Unix/Linux Go Back    


NetBSD 6.1.5 - man page for bdes (netbsd section 1)

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:   man
Select Man Page Set:       apropos Keyword Search (sections above)


BDES(1) 			   BSD General Commands Manual				  BDES(1)

NAME
     bdes -- encrypt/decrypt using the Data Encryption Standard

SYNOPSIS
     bdes [-abdp] [-F N] [-f N] [-k key] [-m N] [-o N] [-v vector]

DESCRIPTION
     bdes implements all DES modes of operation described in FIPS PUB 81, including alternative
     cipher feedback mode and both authentication modes.  bdes reads from the standard input and
     writes to the standard output.  By default, the input is encrypted using cipher block chain-
     ing mode.	Using the same key for encryption and decryption preserves plain text.

     All modes but the electronic code book mode require an initialization vector; if none is
     supplied, the zero vector is used.  If no key is specified on the command line, the user is
     prompted for one (see getpass(3) for more details).

     The options are as follows:
     -a 	The key and initialization vector strings are to be taken as ASCII, suppressing
		the special interpretation given to leading ``0X'', ``0x'', ``0B'', and ``0b''
		characters.  This flag applies to both the key and initialization vector.
     -b 	Use electronic code book mode.	This is not recommended for messages longer than
		8 bytes, as patterns in the input will show through to the output.
     -d 	Decrypt the input.
     -F N	Use N-bit alternative cipher feedback mode.  Currently N must be a multiple of 7
		between 7 and 56 inclusive (this does not conform to the alternative CFB mode
		specification).
     -f N	Use N-bit cipher feedback mode.  Currently N must be a multiple of 8 between 8
		and 64 inclusive (this does not conform to the standard CFB mode specification).
     -k key	Use key as the cryptographic key.
     -m N	Compute a message authentication code (MAC) of N bits on the input.  The value of
		N must be between 1 and 64 inclusive; if N is not a multiple of 8, enough 0 bits
		will be added to pad the MAC length to the nearest multiple of 8.  Only the MAC
		is output.  MACs are only available in cipher block chaining mode or in cipher
		feedback mode.
     -o N	Use N-bit output feedback mode.  Currently N must be a multiple of 8 between 8
		and 64 inclusive (this does not conform to the OFB mode specification).
     -p 	Disable the resetting of the parity bit.  This flag forces the parity bit of the
		key to be used as typed, rather than making each character be of odd parity.  It
		is used only if the key is given in ASCII.
     -v vector	Set the initialization vector to vector; the vector is interpreted in the same
		way as the key.  The vector is ignored in electronic codebook mode.  For best
		security, a different initialization vector should be used for each file.

     The key and initialization vector are taken as sequences of ASCII characters which are then
     mapped into their bit representations.  If either begins with ``0X'' or ``0x'', that one is
     taken as a sequence of hexadecimal digits indicating the bit pattern; if either begins with
     ``0B'' or ``0b'', that one is taken as a sequence of binary digits indicating the bit pat-
     tern.  In either case, only the leading 64 bits of the key or initialization vector are
     used, and if fewer than 64 bits are provided, enough 0 bits are appended to pad the key to
     64 bits.

     According to the DES standard, the low-order bit of each character in the key string is
     deleted.  Since most ASCII representations set the high-order bit to 0, simply deleting the
     low-order bit effectively reduces the size of the key space from 2**56 to 2**48 keys.  To
     prevent this, the high-order bit must be a function depending in part upon the low-order
     bit; so, the high-order bit is set to whatever value gives odd parity.  This preserves the
     key space size.  Note this resetting of the parity bit is not done if the key is given in
     binary or hex, and can be disabled for ASCII keys as well.

     The DES is considered a very strong cryptosystem hobbled by a short key, and other than ta-
     ble lookup attacks, key search attacks, and Hellman's time-memory tradeoff (all of which are
     very expensive and time-consuming), no practical cryptanalytic methods for breaking the DES
     are known in the open literature.	As of this writing, the best known cryptanalytic method
     is linear cryptanalysis, which requires an average of 2**43 known plaintext-ciphertext pairs
     to succeed.  Unfortunately for the DES, key search attacks (requiring only a single known
     plaintext-ciphertext pair and trying 2**55 keys on average) are becoming practical.

     As with all cryptosystems, the choice of keys and key security remain the most vulnerable
     aspect of bdes.

IMPLEMENTATION NOTES
     For implementors wishing to write software compatible with this program, the following notes
     are provided.  This software is believed to be compatible with the implementation of the
     data encryption standard distributed by Sun Microsystems, Inc.

     In the ECB and CBC modes, plaintext is encrypted in units of 64 bits (8 bytes, also called a
     block).  To ensure that the plaintext file is encrypted correctly, bdes will (internally)
     append from 1 to 8 bytes, the last byte containing an integer stating how many bytes of that
     final block are from the plaintext file, and encrypt the resulting block.	Hence, when
     decrypting, the last block may contain from 0 to 7 characters present in the plaintext file,
     and the last byte tells how many.	Note that if during decryption the last byte of the file
     does not contain an integer between 0 and 7, either the file has been corrupted or an incor-
     rect key has been given.  A similar mechanism is used for the OFB and CFB modes, except that
     those simply require the length of the input to be a multiple of the mode size, and the
     final byte contains an integer between 0 and one less than the number of bytes being used as
     the mode.	(This was another reason that the mode size must be a multiple of 8 for those
     modes.)

     Unlike Sun's implementation, unused bytes of that last block are not filled with random
     data, but instead contain what was in those byte positions in the preceding block.  This is
     quicker and more portable, and does not weaken the encryption significantly.

     If the key is entered in ASCII, the parity bits of the key characters are set so that each
     key character is of odd parity.  Unlike Sun's implementation, it is possible to enter binary
     or hexadecimal keys on the command line, and if this is done, the parity bits are not reset.
     This allows testing using arbitrary bit patterns as keys.

     The Sun implementation always uses an initialization vector of 0 (that is, all zeroes).  By
     default, bdes does too, but this may be changed from the command line.

SEE ALSO
     crypt(3), getpass(3)

     Data Encryption Standard, Federal Information Processing Standard #46, National Bureau of
     Standards, U.S. Department of Commerce, January 1977, Washington DC.

     DES Modes of Operation, Federal Information Processing Standard #81, National Bureau of
     Standards, U.S. Department of Commerce, December 1980, Washington DC.

     Dorothy Denning, Cryptography and Data Security, Addison-Wesley Publishing Co., 1982,
     Reading, MA.

     Matt Bishop, Implementation Notes on bdes(1), Technical Report PCS-TR-91-158, Department of
     Mathematics and Computer Science, Dartmouth College, April 1991, Hanover, NH 03755.

     M.J. Wiener, Efficient DES Key Search, Technical Report 244, School of Computer Science,
     Carleton University, May 1994.

     Bruce Schneier, Applied Cryptography (2nd edition), John Wiley & Sons, Inc., 1996, New York,
     NY.

     M. Matsui, Linear Cryptanalysis Method for DES Cipher, Springer-Verlag, Advances in
     Cryptology -- Eurocrypt '93 Proceedings, 1994.

     Blaze, Diffie, Rivest, Schneier, Shimomura, Thompson, and Wiener, Minimal Key Lengths for
     Symmetric Ciphers To Provide Adequate Commercial Security, Business Software Alliance,
     http://www.bsa.org/policy/encryption/cryptographers.html, January 1996.

BUGS
     When this document was originally written, there was a controversy raging over whether the
     DES would still be secure in a few years.	There is now near-universal consensus in the
     cryptographic community that the key length of the DES is far too short.  The advent of spe-
     cial-purpose hardware could reduce the cost of any of the methods of attack named above so
     that they are no longer computationally infeasible; in addition, the explosive growth in the
     number and speed of modern microprocessors as well as advances in programmable logic devices
     has brought an attack using only commodity hardware into the realm of possibility.  Schneier
     and others currently recommend using cryptosystems with keys of at least 90 bits when long-
     term security is needed.

     As the key or key schedule is stored in memory, the encryption can be compromised if memory
     is readable.  Additionally, programs which display programs' arguments may compromise the
     key and initialization vector, if they are specified on the command line.	To avoid this
     bdes overwrites its arguments, however, the obvious race cannot currently be avoided.

     Certain specific keys should be avoided because they introduce potential weaknesses; these
     keys, called the weak and semiweak keys, are (in hex notation, where p is either 0 or 1, and
     P is either e or f):

	   0x0p0p0p0p0p0p0p0p	   0x0p1P0p1P0p0P0p0P
	   0x0pep0pep0pfp0pfp	   0x0pfP0pfP0pfP0pfP
	   0x1P0p1P0p0P0p0P0p	   0x1P1P1P1P0P0P0P0P
	   0x1Pep1Pep0Pfp0Pfp	   0x1PfP1PfP0PfP0PfP
	   0xep0pep0pfp0pfp0p	   0xep1Pep1pfp0Pfp0P
	   0xepepepepepepepep	   0xepfPepfPfpfPfpfP
	   0xfP0pfP0pfP0pfP0p	   0xfP1PfP1PfP0PfP0P
	   0xfPepfPepfPepfPep	   0xfPfPfPfPfPfPfPfP

     This is inherent in the DES algorithm (see Moore and Simmons, ``Cycle structure of the DES
     with weak and semi-weak keys'', Advances in Cryptology - Crypto '86 Proceedings, Springer-
     Verlag New York, (C)1987, pp. 9-32.)

BSD					 December 1, 2001				      BSD
Unix & Linux Commands & Man Pages : ©2000 - 2018 Unix and Linux Forums


All times are GMT -4. The time now is 10:13 AM.