The PPP Triple-DES Encryption Protocol (3DESE)
Extracted elements (22)
A 16-bit sequence number is included in each packet specifically because DES-EDE3-CBC mode requires the previous ciphertext block as the IV for the next packet; the sequence number allows detection of lost packets and clarifies when decryption of a packet is impossible.
DES-EDE3-CBC was chosen for PPP encryption because it is a well-studied, widely implemented algorithm that was also selected for the security section of IP (IPsec ESP). When all three keys are identical, DES-EDE3-CBC is equivalent to DES-CBC, providing backwards compatibility.
Self Describing Padding (SDP) was chosen because removing incorrect padding after decryption can be injurious to the interpretation of protocols that do not contain an explicit length field. SDP is unambiguous and requires no separate negotiation for 3DESE; only the MPV of 8 is required.
Due to CBC chaining, if packet N-1 is lost, packet N cannot be decrypted (its first block requires the last ciphertext block of N-1). However, packets N+1 and beyond can be decrypted normally using the last ciphertext block of received packet N. Packet loss is detected by discontinuities in the 16-bit sequence numbers.
If the async control character map option has been negotiated on the link, the sender applies character mapping after the encryption algorithm has been run, not before.
When using Multilink and encrypting on individual links, it is recommended that all non-terminating fragments have a length divisible by 8, so no additional padding is needed on those fragments.
Address and Control fields MUST be present in the 3DESE packet unless the PPP Address and Control Field Compression option (ACFC) has been negotiated.
After decrypting, the peer SHOULD discard the frame if the octets forming the padding do not match the Self Describing Padding scheme.
All packets not already a multiple of eight bytes in length MUST be padded prior to encrypting using Self Describing Padding with a Maximum Pad Value (MPV) of 8, using the octet sequence 1, 2, 3, ..., up to 7.
Once ECP has reached the Opened state, the sender MUST NOT apply the 3DESE encryption procedure to LCP packets nor to ECP packets.
Plain text whose length is already a multiple of 8 octets MUST only be padded with an additional 8 octets (1, 2, 3 ... 8) if the last octet of the plain text had a value of 8 or less.
To guard against replay attacks, the implementation SHOULD offer a different Initial Nonce value during each ECP negotiation.
When configuring keys for 3DESE, keys with incorrect parity or so-called weak keys SHOULD be rejected.
3DESE uses DES-EDE3-CBC mode: an IV is XOR'd with the first 64-bit plaintext block, then the keyed DES function is applied as Encrypt(k1), Decrypt(k2), Encrypt(k3) to produce ciphertext. Successive blocks XOR the previous ciphertext block with the current plaintext before applying DES-EDE3.
The 16-bit Sequence Number is assigned by the encryptor sequentially starting with 0 for the first packet transmitted once ECP has reached the opened state. It is used to detect lost packets.
The 3DES key is effectively 168 bits, consisting of three independent 56-bit quantities. Each 56-bit subkey is stored as a 64-bit (8 octet) quantity, with the least significant bit of each octet used as a parity bit.
The encryption procedure is only applied to the portion of the packet excluding the address and control field. When encrypting the first packet after ECP reaches the opened state, the Initial Nonce is first encrypted via the 3DES algorithm before use as the IV.
The Protocol ID field value is 0x53 for normal encrypted packets, or 0x55 to indicate use of the Individual Link Encryption Control Protocol and that the ciphertext contains a Multilink fragment.
3DESE provides confidentiality only. It does not provide integrity, authentication, or nonrepudiation, and does not guarantee that received messages have not been modified via replay, cut-and-paste, or active tampering. Source authentication is not provided.
The protocol relies on exterior and unspecified methods for retrieval of shared secrets. Any limitations of the 3DES cipher and any methodology for protection and retrieval of shared secrets are relevant to the security of this protocol.
The 3DESE packet format contains Address (1 byte), Control (1 byte), Protocol ID (0x53 or 0x55, 2 bytes), a 16-bit Sequence Number (high and low bytes), and the Ciphertext payload. Protocol Field Compression MAY be applied to the leading zero of the Protocol ID.
The ECP 3DESE Configuration Option has Type=2, Length=10, and an 8-byte Initial Nonce field. The Initial Nonce is used by the peer to encrypt the first packet after the sender reaches the opened state.