| blob | d00f68bd52889e691e87013b1ece00badb93b62d |
1 .\" $NetBSD: bdes.1,v 1.12 2004/06/04 10:25:22 wiz Exp $
2 .\"
3 .\" Copyright (c) 1991, 1993
4 .\" The Regents of the University of California. All rights reserved.
5 .\"
6 .\" This code is derived from software contributed to Berkeley by
7 .\" Matt Bishop of Dartmouth College.
8 .\"
9 .\" Redistribution and use in source and binary forms, with or without
10 .\" modification, are permitted provided that the following conditions
11 .\" are met:
12 .\" 1. Redistributions of source code must retain the above copyright
13 .\" notice, this list of conditions and the following disclaimer.
14 .\" 2. Redistributions in binary form must reproduce the above copyright
15 .\" notice, this list of conditions and the following disclaimer in the
16 .\" documentation and/or other materials provided with the distribution.
17 .\" 3. Neither the name of the University nor the names of its contributors
18 .\" may be used to endorse or promote products derived from this software
19 .\" without specific prior written permission.
20 .\"
21 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 .\" SUCH DAMAGE.
32 .\"
33 .\" @(#)bdes.1 8.1 (Berkeley) 6/29/93
34 .\"
35 .Dd December 1, 2001
36 .Dt BDES 1
37 .Os
38 .Sh NAME
39 .Nm bdes
40 .Nd encrypt/decrypt using the Data Encryption Standard
41 .Sh SYNOPSIS
42 .Nm
43 .Op Fl abdp
44 .Op Fl F Ar N
45 .Op Fl f Ar N
46 .Op Fl k Ar key
47 .Op Fl m Ar N
48 .Op Fl o Ar N
49 .Op Fl v Ar vector
50 .Sh DESCRIPTION
51 .Nm
52 implements all DES modes of operation described in FIPS PUB 81,
53 including alternative cipher feedback mode and both authentication
54 modes.
55 .Nm
56 reads from the standard input and writes to the standard output.
57 By default, the input is encrypted using cipher block chaining mode.
58 Using the same key for encryption and decryption preserves plain text.
59 .Pp
60 All modes but the electronic code book mode require an initialization
61 vector; if none is supplied, the zero vector is used.
62 If no
63 .Ar key
64 is specified on the command line, the user is prompted for one (see
65 .Xr getpass 3
66 for more details).
67 .Pp
68 The options are as follows:
69 .Bl -tag -width "-v vector" -compact
70 .It Fl a
71 The key and initialization vector strings are to be taken as ASCII,
72 suppressing the special interpretation given to leading
73 .Dq 0X ,
74 .Dq 0x ,
75 .Dq 0B ,
76 and
77 .Dq 0b
78 characters.
79 This flag applies to
80 .Em both
81 the key and initialization vector.
82 .It Fl b
83 Use electronic code book mode.
84 This is not recommended for messages
85 longer than 8 bytes, as patterns in the input will show through to the
86 output.
87 .It Fl d
88 Decrypt the input.
89 .It Fl F Ar N
90 Use
91 .Ar N Ns -bit
92 alternative cipher feedback mode.
93 Currently
94 .Ar N
95 must be a multiple of 7 between 7 and 56 inclusive (this does not conform
96 to the alternative CFB mode specification).
97 .It Fl f Ar N
98 Use
99 .Ar N Ns -bit
100 cipher feedback mode.
101 Currently
102 .Ar N
103 must be a multiple of 8 between 8 and 64 inclusive (this does not conform
104 to the standard CFB mode specification).
105 .It Fl k Ar key
106 Use
107 .Ar key
108 as the cryptographic key.
109 .It Fl m Ar N
110 Compute a message authentication code (MAC) of
111 .Ar N
112 bits on the input.
113 The value of
114 .Ar N
115 must be between 1 and 64 inclusive; if
116 .Ar N
117 is not a multiple of 8, enough 0 bits will be added to pad the MAC length
118 to the nearest multiple of 8.
119 Only the MAC is output.
120 MACs are only available in cipher block chaining mode or in cipher feedback
121 mode.
122 .It Fl o Ar N
123 Use
124 .Ar N Ns -bit
125 output feedback mode.
126 Currently
127 .Ar N
128 must be a multiple of 8 between 8 and 64 inclusive (this does not conform
129 to the OFB mode specification).
130 .It Fl p
131 Disable the resetting of the parity bit.
132 This flag forces the parity bit of the key to be used as typed, rather than
133 making each character be of odd parity.
134 It is used only if the key is given in ASCII.
135 .It Fl v Ar vector
136 Set the initialization vector to
137 .Ar vector ;
138 the vector is interpreted in the same way as the key.
139 The vector is ignored in electronic codebook mode.
140 For best security, a different
141 initialization vector should be used for each file.
142 .El
143 .Pp
144 The key and initialization vector are taken as sequences of ASCII
145 characters which are then mapped into their bit representations.
146 If either begins with
147 .Dq 0X
148 or
149 .Dq 0x ,
150 that one is taken as a sequence of hexadecimal digits indicating the
151 bit pattern;
152 if either begins with
153 .Dq 0B
154 or
155 .Dq 0b ,
156 that one is taken as a sequence of binary digits indicating the bit pattern.
157 In either case,
158 only the leading 64 bits of the key or initialization vector
159 are used,
160 and if fewer than 64 bits are provided, enough 0 bits are appended
161 to pad the key to 64 bits.
162 .Pp
163 According to the DES standard, the low-order bit of each character in the
164 key string is deleted.
165 Since most ASCII representations set the high-order bit to 0, simply
166 deleting the low-order bit effectively reduces the size of the key space
167 from
168 .if t 2\u\s-356\s0\d
169 .if n 2**56
170 to
171 .if t 2\u\s-348\s0\d
172 .if n 2**48
173 keys.
174 To prevent this, the high-order bit must be a function depending in part
175 upon the low-order bit; so, the high-order bit is set to whatever value
176 gives odd parity.
177 This preserves the key space size.
178 Note this resetting of the parity bit is
179 .Em not
180 done if the key is given in binary or hex, and can be disabled for ASCII
181 keys as well.
182 .Pp
183 The DES is considered a very strong cryptosystem hobbled by a short
184 key, and other than table lookup attacks, key search attacks, and
185 Hellman's time-memory tradeoff (all of which are very expensive and
186 time-consuming), no practical cryptanalytic methods for breaking the
187 DES are known in the open literature.
188 As of this writing, the best
189 known cryptanalytic method is linear cryptanalysis, which requires an
190 average of
191 .if t 2\u\s-343\s0\d
192 .if n 2**43
193 known plaintext-ciphertext pairs to succeed.
194 Unfortunately for the DES, key search attacks (requiring only
195 a single known plaintext-ciphertext pair and trying
196 .if t 2\u\s-355\s0\d
197 .if n 2**55
198 keys on average) are becoming practical.
199 .Pp
200 As with all cryptosystems, the choice of keys and
201 key security remain the most vulnerable aspect of
202 .Nm .
203 .Sh IMPLEMENTATION NOTES
204 For implementors wishing to write software compatible with this program,
205 the following notes are provided.
206 This software is believed to be compatible with the implementation of the
207 data encryption standard distributed by Sun Microsystems, Inc.
208 .Pp
209 In the ECB and CBC modes, plaintext is encrypted in units of 64 bits (8 bytes,
210 also called a block).
211 To ensure that the plaintext file is encrypted correctly,
212 .Nm
213 will (internally) append from 1 to 8 bytes, the last byte containing an
214 integer stating how many bytes of that final block are from the plaintext
215 file, and encrypt the resulting block.
216 Hence, when decrypting, the last block may contain from 0 to 7 characters
217 present in the plaintext file, and the last byte tells how many.
218 Note that if during decryption the last byte of the file does not contain an
219 integer between 0 and 7, either the file has been corrupted or an incorrect
220 key has been given.
221 A similar mechanism is used for the OFB and CFB modes, except that those
222 simply require the length of the input to be a multiple of the mode size,
223 and the final byte contains an integer between 0 and one less than the number
224 of bytes being used as the mode.
225 (This was another reason that the mode size must be a multiple of 8 for those
226 modes.)
227 .Pp
228 Unlike Sun's implementation, unused bytes of that last block are not filled
229 with random data, but instead contain what was in those byte positions in
230 the preceding block.
231 This is quicker and more portable, and does not weaken the encryption
232 significantly.
233 .Pp
234 If the key is entered in ASCII, the parity bits of the key characters are set
235 so that each key character is of odd parity.
236 Unlike Sun's implementation, it is possible to enter binary or hexadecimal
237 keys on the command line, and if this is done, the parity bits are
238 .Em not
239 reset.
240 This allows testing using arbitrary bit patterns as keys.
241 .Pp
242 The Sun implementation always uses an initialization vector of 0
243 (that is, all zeroes).
244 By default,
245 .Nm
246 does too, but this may be changed from the command line.
247 .Sh SEE ALSO
248 .Xr crypt 3 ,
249 .Xr getpass 3
250 .Rs
251 .%T Data Encryption Standard
252 .%R Federal Information Processing Standard #46
253 .%Q National Bureau of Standards, U.S. Department of Commerce
254 .\" should be .%C as soon as it's supported.
255 .%O Washington DC
256 .%D January 1977
257 .Re
258 .Rs
259 .%T DES Modes of Operation
260 .%R Federal Information Processing Standard #81
261 .%Q National Bureau of Standards, U.S. Department of Commerce
262 .\" should be .%C as soon as it's supported.
263 .%O Washington DC
264 .%D December 1980
265 .Re
266 .Rs
267 .%A Dorothy Denning
268 .%T Cryptography and Data Security
269 .%I Addison-Wesley Publishing Co.
270 .\" should be .%C as soon as it's supported.
271 .%O Reading, MA
272 .%D 1982
273 .Re
274 .Rs
275 .%A Matt Bishop
276 .%T Implementation Notes on bdes(1)
277 .%R Technical Report PCS-TR-91-158
278 .%Q Department of Mathematics and Computer Science, Dartmouth College
279 .\" should be .%C as soon as it's supported.
280 .%O Hanover, NH 03755
281 .%D April 1991
282 .Re
283 .Rs
284 .%A M.J. Wiener
285 .%T Efficient DES Key Search
286 .%R Technical Report 244
287 .%Q School of Computer Science, Carleton University
288 .%D May 1994
289 .Re
290 .Rs
291 .%A Bruce Schneier
292 .%T Applied Cryptography (2nd edition)
293 .%I John Wiley \*[Am] Sons, Inc.
294 .%O New York, NY
295 .\" should be .%C as soon as it's supported.
296 .%D 1996
297 .Re
298 .Rs
299 .%A M. Matsui
300 .%T Linear Cryptanalysis Method for DES Cipher
301 .%R Advances in Cryptology -- Eurocrypt '93 Proceedings
302 .%I Springer-Verlag
303 .%D 1994
304 .Re
305 .Rs
306 .%A Blaze
307 .%A Diffie
308 .%A Rivest
309 .%A Schneier
310 .%A Shimomura
311 .%A Thompson
312 .%A Wiener
313 .%T Minimal Key Lengths for Symmetric Ciphers To Provide Adequate Commercial Security
314 .%I Business Software Alliance
315 .%O http://www.bsa.org/policy/encryption/cryptographers.html
316 .%D January 1996
317 .Re
318 .Sh BUGS
319 When this document was originally written, there was a controversy
320 raging over whether the DES would still be secure in a few years.
321 There is now near-universal consensus in the cryptographic community
322 that the key length of the DES is far too short.
323 The advent of
324 special-purpose hardware could reduce the cost of any of the methods
325 of attack named above so that they are no longer computationally
326 infeasible; in addition, the explosive growth in the number and speed
327 of modern microprocessors as well as advances in programmable logic
328 devices has brought an attack using only commodity hardware into the
329 realm of possibility.
330 Schneier and others currently recommend using
331 cryptosystems with keys of at least 90 bits when long-term security is
332 needed.
333 .Pp
334 As the key or key schedule is stored in memory, the encryption can be
335 compromised if memory is readable.
336 Additionally, programs which display programs' arguments may compromise the
337 key and initialization vector, if they are specified on the command line.
338 To avoid this
339 .Nm
340 overwrites its arguments, however, the obvious race cannot currently be
341 avoided.
342 .Pp
343 Certain specific keys should be avoided because they introduce potential
344 weaknesses; these keys, called the
345 .Em weak
346 and
347 .Em semiweak
348 keys, are (in hex notation, where p is either 0 or 1, and P is either
349 e or f):
350 .Bd -literal -offset indent
351 0x0p0p0p0p0p0p0p0p 0x0p1P0p1P0p0P0p0P
352 0x0pep0pep0pfp0pfp 0x0pfP0pfP0pfP0pfP
353 0x1P0p1P0p0P0p0P0p 0x1P1P1P1P0P0P0P0P
354 0x1Pep1Pep0Pfp0Pfp 0x1PfP1PfP0PfP0PfP
355 0xep0pep0pfp0pfp0p 0xep1Pep1pfp0Pfp0P
356 0xepepepepepepepep 0xepfPepfPfpfPfpfP
357 0xfP0pfP0pfP0pfP0p 0xfP1PfP1PfP0PfP0P
358 0xfPepfPepfPepfPep 0xfPfPfPfPfPfPfPfP
359 .Ed
360 .Pp
361 This is inherent in the DES algorithm (see Moore and Simmons,
362 .Do
363 Cycle structure of the DES with weak and semi-weak keys
364 .Dc ,
365 .Em "Advances in Cryptology \- Crypto '86 Proceedings" ,
366 Springer-Verlag New York, \(co1987, pp. 9-32.)