Telnet Encryption: DES3 64 bit Cipher Feedback
Extracted elements (16)
A message authentication code (MAC) was deliberately omitted from this cipher suite because adding one would significantly increase per-character overhead in the Telnet protocol, impacting performance on slow (dialup) links.
Key derivation from authentication session key data uses a formula: keys_to_use = bytes of key data / 8. For 2 keys, server uses key1/key2/key1 and client uses key2/key1/key2; for 3 keys, server uses key1/key2/key3 and client uses key2/key3/key1; additional rules apply for 4–6 keys.
The key derivation algorithm assumes it is safe to use a non-DES key (or part thereof) as a DES key, which is true for most authentication systems in popular use. New Telnet AUTHENTICATION mechanisms may specify alternative key derivation if their negotiated session key cannot safely be used this way.
If a new CFB64_IV command is received while encryption is enabled, the encryption/decryption machine must be re-initialized immediately after the command using the new initial vector and the keyid from the last START command.
If a START command is received with a different keyid, the encryption/decryption machine must be re-initialized immediately after the START command using the new key and the last received CFB64_IV initial vector.
If encryption is not active when a CFB64_IV command is received, the encryption machine must be re-initialized at the next START command using the keyid from that START and the IV from the CFB64_IV command.
If encryption is toggled off and back on with the same keyid, intervening cleartext must not alter the state of the encryption or decryption machine.
If the default encryption key derived from the Telnet AUTHENTICATION option contains fewer than 16 bytes, the DES3_CFB64 option must not be offered or used as a valid Telnet encryption option.
In all cases, the three keys used by DES3_CFB64 must have their parity corrected after being derived from the session key data.
The CFB64_IV_OK command MUST be sent for backwards compatibility with existing implementations. CFB64_IV_BAD should only be sent when the received IV is not the correct length (8 bytes).
CFB64_IV_OK and CFB64_IV_BAD reply commands (IAC SB ENCRYPT REPLY DES3_CFB64 CFB64_IV_OK/BAD IAC SE) accept or reject the received initial vector. Only the DO ENCRYPT side may send these replies.
DES3_CFB64 is assigned encryption type code 3 within the Telnet encryption option framework. Suboption commands are: CFB64_IV (1), CFB64_IV_OK (2), and CFB64_IV_BAD (3).
The CFB64_IV command (IAC SB ENCRYPT IS DES3_CFB64 CFB64_IV <initial vector> IAC SE) carries a random 8-byte initial vector sent in clear text. Only the WILL ENCRYPT side may send this command.
DES3 CFB64 does not ensure data integrity. An active attacker who can predict cleartext can modify up to 8 bytes at a time; the following 8-byte block will be corrupted (aiding detection), but exploitation of this weakness remains a risk.
After CFB64_IV_OK is received, the WILL ENCRYPT side performs keyid negotiation via ENC_KEYID. Once a common keyid is identified, START and END commands may be sent by the WILL ENCRYPT side to begin or stop DES3 CFB64 encryption.
The DES3 CFB64 algorithm operates on 64-bit (8-byte) blocks. The initial vector iV is 64 bits. Each chunk Dn is 64 bits. Output On = Dn XOR Vn, where V0 = DES-e(DES-d(DES-e(iV, key1), key2), key3) and V(n+1) = DES-e(DES-d(DES-e(On, key1), key2), key3).