Telnet Encryption: DES3 64 bit Output Feedback
Extracted elements (17)
OFB mode was chosen originally when CPU speeds were too slow for CFB. The document notes that CPUs have since become much faster and suggests DES3_OFB64 may warrant deprecation in favor of CFB modes given OFB's inherent weaknesses.
The key derivation algorithm assumes it is safe to use a non-DES key (or part thereof) as a DES key. This is not universally true but is specified as default for compatibility with popular authentication systems and existing implementations. New AUTHENTICATION mechanisms may specify alternative key derivation if needed.
If a new OFB64_IV command is received while encryption is enabled, the encryption/decryption machine must be re-initialized immediately after the OFB64_IV command using the new IV and the keyid from the last START command.
If a START command is received with a different keyid, the encryption/decryption machine must be re-initialized immediately after the START command using the new key and the last received OFB64_IV initial vector.
If encryption is not enabled when an OFB64_IV command arrives, the machine must be re-initialized after the next START command, using the keyid from that START and the IV from the OFB64_IV command.
If encryption is turned off and back on using the same keyid, intervening clear text must not change the state of the encryption/decryption machine.
If the default encryption key derived from the telnet AUTHENTICATION option contains less than 16 bytes, then the DES3_OFB64 option must not be offered or used.
In all cases, the keys used by DES3_OFB64 must have their parity corrected after being determined by the key derivation algorithm.
The OFB64_IV_OK command MUST be sent for backwards compatibility with existing implementations.
DES3_OFB64 is assigned encryption type code 4. Suboption commands are OFB64_IV (1), OFB64_IV_OK (2), and OFB64_IV_BAD (3).
IAC SB ENCRYPT IS DES3_OFB64 OFB64_IV <initial vector> IAC SE: the WILL ENCRYPT side generates a random 8-byte initial vector and sends it in clear text to the peer.
IAC SB ENCRYPT REPLY DES3_OFB64 OFB64_IV_OK/OFB64_IV_BAD IAC SE: the DO ENCRYPT side accepts or rejects the received initial vector. OFB64_IV_BAD is only appropriate when the IV is not 8 bytes.
The DES3 OFB64 algorithm applies three DES operations in sequence — encrypt with key1, decrypt with key2, encrypt with key3 — to the feedback register to produce each keystream block, which is then XORed with plaintext.
The number of DES keys to use is derived as: keys_to_use = bytes of key data / 8. Keys are labeled key1 through key6 in 8-byte segments. Different key assignments apply depending on whether 2, 3, 4, 5, or 6 keys are available, with server and client using distinct key combinations.
Output Feedback mode does not ensure data integrity; an active attacker who can predict the clear text may be able to substitute text. Adding a MAC would significantly increase per-character byte overhead, impacting performance on slow links.
After OFB64_IV_OK is received, the WILL ENCRYPT side performs keyid negotiation via ENC_KEYID. Once a common keyid is established, START and END commands may be issued. Encryption uses the DES3 64-bit OFB algorithm.
The initial vector (iV) is 64 bits (8 bytes). Each data chunk Dn is 64 bits (8 bytes). Output On = Dn XOR Vn, where V0 = DES-e(DES-d(DES-e(iV, key1), key2), key3) and V(n+1) = DES-e(DES-d(DES-e(Vn, key1), key2), key3).