rfc2451.txt

RFC 的详细文档！


RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


   The DES-EDE3-CBC algorithm is a simple variant of the DES-CBC
   algorithm [FIPS-46].  The "outer" chaining technique is used.

   In DES-EDE3-CBC, an Initialization Vector (IV) is XOR'd with the
   first 64-bit (8 byte) plaintext block (P1).  The keyed DES function
   is iterated three times, an encryption (Ek1) followed by a decryption
   (Dk2) followed by an encryption (Ek3), and generates the ciphertext
   (C1) for the block.  Each iteration uses an independent key: k1, k2
   and k3.

   For successive blocks, the previous ciphertext block is XOR'd with
   the current plaintext (Pi).  The keyed DES-EDE3 encryption function
   generates the ciphertext (Ci) for that block.

   To decrypt, the order of the functions is reversed: decrypt with k3,
   encrypt with k2, decrypt with k1, and XOR the previous ciphertext
   block.

   Note that when all three keys (k1, k2 and k3) are the same, DES-
   EDE3-CBC is equivalent to DES-CBC.  This property allows the DES-EDE3
   hardware implementations to operate in DES mode without modification.

   For more explanation and implementation information for Triple DES,
   see [Schneier95].

2.7 Performance

   For a comparison table of the estimated speed of any of these and
   other cipher algorithms, please see [Schneier97] or for an up-to-date
   performance comparison, please see [Bosseleaers].

3. ESP Payload

   The ESP payload is made up of the IV followed by raw cipher-text.
   Thus the payload field, as defined in [Kent98], is broken down
   according to the following diagram:

   +---------------+---------------+---------------+---------------+
   |                                                               |
   +               Initialization Vector (8 octets)                +
   |                                                               |
   +---------------+---------------+---------------+---------------+
   |                                                               |
   ~              Encrypted Payload (variable length)              ~
   |                                                               |
   +---------------------------------------------------------------+
    1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8




Pereira & Adams             Standards Track                     [Page 8]

RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


   The IV field MUST be same size as the block size of the cipher
   algorithm being used.  The IV MUST be chosen at random.  Common
   practice is to use random data for the first IV and the last block of
   encrypted data from an encryption process as the IV for the next
   encryption process.

   Including the IV in each datagram ensures that decryption of each
   received datagram can be performed, even when some datagrams are
   dropped, or datagrams are re-ordered in transit.

   To avoid ECB encryption of very similar plaintext blocks in different
   packets, implementations MUST NOT use a counter or other low-Hamming
   distance source for IVs.

3.1 ESP Environmental Considerations

   Currently, there are no known issues regarding interactions between
   these algorithms and other aspects of ESP, such as use of certain
   authentication schemes.

3.2 Keying Material

   The minimum number of bits sent from the key exchange protocol to
   this ESP algorithm must be greater or equal to the key size.

   The cipher's encryption and decryption key is taken from the first
   <x> bits of the keying material, where <x> represents the required
   key size.

4. Security Considerations

   Implementations are encouraged to use the largest key sizes they can
   when taking into account performance considerations for their
   particular hardware and software configuration.  Note that encryption
   necessarily impacts both sides of a secure channel, so such
   consideration must take into account not only the client side, but
   the server as well.

   For information on the case for using random values please see
   [Bell97].

   For further security considerations, the reader is encouraged to read
   the documents that describe the actual cipher algorithms.








Pereira & Adams             Standards Track                     [Page 9]

RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


5. References

   [Adams97]   Adams, C, "The CAST-128 Encryption Algorithm",
               RFC2144, 1997.

   [Atkinson98]Kent, S. and R. Atkinson, "Security Architecture for the
               Internet Protocol", RFC 2401, November 1998.

   [Baldwin96] Baldwin, R. and R. Rivest, "The RC5, RC5-CBC, RC5-CBC-
               Pad, and RC5-CTS Algorithms", RFC 2040, October 1996.

   [Bell97]    S. Bellovin, "Probable Plaintext Cryptanalysis of the IP
               Security Protocols", Proceedings of the Symposium on
               Network and Distributed System Security, San Diego, CA,
               pp. 155-160, February 1997 (also
               http://www.research.att.com/~smb/probtxt.{ps, pdf}).

   [Bosselaers]A. Bosselaers, "Performance of Pentium implementations",
               http://www.esat.kuleuven.ac.be/~bosselae/

   [Bradner97] Bradner, S., "Key words for use in RFCs to indicate
               Requirement Levels", BCP 14, RFC 2119, March 1997.

   [Crypto93]  J. Daemen, R. Govaerts, J. Vandewalle, "Weak Keys for
               IDEA", Advances in Cryptology, CRYPTO 93 Proceedings,
               Springer-Verlag, pp. 224-230.

   [FIPS-46]   US National Bureau of Standards, "Data Encryption
               Standard", Federal Information Processing Standard (FIPS)
               Publication 46, January 1977.

   [Kent98]    Kent, S. and R. Atkinson, "IP Encapsulating Security
               Payload (ESP)", RFC 2406, November 1998.

   [Lai]       X. Lai, "On the Design and Security of Block Ciphers",
               ETH Series in Information Processing, v. 1, Konstanz:
               Hartung-Gorre Verlag, 1992.

   [Madson98]  Madson, C. and N. Dorswamy, "The ESP DES-CBC Cipher
               Algorithm With Explicit IV", RFC 2405, November 1998.

   [MOV]       A. Menezes, P. Van Oorschot, S. Vanstone, "Handbook of
               Applied Cryptography", CRC Press, 1997. ISBN 0-8493-
               8523-7

   [Schneier]  B. Schneier, "Applied Cryptography Second Edition", John
               Wiley & Sons, New York, NY, 1995.  ISBN 0-471-12845-7




Pereira & Adams             Standards Track                    [Page 10]

RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


   [Schneier93]B. Schneier, "Description of a New Variable-Length Key,
               64-Bit Block Cipher", from "Fast Software Encryption,
               Cambridge Security Workshop Proceedings", Springer-
               Verlag, 1994, pp. 191-204.
               http://www.counterpane.com/bfsverlag.html

   [Schneier95]B. Schneier, "The Blowfish Encryption Algorithm - One
               Year Later", Dr. Dobb's Journal, September 1995,
               http://www.counterpane.com/bfdobsoyl.html

   [Schneier97]B. Scheier, "Speed Comparisons of Block Ciphers on a
               Pentium." February 1997,
               http://www.counterpane.com/speed.html

   [Thayer97]  Thayer, R., Doraswamy, N. and R. Glenn, "IP Security
               Document Roadmap", RFC 2411, November 1998.

   [Tuchman79] Tuchman, W, "Hellman Presents No Shortcut Solutions to
               DES", IEEE Spectrum, v. 16 n. 7, July 1979, pp. 40-41.

6. Acknowledgments

   This document is a merger of most of the ESP cipher algorithm
   documents.  This merger was done to facilitate greater understanding
   of the commonality of all of the ESP algorithms and to further the
   development of these algorithm within ESP.

   The content of this document is based on suggestions originally from
   Stephen Kent and subsequent discussions from the IPSec mailing list
   as well as other IPSec documents.

   Special thanks to Carlisle Adams and Paul Van Oorschot both of
   Entrust Technologies who provided input and review of CAST.

   Thanks to all of the editors of the previous ESP 3DES documents; W.
   Simpson, N. Doraswamy, P. Metzger, and P. Karn.

   Thanks to Brett Howard from TimeStep for his original work of ESP-
   RC5.

   Thanks to Markku-Juhani Saarinen, Helger Lipmaa and Bart Preneel for
   their input on IDEA and other ciphers.









Pereira & Adams             Standards Track                    [Page 11]

RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


7. Editors' Addresses

   Roy Pereira
   TimeStep Corporation

   Phone: [phone] x 4808
   EMail: [e-mail]


   Rob Adams
   Cisco Systems Inc.

   Phone: [phone]
   EMail: [e-mail]


   Contributors:

   Robert W. Baldwin
   RSA Data Security, Inc.

   Phone: [phone]
   EMail: [e-mail] or [e-mail]


   Greg Carter
   Entrust Technologies

   Phone: [phone]
   EMail: [e-mail]


   Rodney Thayer
   Sable Technology Corporation

   Phone: [phone]
   EMail: [e-mail]














Pereira & Adams             Standards Track                    [Page 12]

RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


   The IPSec working group can be contacted via the IPSec working
   group's mailing list ([e-mail]) or through its chairs:

   Robert Moskowitz
   International Computer Security Association

   EMail: [e-mail]


   Theodore Y. Ts'o
   Massachusetts Institute of Technology

   EMail: [e-mail]






































Pereira & Adams             Standards Track                    [Page 13]

RFC 2451             ESP CBC-Mode Cipher Algorithms        November 1998


8.  Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
























Pereira & Adams             Standards Track                    [Page 14]