rfc2420.txt

来自「RFC 的详细文档！」· 文本 代码 · 共 452 行 · 第 1/2 页

Network Working Group                                         H. Kummert
Request for Comments: 2420                                   Nentec GmbH
Category: Standards Track                                 September 1998


             The PPP Triple-DES Encryption Protocol (3DESE)

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   The Point-to-Point Protocol (PPP) [1] provides a standard method for
   transporting multi-protocol datagrams over point-to-point links.

   The PPP Encryption Control Protocol (ECP) [2] provides a method to
   negotiate and utilize encryption protocols over PPP encapsulated
   links.

   This document provides specific details for the use of the Triple-DES
   standard (3DES) [6] for encrypting PPP encapsulated packets.

Table of Contents

   1.   Introduction .............................................. 2
   1.1  Algorithm ................................................. 2
   1.2  Keys ...................................................... 3
   2.   3DESE Configuration Option for ECP ........................ 3
   3.   Packet format for 3DESE ................................... 4
   4.   Encryption ................................................ 5
   4.1  Padding ................................................... 5
   4.2  Recovery after packet loss ................................ 6
   5.   Security Considerations ................................... 6
   6.   References ................................................ 7
   7.   Acknowledgements .......................................... 7
   8.   Author's Address .......................................... 7
   9.   Full Copyright Statement .................................. 8





Kummert                     Standards Track                     [Page 1]

RFC 2420               PPP Triple-DES Encryption          September 1998


1. Introduction

   The purpose of encrypting packets exchanged between two PPP
   implementations is to attempt to insure the privacy of communication
   conducted via the two implementations. There exists a large variety
   of encryption algorithms, where one is the DES algorithm. The DES
   encryption algorithm is a well studied, understood and widely
   implemented encryption algorithm.  Triple-DES means that this
   algorithm is applied three times on the data to be encrypted before
   it is sent over the line. The variant used is the DES-EDE3-CBC, which
   is described in more detail in the text. It was also chosen to be
   applied in the security section of IP [5].

   This document shows how to send via the Triple-DES algorithm
   encrypted packets over a point-to-point-link. It lies in the context
   of the generic PPP Encryption Control Protocol [2].

   Because of the use of the CBC-mode a sequence number is provided to
   ensure the right order of transmitted packets. So lost packets can be
   detected.

   The padding section reflects the result of the discussion on this
   topic on the ppp mailing list.

   In this document, the key words "MUST", "SHOULD", and "recommended"
   are to be interpreted as described in [3].

1.1  Algorithm

   The DES-EDE3-CBC algorithm is a simple variant of the DES-CBC
   algorithm.  In DES-EDE3-CBC, an Initialization Vector (IV) is XOR'd
   with the first 64-bit (8 octet) plaintext block (P1).  The keyed DES
   function is iterated three times, an encryption (E) followed by a
   decryption (D) followed by an encryption (E), and generates the
   ciphertext (C1) for the block. Each iteration uses an independent
   key: k1, k2 and k3.

   For successive blocks, the previous ciphertext block is XOR'd with
   the current 8-octet plaintext block (Pi). The keyed DES-EDE3
   encryption function generates the ciphertext (Ci) for that block.











Kummert                     Standards Track                     [Page 2]

RFC 2420               PPP Triple-DES Encryption          September 1998


                      P1             P2                 Pi
                      |              |                  |
               IV--->(X)    +------>(X)      +-------->(X)
                      v     |        v       |          v
                   +-----+  |     +-----+    |       +-----+
               k1->|  E  |  | k1->|  E  |    :   k1->|  E  |
                   +-----+  |     +-----+    :       +-----+
                      |     |        |       :          |
                      v     |        v       :          v
                   +-----+  ^     +-----+    ^       +-----+
               k2->|  D  |  | k2->|  D  |    |   k2->|  D  |
                   +-----+  |     +-----+    |       +-----+
                      |     |        |       |          |
                      v     |        v       |          v
                   +-----+  |     +-----+    |       +-----+
               k3->|  E  |  | k3->|  E  |    |   k3->|  E  |
                   +-----+  |     +-----+    |       +-----+
                      |     |        |       |          |
                      +---->+        +------>+          +---->
                      |              |                  |
                      C1             C2                 Ci

   To decrypt, the order of the functions is reversed: decrypt with k3,
   encrypt with k2, decrypt with k1, and XOR with the previous cipher-
   text block.

   When all three keys (k1, k2 and k3) are the same, DES-EDE3-CBC is
   equivalent to DES-CBC.

1.2  Keys

   The secret DES-EDE3 key shared between the communicating parties is
   effectively 168-bits long.  This key consists of three independent
   56-bit quantities used by the DES algorithm.  Each of the three 56-
   bit subkeys is stored as a 64-bit (8 octet) quantity, with the least
   significant bit of each octet used as a parity bit.

   When configuring keys for 3DESE those with incorrect parity or so-
   called weak keys [6] SHOULD be rejected.

2.  3DESE Configuration Option for ECP

   Description

        The ECP 3DESE Configuration Option indicates that the issuing
        implementation is offering to employ this specification for
        decrypting communications on the link, and may be thought of as
        a request for its peer to encrypt packets in this manner.  The



Kummert                     Standards Track                     [Page 3]

RFC 2420               PPP Triple-DES Encryption          September 1998


        ECP 3DESE Configuration Option has the following fields, which
        are transmitted from left to right:

                   Figure 1:  ECP 3DESE Configuration Option

      0                   1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |     Type      |    Length     |         Initial Nonce ...
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Type

           2, to indicate the 3DESE protocol.

      Length

           10

      Initial Nonce

              This field is an 8 byte quantity which is used by the peer
              implementation to encrypt the first packet transmitted
              after the sender reaches the opened state. To guard
              against replay attacks, the implementation SHOULD offer a
              different value during each ECP negotiation.

3.  Packet format for 3DESE

   Description

        The 3DESE packets that contain the encrypted payload have the
        following fields:

               Figure 2:  3DESE Encryption Protocol Packet Format

      0                   1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |    Address    |    Control    |     0000      |  Protocol ID  |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      | Seq. No. High | Seq. No. Low  |        Ciphertext ...
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Address and Control

              These fields MUST be present unless the PPP Address and
              Control Field Compression option (ACFC) has been



Kummert                     Standards Track                     [Page 4]