Telnet Encryption: CAST-128 64 bit Cipher Feedback
Extracted elements (19)
A message authentication code (MAC) was not added to CFB mode because doing so would significantly increase the byte overhead per character in the Telnet protocol, impacting performance on slow (dialup) links.
The 40-bit key variant (CAST5_40_CFB64) is included not for security but to document implementations already prevalent on the Internet that had never been formally specified.
If a new CFB64_IV command is received while encryption is enabled, the encryption machine must be re-initialized immediately after the command using the new initial vector and the keyid from the last START command.
If a START command is received with a different keyid, the encryption machine must be re-initialized immediately after the START command using the new key and the last received CFB64_IV initial vector.
If encryption is not enabled when a CFB64_IV command is received, the encryption machine must be re-initialized after the next START command, using the keyid from that START command and the IV from the CFB64_IV command.
If encryption is turned off and back on with the same keyid, intervening clear text must not change the state of the encryption machine.
If the default encryption key derived from the AUTHENTICATION option contains fewer than 16 bytes (CAST128_CFB64) or 5 bytes (CAST5_40_CFB64), that encryption option must not be offered or used.
If there are fewer than 32 (10) bytes of key data, the first 16 (5) bytes are used as keyid 0 in each direction. If there are at least 32 (10) bytes, the first 16 (5) are used for client-to-server encryption and the second 16 (5) for server-to-client encryption.
The CFB64_IV_OK command MUST be sent for backwards compatibility with existing implementations upon acceptance of the initial vector.
Any key data beyond the minimum required amounts is used as random data to be sent as an initialization vector.
CFB64_IV_BAD is sent only in the case of a protocol violation where the received IV was not the correct length (8 bytes). Only the DO ENCRYPT side may send CFB64_IV_OK or CFB64_IV_BAD.
The CFB64_IV command carries a randomly generated 8-byte initial vector sent in clear text. Only the WILL ENCRYPT side may send this command.
Three suboption commands are defined: CFB64_IV (code 1) for sending the initial vector, CFB64_IV_OK (code 2) for accepting it, and CFB64_IV_BAD (code 3) for rejecting it.
Two encryption type codes are defined: CAST5_40_CFB64 with code 8 (40-bit key) and CAST128_CFB64 with code 10 (128-bit key), for use with the Telnet encryption option.
This document assigns Telnet encryption type numbers: CAST5_40_CFB64 = 8 and CAST128_CFB64 = 10, extending the Telnet Encryption Type registry.
CFB mode does not ensure data integrity; an active attacker who can predict plaintext can modify up to 8 bytes at a time, though the following 8-byte block will be corrupted, making detection likely.
Encryption modes using 40-bit keys are not to be considered secure. CAST5_40_CFB64 is documented only to capture existing prevalent implementations.
After CFB64_IV_OK is received, the WILL ENCRYPT side performs keyid negotiation via ENC_KEYID. Once a common keyid is identified, START and END commands may be exchanged to enable or disable encryption.
The CAST 64-bit CFB algorithm uses a 64-bit (8-byte) initial vector and processes data in 64-bit chunks. V0 = CAST(iV, key); On = Dn XOR Vn; V(n+1) = CAST(On, key).