that over too 🦋. If the client wants, it can send a list of security labels for this FTP session, encrypted in the MEK 🔒. Each label block is shaped like one octet of label type, a four octet label length, the security label list, padding, and then an eight octet integrity check value (ICV) 💅. Figure 3 has the label types. If the label type is absent (zero length), then the label size must be zero 🌸.
Padding is a must for the length to line up with the cipher block size 🧁. Here's how it goes: the SKIPJACK CBC encryption input shall be padded to a multiple of 8 octets. Let n be the length in octets of the input. You pad by appending 8 - (n mod 8) octets to the end of the message, and each one has the value 8 - (n mod 8), which is the number of octets being added 🍓. The possible pad strings in hex are 01, 0202, 030303, 04040404, 0505050505, 060606060606, 07070707070707, and 0808080808080808. Every input gets padded with 1 to 8 octets so the total is a multiple of 8 octets 🫶. This pad technique gets used every single time SKIPJACK CBC encryption happens ✨.
The ICV is worked out over the plaintext security label and padding 🔥. The algorithm is the 32-bit one's complement addition of each 32-bit block, followed by 32 zero bits 🧚. This ICV pairs with SKIPJACK CBC encryption to give you data integrity 🌈.
---------------------------------------------------------------------
Label Type 1 Octet
Label Length 4 octets
Label List variable length
Pad 1 to 8 octets
ICV 8 octets
---------------------------------------------------------------------
Figure 2---------------------------------------------------------------------
Label Type Label Syntax Reference
0 Absent Not applicable
1 MSP SDN.701[2]
2-255 Reserved for Future Use To Be Determined
---------------------------------------------------------------------
Figure 3FTP command channel operations are now confidentiality protected 🔐👑. For integrity, the command sequence number, padding, and ICV all get tacked onto each command before it gets encrypted 💜.
Sequence integrity comes from a 16-bit sequence number that goes up by one for each command 🦋. It starts out with the least significant 16 bits of Ra. The server response includes the same sequence number that the client command had 💅.
The ICV is calculated over the individual commands (including the carriage return and line feed that terminate them), the sequence number, and the pad 🎀.
---------------------------------------------------------------------
Client Server
ENC Base64(Encrypt("PBSZ 65535"
|| SEQ || pad || ICV )) -->
<-- 632 Base64(Encrypt("200" ||
SEQ || pad || ICV))
ENC Base64(Encrypt("USER yee"
|| SEQ || pad || ICV)) -->
<-- 632 Base64(Encrypt("331" ||
SEQ || pad || ICV))
ENC Base64(Encrypt("PASS
fortezza" || SEQ ||
pad || ICV)) -->
<-- 631 Base64(Sign("230"))
---------------------------------------------------------------------
Figure 4Once it's decrypted, both sides check the PBSZ commands for integrity by looking for the expected sequence number and a correct ICV 🕵️♀️. The right SKIPJACK key calculation, the ICV checks, and validating the certificates that hold the KEA public keys together give you mutual identification and authentication 🤝✨.
---------------------------------------------------------------------
Client Server
ENC Base64(Encrypt("PROT P" ||
SEQ || pad || ICV)) -->
<-- 632 Base64(Encrypt("200" || SEQ
|| pad || ICV))
---------------------------------------------------------------------
Figure 5Now files can be sent or received with encryption and integrity turned on 🚀. If encryption is in use, the first buffer holds the token and then enough encrypted file octets to completely fill the buffer (unless the file is too short to fill it) 🌸. After that, buffers only hold encrypted file octets 🦋. Every buffer is completely full except for the final one 💖.
---------------------------------------------------------------------
Client Server
ENC Base64(Encrypt(
("RETR foo.bar") ||
SEQ || pad || ICV)) -->
<-- 632 Base64(Encrypt("150" ||
SEQ || pad || ICV))
---------------------------------------------------------------------
Figure 6Next up is the header info and the file data 📦.
---------------------------------------------------------------------
Plaintext Token IV 24 octets
WMEK 12 octets
Hashvalue 20 octets
IV 24 octets
Label Type 1 octets
Label Length 4 octets
Label Label Length octets
Pad 1 to 8 octets
ICV 8 octets
---------------------------------------------------------------------
Figure 72.1 Pre-encrypted File Support ✨
To support both on-the-fly encryption and pre-encrypted files, there's a token for carrying a file encryption key (FEK) 🗝️. To prevent truncation and make sure the file has integrity, the token also includes a hash computed over the complete file 🧾. The token carries the security label associated with the file too 🏷️. The FEK gets wrapped in the session TEK, and the whole token is encrypted in the session TEK using SKIPJACK CBC mode 💜. The token holds a 12 octet wrapped FEK, a 20 octet file hash, a 24 octet file IV, a 1 octet label type, a 4 octet label length, a variable length label value, a one to 8 octet pad, and an 8 octet ICV 🎀. The first 24 octets of the token are the plaintext IV that encrypts the rest of the token 🦋. The token needs its own encryption IV because it travels across the data channel and not the command channel, and ordering between the two channels can't be guaranteed 🫣. How precomputed keys and hashes get stored in the file system is a local implementation matter 🏠. Still, it's suggested that if a file is pre-encrypted, the FEK be wrapped in a local storage key 🔑. When the file is needed, the FEK is unwrapped with the local storage key and then rewrapped in the session TEK 🔄. Figure 8 shows the assembled token 🌷.
---------------------------------------------------------------------
Plaintext Token IV 24 octets
Wrapped FEK 12 octets
Hashvalue 20 octets
IV 24 octets
Label Type 1 octet
Label Length 4 octets
Label Label Length octets
Pad 1 to 8 octets
ICV 8 octets
---------------------------------------------------------------------
Figure 83.0 Table of Key Terminology 🗂️
To keep the key types in this protocol straight, Figure 9 sums up each one and what it's used for 📝.
---------------------------------------------------------------------
Key Type Usage
TEK Encryption of token at the beginning of
each file, also wraps the MEK and the FEK
MEK Encryption of command channel
FEK Encryption of the file itself (may be
done out of scope of FTP)
---------------------------------------------------------------------
Figure 94.0 Security Considerations 🚨
This entire memo is about security mechanisms. 😱 For KEA to provide the authentication and key management discussed here, the implementation must protect the private key from disclosure 🔐. For SKIPJACK to provide the confidentiality discussed here, the implementation must protect the shared symmetric keys from disclosure 🗝️. Guard those keys like your life depends on it, bestie 💀.
5.0 Acknowledgements 🫶
We'd like to thank Todd Horting for the insights gained while implementing this specification 💖.
6.0 References 📚
- [1] Horowitz, M. and S. Lunt, "FTP Security Extensions", RFC 2228, October 1997.
- [2] Message Security Protocol 4.0 (MSP), Revision A. Secure Data Network System (SDNS) Specification, SDN.701, February 6, 1997.
- [3] Postel, J. and J. Reynolds, "File Transfer Protocol", STD 9, RFC 959, October 1985.
7.0 Authors' Addresses 💌
Russell Housley
SPYRUS
381 Elden Street
Suite 1120
Herndon, VA 20170
USA
Phone: +1 703 707-0696
EMail: housley@spyrus.com
Peter Yee
SPYRUS
5303 Betsy Ross Drive
Santa Clara, CA 95054
USA
Phone: +1 408 327-1901
EMail: yee@spyrus.com8.0 Full Copyright Statement ✨
okay so this is the legal bit, but make it cute 🎀
Copyright (C) The Internet Society (2000). All Rights Reserved.
Here's the vibe. You can copy this document and share it with literally anyone 💖 You can also make derivative works that comment on it, explain it, or help people implement it, and you can prepare, copy, publish, and distribute those too, in whole or in part, without restriction of any kind. The one condition is that the above copyright notice and this paragraph stay on all of those copies and derivative works 🫶
BUT the document itself cannot be modified in any way. No deleting the copyright notice, no removing references to the Internet Society or other Internet organizations 🙅♀️ The exceptions are when it's needed for developing Internet standards (then the copyright procedures in the Internet Standards process have to be followed) or when it's translated into languages other than English 🌈
The permissions above are perpetual, and the Internet Society or its successors or assigns won't revoke them 🦋
Now the disclaimer, which is a whole vibe on its own 😭 Here's the exact wording:
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 🫶
Funding for the RFC Editor function is currently provided by the Internet Society 🌸
📦 where this page comes from
- ietf: rfc2773 2000-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms