The ESP DES-CBC Cipher Algorithm With Explicit IV
Extracted elements (17)
Common practice of using the last 8 octets of encrypted data as the IV for the next encryption logically extends CBC across packets and limits leakage from the random number generator, though receivers MUST NOT rely on this.
Including the explicit IV in each datagram ensures decryption of each received datagram is possible even when datagrams are dropped or reordered in transit, rather than relying on chained state across packets.
When default ESP padding is used, the padding bytes have predictable values, providing a small measure of tamper detection on their own block and the previous block in CBC mode, making splicing attacks harder and avoiding a covert channel.
As of the time of writing, there are no known issues precluding use of DES-CBC with any specific authentication algorithm.
A strong pseudo-random function MUST be used to generate the required key, per RFC 1750.
DES-CBC MUST use a block size of 8 octets (64 bits). When padding is required, it MUST be done according to the conventions specified in [ESP].
The IV MUST be a random value; implementations MUST NOT use a counter or other low-Hamming distance source for IVs.
The key derivation mechanism MUST derive a 64-bit key value for use by this cipher; the derivation process is not responsible for handling parity or weak key checks.
The receiver MUST NOT assume any meaning for the IV value other than that it is an IV.
Weak key checks SHOULD be performed. If a weak key is found, the key SHOULD be rejected and a new SA requested.
DES-CBC uses a symmetric secret-key block algorithm with a 64-bit block size and a 64-bit key (56 significant bits; least significant bit of each byte is a parity bit).
DES has 16 known weak keys, including semi-weak keys, listed in [FIPS74]. Implementations performing weak key checks should note that the known weak keys have been adjusted for parity.
A $1M DES-cracking machine can recover one key every 3.5 hours using a known-plaintext attack; IP datagrams typically begin with guessable header text, making frequent key changes insufficient protection.
DES-CBC provides no authentication; use without a corresponding authentication mechanism (either ESP with auth or a companion AH header) is strongly discouraged due to cut-and-paste splicing attacks.
Differential cryptanalysis requires 2^47 chosen plaintext-ciphertext pairs and linear cryptanalysis requires 2^43 known-plaintext pairs against DES; Triple DES is recommended for protecting moderate-value information.
Using a low-Hamming distance IV source (e.g., a counter) in CBC mode can expose nearly identical effective plaintext across packets, enabling cryptanalytic attacks; IVs MUST differ substantially between packets.
The ESP payload for DES-CBC consists of an 8-octet (64-bit) Initialization Vector (IV) immediately followed by the variable-length encrypted payload.