Data Encryption Standard (DES) is a pretty old (1977) algorithm which has been succeeded by Triple-DES (and a few other algorithms) allowing for symmetric encryption of data using a key. The algorithm takes a fixed size block of 64bits plain-text, and using a 64bit key produces 64bits of cipher-text. Therefore, we can say that the block cipher in this case is 64bits (and should always be 64bits).
As the key is utilised for error detection, there are in-fact only 56bits of the key used by the algorithm as every 8th bit in the key is used to check that each byte is of odd parity.
The main weakness of DES is brute-force where modern hardware can feasibly crack DES cipher-text in a matter of hours at relatively low costs.
Due to this, let’s move onto Triple DES (which is a lot more popular now-a-days and is still pretty secure). Triple DES was officially named “Triple Data Encryption Algorithm” and as such is often also named as TDES, 3DEA, DEA3, 3DES and DES3 however all of these are ‘correct’.
Essentially, Triple DES applies the DES algorithm three times increasing the number of rounds from 16 to 48 for each block cipher, and can use up to three keys allowing a 192bit key (with 168bits of effective key data) however due to some feasible attacks on Triple DES NIST notes that there are actually only 80bits of security.
So that’s enough about the algorithm, let’s talk about the modes. There are essentially four modes of operation which can be used with DES which are:
- Electronic Codebook (ECB) Mode
- Cipher Block Chaining (CBC) Mode
- K-Bit Cipher Feedback (CFB) Mode
- K-Bit Output Feedback (OFB) Mode
For the purpose of this brief introduction, I’ll stick to the first two (in my experience, these are most commonly used). Firstly, Electronic Codebook (ECB) is the simplest mode where the message is divided into blocks and each block is encrypted separately. There is a primary weakness faced when using ECB versus CBC, CFB or OFB; identical plain-text blocks encrypt into identical cipher-text blocks. This can be visualised when an ECB mode is used to encrypt a bitmap image which uses large areas of uniform colour as the overall image is not lost in the encryption routine.
Above we can see Tux, without any encryption applied, then below we haveTux encrypted using ECB which visually highlights the weakness due to the uniform patterns in the ciphertext.
Using CBC, however, leads to the image below which is significantly random.
Cipher-block Chaining (CBC) tackles the weakness of ECB as each block of plaintext is exclusive-or’d (XOR’d) with the previous cipher-text block before being encrypted. This way, the cipher-text block depends on all of the plaintext blocks processed up to that point; this therefore means that messages must be transmitted / received with a degree of atomicity to ensure that the message can successfully be decrypted.
Now that we’ve talked a bit more about the modes, let’s talk about some of the issues you might face when attempting to implement these modes in your code. Firstly, padding. When choosing a padding method, it’s first important to ensure that your padding method will be accepted by both the encryption and decryption methods; therefore if your message is going to be passed to a third party, we must ensure that the third party will be using the same algorithm, algorithm mode and padding method.
As we’ve highlighted, the block-size for DES is 64bits, or, 8bytes. Therefore, if we wanted to encipher for example, my name, we would first need to convert it into ASCII. Let’s look at this transformation below.
C H R I S T O P H E R B U R K E 43:48:52:49:53:54:4f:50:48:45:52:20:42:55:52:4b:45
If we were to calculate the length of the above data modulus eight, we would be returned six. This would suggest, then, that we would need to pad the data by an additional two bytes. There are, of course a few padding methods however the point we must portray here is that the above data will likely raise some kind of block size exception. The most basic method of padding is called ‘zero-padding’ where we simply pad the data with zeros to ensure uniformity of the block size.
43:48:52:49:53:54:4f:50 // Block 1 48:45:52:20:50:41:55:4c // Block 2 20:42:55:52:4b:45:00:00 // Block 3
Of course, if we were to now calculate the length of the above data, modulus eight, we’d now be returned the magic number we’re looking for; zero! There are also additional padding algorithms which, some what, ‘do this for you’ such as PKCS. These padding algorithms are usually available in most cryptography packages and are often trivial to use.