The ESP CBC-Mode Cipher Algorithms
Extracted elements (20)
CBC mode with a randomly generated IV prevents generation of identical ciphertext from packets that have identical data spanning the first block, avoiding the deterministic leakage that ECB mode would produce.
Default key sizes (128 bits for CAST-128, RC5, IDEA, and Blowfish; 192 bits for 3DES) were chosen by consulting algorithm experts and balancing cryptographic strength against performance.
Including the IV in each datagram ensures that decryption of each received datagram can be performed even when datagrams are dropped or reordered in transit. This is why per-packet IVs are included rather than relying on chained state.
When all three 3DES keys k1, k2, k3 are identical, DES-EDE3-CBC is equivalent to DES-CBC. This property allows 3DES hardware to operate in DES mode without modification, which is why the EDE (encrypt-decrypt-encrypt) structure was chosen.
This document explicitly covers Blowfish, CAST-128, 3DES, IDEA, and RC5 but states any block cipher MAY be used with ESP in CBC mode, provided all variables (mode, key size, weak keys, block size, rounds) are clearly defined.
3DES implementations MUST take into consideration the parity bits when initially accepting a new set of keys; each of the three keys is 56 bits in length with 8 extra parity bits.
All key sizes MUST be a multiple of 8 bits.
CAST-128 keys less than 128 bits MUST be padded with zeros in the rightmost (least significant) positions out to 128 bits, since the CAST-128 key schedule assumes a 128-bit input key.
For 3DES, implementations MUST reject keys where the first two or last two independent 64-bit keys are equal (k1 == k2 or k2 == k3), as this reduces 3DES to simple DES.
Implementations MUST NOT use a counter or other low-Hamming-distance source for IVs, to avoid ECB encryption of very similar plaintext blocks across different packets.
The IV MUST be chosen at random. Common practice is to use random data for the first IV and the last encrypted block from the previous encryption process as the IV for the next.
The minimum number of bits sent from the key exchange protocol to the ESP algorithm must be greater than or equal to the required key size. The cipher key is taken from the first <x> bits of the keying material.
Weak key checks SHOULD be performed. If a weak key is found, the key SHOULD be rejected and a new SA requested.
3DES-EDE3-CBC processes each 64-bit block three times using independent keys k1, k2, k3 in the sequence encrypt(k1) → decrypt(k2) → encrypt(k3), using the 'outer' CBC chaining technique where the previous ciphertext block is XOR'd with the current plaintext before the EDE3 operation.
All CBC-mode cipher algorithms used with ESP require an Initialization Vector (IV) the same size as the cipher block size. The IV is XOR'd with the first plaintext block before encryption; for successive blocks, the previous ciphertext block is XOR'd with the current plaintext.
All cipher algorithms described use a block size of eight octets (64 bits). Padding must be sufficient to align the data to be encrypted to an eight-octet (64-bit) boundary, as specified in the ESP document.
Rounds are fixed (non-negotiable) for all specified algorithms: CAST-128 uses 12 rounds for keys ≤80 bits and 16 for keys >80 bits; RC5 uses 16; IDEA uses 8; Blowfish uses 16; 3DES uses 48 (16×3). A default value MUST always exist when rounds are not negotiated.
Blowfish weak keys produce identical entries in a given S-box, but cannot be tested before S-box generation; however, the probability of randomly generating such a key is small. IDEA has known weak keys documented in cryptographic literature.
Implementations are encouraged to use the largest key sizes feasible given hardware and software performance constraints, noting that encryption impacts both sides of a secure channel. Authors strongly advise against key sizes smaller than 40 bits.
The ESP payload for CBC-mode ciphers consists of an 8-octet (64-bit) Initialization Vector field followed by the variable-length Encrypted Payload. The IV field MUST be the same size as the cipher's block size.