The ESP DES-CBC Transform
Extracted elements (23)
DES-CBC encryption produces output the same length as input, facilitating in-place encryption and decryption without additional buffer allocation.
Octets within padding are unspecified and implementation-dependent (preferably random); padding aligns the Pad Length and Payload Type fields at an eight-octet boundary required by DES block size.
The IV is included in every datagram rather than maintained as shared state, so that decryption of each received datagram can be performed independently even when other datagrams are dropped or arrive out of order.
On receipt, if the length of data to be decrypted is not an integral multiple of eight octets, an error must be indicated as described in RFC-1825.
After decryption, the Padding field MUST be ignored.
All conformant implementations MUST correctly process a 64-bit IV field size to provide strict compatibility with existing hardware implementations.
All implementations that claim conformance or compliance with the Encapsulating Security Payload specification MUST implement the DES-CBC transform.
The IV size MUST be a multiple of 32 bits. Sizes of 32 and 64 bits are required to be supported; use of other sizes is beyond the scope of this specification.
The Security Parameters Index (SPI) field is a 32-bit value identifying the Security Parameters for the datagram. The value MUST NOT be zero.
The session key SHOULD be changed at least as frequently as every 2^32 datagrams, even when a full 64-bit IV is used, to prevent IV repetition.
Each datagram carries its own Initialization Vector (IV) of eight octets. Including the IV per-datagram ensures decryption remains possible even when datagrams are dropped or reordered.
The Pad Length field indicates the number of padding octets and is opaque: set before encryption, examined only after decryption. Its value ranges from 0 to 7 normally but may be up to 255 to hide actual data length.
The Payload Type field carries the IP Protocol/Payload value identifying the protocol header beginning the payload. It is opaque: set before encryption, examined only after decryption.
The secret DES key is eight octets (64 bits) in length. The 56-bit key quantity is stored as 64 bits with the least significant bit of each octet used as a parity bit.
When the IV field size is 32 bits, the 64-bit DES IV is formed by concatenating the 32-bit value with its bitwise complement. This 32-bit field size is most common as it aligns Payload Data for both 32-bit and 64-bit processing.
Differential cryptanalysis (Biham & Shamir 1993) requires 2^47 chosen plaintext-ciphertext pairs and linear cryptanalysis (Matsui 1994) requires 2^43 known-plaintext pairs to break DES. While not yet considered fully practical, these attacks must be taken into account.
One or two blocks of known plaintext suffice to recover a DES key. Because IP datagrams typically begin with known and/or guessable header text, frequent key changes will not protect against known-plaintext attacks.
Security quality depends entirely on DES algorithm strength, implementation correctness, key management security, key strength, and all participating nodes. Users should take care not to select weak keys.
The cut-and-paste attack (Bellovin 1995) exploits CBC mode: a damaged block and the following block are garbled on decryption, but subsequent blocks decrypt correctly. An attacker with access to the same key can insert or replay previously encrypted data. Transport checksums detect but do not cryptographically prevent this; integrity protection per RFC-1826 is needed.
Wiener (1994) demonstrated a DES cracking machine costing $1 million that can crack one key every 3.5 hours, making brute-force key recovery extremely practical. DES is not considered adequate for protecting moderate-value information; Triple DES is recommended instead.
Decryption procedure: extract SPI and look up Security Parameters; extract IV and construct 64-bit value; decrypt with DES-CBC; examine Payload Type (discard with ICMP if unrecognized); strip Pad Length octets; pass decrypted payload to the indicated protocol.
Encryption procedure: pad plaintext to modulo-8 length equal to 6, append Pad Length octet, append Payload Type octet, obtain IV, encrypt with DES-CBC, construct IP datagram with SPI and IV prepended.
The ESP DES-CBC payload format is: 32-bit SPI | variable IV (32 or 64 bits) | variable Payload Data | variable Padding | 8-bit Pad Length | 8-bit Payload Type. All fields after the SPI through Payload Type are encrypted together.