The PPP DES Encryption Protocol, Version 2 (DESE-bis)
obsoletes
- rfc-1969 — The PPP DES Encryption Protocol (DESE)
Extracted elements (27)
A new ECP Type value (3) was assigned for DESE-bis rather than reusing Type 1 from RFC 1969 because the change to padding ALL packets could cause misinterpretation of packets transmitted according to the previous specification.
An explicit 16-bit sequence number is included in each packet so that both sender and receiver can agree on packet ordering for cross-boundary CBC chaining. This also enables recovery from occasional packet loss without a full renegotiation.
CBC mode was chosen over ECB because identical plaintext sequences produce different ciphertexts under chaining, complicating cryptanalysis. CBC mode is generally considered to require more computation to deduce a 64-bit DES key by analysis of the encrypted stream.
Self-Describing Padding is applied to ALL packets in DESE-bis (unlike RFC 1969 which exempted protocols with explicit length fields) because there is no standard directory of protocols susceptible to padding-induced corruption, and selective padding creates ambiguity.
The maximum pad value is fixed at 8 (rather than the variable maximum of LCP SDP) so that the padding scheme is unambiguous and independent of any LCP Self-Describing-Padding option negotiation on the link.
Because DESE adds a 2-byte sequence number and up to 8 bytes of padding, the effective payload size increases relative to the negotiated MRU. Negotiation of DESE does not automatically increase the MRU value, so implementations must account for this growth.
If the async control character map option has been negotiated on the link, the sender applies character mapping AFTER the encryption algorithm has been run, not before.
Regardless of whether ACFC has been negotiated, the sender applies the encryption procedure only to the portion of the packet excluding the Address and Control fields. The Protocol and Information fields (and their extent under Multilink) are what gets encrypted.
Address and Control fields in the DESE packet MUST be present unless the PPP Address and Control Field Compression option (ACFC) has been negotiated.
After decrypting, the peer SHOULD discard the frame if all the octets forming the padding do not match the Self-Describing-Padding scheme (sequential integers ending with the pad count).
Once ECP has reached the Opened state, the sender MUST NOT apply the encryption procedure to LCP packets nor ECP packets.
Plain text not a multiple of 8 octets MUST be padded with sequential octets 1, 2, 3...7 to reach a multiple of 8. This Self-Describing-Padding scheme MUST be applied to ALL plain text packets, regardless of protocol type.
Plain text that is already a multiple of 8 octets MUST have an additional 8 octets of padding (1, 2, 3...8) appended prior to encryption if the last octet of the plain text has a value between 1 and 8 inclusive.
Protocol ID 0x55 REQUIRES that the Individual Link Encryption Control Protocol has reached the opened state before use, as it signals that ciphertext includes Multilink Protocol headers.
Systems implementing DESE-bis MUST NOT offer the former Type value 1 (from RFC 1969) in a configure-request, and MUST configure-reject the former value 1 upon receipt of a configure-request containing it.
To guard against replay attacks, the implementation SHOULD offer a different Initial Nonce value during each ECP negotiation. The document suggests encoding seconds since epoch in the upper 32 bits and nanoseconds in the lower 32 bits.
CBC chaining extends across packet boundaries: C[0] for each packet is the final ciphertext block of the previous packet in sequence space (or E[k](Initial Nonce) for the very first packet). Encryption: C[i] = E[k](P[i] ^ C[i-1]).
Decryption is accomplished by P[i] = C[i-1] ^ D[k](C[i]), where C[0] for the first received packet is E[k](Initial Nonce transmitted in the local ECP DESE option) and for subsequent packets is the final block of the previous packet in sequence space.
DES is used exclusively in Cipher Block Chaining (CBC) mode with a 56-bit key. The initialization vector for the first packet is derived by applying E[k] to the 64-bit Initial Nonce received in the peer's ECP DESE option.
Recovery after packet loss relies on sequence number discontinuity detection. If packet N-1 is lost, packet N cannot be decrypted (missing C[last] of N-1), but all packets N+1 and following can be decoded normally using the last ciphertext block of the received packet N.
The 16-bit sequence number is assigned by the encryptor sequentially starting with 0 for the first packet transmitted after ECP reaches the opened state. It is used to order decryption across packet boundaries when CBC chaining is applied between packets.
All limitations of the DES cipher itself (56-bit key length, known cryptanalytic attacks) are directly relevant to this protocol's security. The document provides no mechanism to strengthen DES or migrate to a stronger algorithm.
DESE-bis provides confidentiality only. It does not provide integrity, authentication, or nonrepudiation, and does not guarantee that received messages have not been modified in transit through replay, cut-and-paste, or active tampering.
The protocol relies entirely on exterior and unspecified methods for authentication and retrieval of the shared 56-bit DES key. If the shared secret can be deduced by analysis of the communication, no privacy is guaranteed.
The encryption lifecycle follows ECP states: configuration options are negotiated in the ECP negotiation phase; encryption is applied only after ECP reaches the Opened state; LCP and ECP packets are never encrypted regardless of state.
The DESE packet format contains: Address (1 byte), Control (1 byte), Protocol ID 0x53 or 0x55 (1-2 bytes), a 16-bit Sequence Number (high byte then low byte), followed by Ciphertext. Protocol ID 0x55 signals that ciphertext wraps Multilink Protocol headers.
The ECP DESE Configuration Option has Type=3 (1 byte), Length=10 (1 byte), and an Initial Nonce field of 8 bytes (64 bits), transmitted left to right. Type value 3 identifies DESE-bis; the former Type=1 from RFC 1969 is deprecated.