Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mdocify. Needs a second pass for SEE ALSO section. 

XXX: Why do we have a 'standard' disclaimer big in its own section here?
This commit is contained in:
wiz 2001-12-01 18:49:55 +00:00
parent 6e766675c6
commit b8bbff606d
1 changed files with 121 additions and 117 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

238
usr.bin/bdes/bdes.1
View File

@ -1,4 +1,4 @@
.\" $NetBSD: bdes.1,v 1.6 2001/12/01 16:43:08 wiz Exp $ .\" $NetBSD: bdes.1,v 1.7 2001/12/01 18:49:55 wiz Exp $
.\" .\"
.\" Copyright (c) 1991, 1993 .\" Copyright (c) 1991, 1993
.\" The Regents of the University of California. All rights reserved. .\" The Regents of the University of California. All rights reserved.
@ -36,148 +36,152 @@
.\" .\"
.\" @(#)bdes.1 8.1 (Berkeley) 6/29/93 .\" @(#)bdes.1 8.1 (Berkeley) 6/29/93
.\" .\"
.de x2 .Dd December 1, 2001
.if t 2\u\s-3\\$1\s0\d .Dt BDES 1
.if n 2**\\$1 .Os
.. .Sh NAME
.TH BDES 1 "October 17, 1996" .Nm bdes
.UC 6 .Nd encrypt/decrypt using the Data Encryption Standard
.SH NAME .Sh SYNOPSIS
bdes \- encrypt/decrypt using the Data Encryption Standard .Nm
.SH SYNOPSIS .Op Fl abdp
.nf .Op Fl F Ar N
.ft B .Op Fl f Ar N
bdes [ \-abdp ] [ \-F N ] [ \-f N ] [ \-k key ] .Op Fl k Ar key
.ti +5 .Op Fl m Ar N
[ \-m N ] [ \-o N ] [ \-v vector ] .Op Fl o Ar N
.ft R .Op Fl v Ar vector
.fi .Sh DESCRIPTION
.SH DESCRIPTION .Nm
.I Bdes
implements all DES modes of operation described in FIPS PUB 81, implements all DES modes of operation described in FIPS PUB 81,
including alternative cipher feedback mode and both authentication including alternative cipher feedback mode and both authentication
modes. modes.
.I Bdes .Nm
reads from the standard input and writes to the standard output. reads from the standard input and writes to the standard output.
By default, the input is encrypted using cipher block chaining mode. By default, the input is encrypted using cipher block chaining mode.
Using the same key for encryption and decryption preserves plain text. Using the same key for encryption and decryption preserves plain text.
.PP .Pp
All modes but the electronic code book mode require an initialization All modes but the electronic code book mode require an initialization
vector; if none is supplied, the zero vector is used. vector; if none is supplied, the zero vector is used.
If no If no
.I key .Ar key
is specified on the command line, the user is prompted for one (see is specified on the command line, the user is prompted for one (see
.IR getpass (3) .Xr getpass 3
for more details). for more details).
.PP .Pp
The options are as follows: The options are as follows:
.TP .Bl -tag -width "-v vector" -compact
\-a .It Fl a
The key and initialization vector strings are to be taken as ASCII, The key and initialization vector strings are to be taken as ASCII,
suppressing the special interpretation given to leading ``0X'', ``0x'', suppressing the special interpretation given to leading
``0B'', and ``0b'' characters. .Dq 0X ,
.Dq 0x ,
.Dq 0B ,
and
.Dq 0b
characters.
This flag applies to This flag applies to
.I both .Em both
the key and initialization vector. the key and initialization vector.
.TP .It Fl b
\-b
Use electronic code book mode. This is not recommended for messages Use electronic code book mode. This is not recommended for messages
longer than 8 bytes, as patterns in the input will show through to the longer than 8 bytes, as patterns in the input will show through to the
output. output.
.TP .It Fl d
\-d
Decrypt the input. Decrypt the input.
.TP .It Fl F Ar N
\-F
Use Use
.IR N -bit .Ar N Ns -bit
alternative cipher feedback mode. alternative cipher feedback mode.
Currently Currently
.I N .Ar N
must be a multiple of 7 between 7 and 56 inclusive (this does not conform must be a multiple of 7 between 7 and 56 inclusive (this does not conform
to the alternative CFB mode specification). to the alternative CFB mode specification).
.TP .It Fl f Ar N
\-f
Use Use
.IR N -bit .Ar N Ns -bit
cipher feedback mode. cipher feedback mode.
Currently Currently
.I N .Ar N
must be a multiple of 8 between 8 and 64 inclusive (this does not conform must be a multiple of 8 between 8 and 64 inclusive (this does not conform
to the standard CFB mode specification). to the standard CFB mode specification).
.TP .It Fl k Ar key
\-k
Use Use
.I key .Ar key
as the cryptographic key. as the cryptographic key.
.TP .It Fl m Ar N
\-m
Compute a message authentication code (MAC) of Compute a message authentication code (MAC) of
.I N .Ar N
bits on the input. bits on the input.
The value of The value of
.I N .Ar N
must be between 1 and 64 inclusive; if must be between 1 and 64 inclusive; if
.I N .Ar N
is not a multiple of 8, enough 0 bits will be added to pad the MAC length is not a multiple of 8, enough 0 bits will be added to pad the MAC length
to the nearest multiple of 8. to the nearest multiple of 8.
Only the MAC is output. Only the MAC is output.
MACs are only available in cipher block chaining mode or in cipher feedback MACs are only available in cipher block chaining mode or in cipher feedback
mode. mode.
.TP .It Fl o Ar N
\-o
Use Use
.IR N -bit .Ar N Ns -bit
output feedback mode. output feedback mode.
Currently Currently
.I N .Ar N
must be a multiple of 8 between 8 and 64 inclusive (this does not conform must be a multiple of 8 between 8 and 64 inclusive (this does not conform
to the OFB mode specification). to the OFB mode specification).
.TP .It Fl p
\-p
Disable the resetting of the parity bit. Disable the resetting of the parity bit.
This flag forces the parity bit of the key to be used as typed, rather than This flag forces the parity bit of the key to be used as typed, rather than
making each character be of odd parity. making each character be of odd parity.
It is used only if the key is given in ASCII. It is used only if the key is given in ASCII.
.TP .It Fl v Ar vector
\-v
Set the initialization vector to Set the initialization vector to
.IR vector ; .Ar vector ;
the vector is interpreted in the same way as the key. The vector is the vector is interpreted in the same way as the key. The vector is
ignored in electronic codebook mode. For best security, a different ignored in electronic codebook mode. For best security, a different
initialization vector should be used for each file. initialization vector should be used for each file.
.PP .El
.Pp
The key and initialization vector are taken as sequences of ASCII The key and initialization vector are taken as sequences of ASCII
characters which are then mapped into their bit representations. characters which are then mapped into their bit representations.
If either begins with ``0X'' or ``0x'', If either begins with
.Dq 0X
or
.Dq 0x ,
that one is taken as a sequence of hexadecimal digits indicating the that one is taken as a sequence of hexadecimal digits indicating the
bit pattern; bit pattern;
if either begins with ``0B'' or ``0b'', if either begins with
.Dq 0B
or
.Dq 0b ,
that one is taken as a sequence of binary digits indicating the bit pattern. that one is taken as a sequence of binary digits indicating the bit pattern.
In either case, In either case,
only the leading 64 bits of the key or initialization vector only the leading 64 bits of the key or initialization vector
are used, are used,
and if fewer than 64 bits are provided, enough 0 bits are appended and if fewer than 64 bits are provided, enough 0 bits are appended
to pad the key to 64 bits. to pad the key to 64 bits.
.PP .Pp
According to the DES standard, the low-order bit of each character in the According to the DES standard, the low-order bit of each character in the
key string is deleted. key string is deleted.
Since most ASCII representations set the high-order bit to 0, simply Since most ASCII representations set the high-order bit to 0, simply
deleting the low-order bit effectively reduces the size of the key space deleting the low-order bit effectively reduces the size of the key space
from from
.x2 56 .if t 2\u\s-356\s0\d
.if n 2**56
to to
.x2 48 .if t 2\u\s-348\s0\d
.if n 2**48
keys. keys.
To prevent this, the high-order bit must be a function depending in part To prevent this, the high-order bit must be a function depending in part
upon the low-order bit; so, the high-order bit is set to whatever value upon the low-order bit; so, the high-order bit is set to whatever value
gives odd parity. gives odd parity.
This preserves the key space size. This preserves the key space size.
Note this resetting of the parity bit is Note this resetting of the parity bit is
.I not .Em not
done if the key is given in binary or hex, and can be disabled for ASCII done if the key is given in binary or hex, and can be disabled for ASCII
keys as well. keys as well.
.PP .Pp
The DES is considered a very strong cryptosystem hobbled by a short The DES is considered a very strong cryptosystem hobbled by a short
key, and other than table lookup attacks, key search attacks, and key, and other than table lookup attacks, key search attacks, and
Hellman's time-memory tradeoff (all of which are very expensive and Hellman's time-memory tradeoff (all of which are very expensive and
@ -185,26 +189,28 @@ time-consuming), no practical cryptanalytic methods for breaking the
DES are known in the open literature. As of this writing, the best DES are known in the open literature. As of this writing, the best
known cryptanalytic method is linear cryptanalysis, which requires an known cryptanalytic method is linear cryptanalysis, which requires an
average of average of
.x2 43 .if t 2\u\s-343\s0\d
.if n 2**43
known plaintext-ciphertext pairs to succeed. known plaintext-ciphertext pairs to succeed.
Unfortunately for the DES, key search attacks (requiring only Unfortunately for the DES, key search attacks (requiring only
a single known plaintext-ciphertext pair and trying a single known plaintext-ciphertext pair and trying
.x2 55 .if t 2\u\s-355\s0\d
.if n 2**55
keys on average) are becoming practical. keys on average) are becoming practical.
.PP .Pp
As with all cryptosystems, the choice of keys and As with all cryptosystems, the choice of keys and
key security remain the most vulnerable aspect of key security remain the most vulnerable aspect of
.IR bdes . .Nm "" .
.SH IMPLEMENTATION NOTES .Sh IMPLEMENTATION NOTES
For implementors wishing to write software compatible with this program, For implementors wishing to write software compatible with this program,
the following notes are provided. the following notes are provided.
This software is believed to be compatible with the implementation of the This software is believed to be compatible with the implementation of the
data encryption standard distributed by Sun Microsystems, Inc. data encryption standard distributed by Sun Microsystems, Inc.
.PP .Pp
In the ECB and CBC modes, plaintext is encrypted in units of 64 bits (8 bytes, In the ECB and CBC modes, plaintext is encrypted in units of 64 bits (8 bytes,
also called a block). also called a block).
To ensure that the plaintext file is encrypted correctly, To ensure that the plaintext file is encrypted correctly,
.I bdes .Nm
will (internally) append from 1 to 8 bytes, the last byte containing an will (internally) append from 1 to 8 bytes, the last byte containing an
integer stating how many bytes of that final block are from the plaintext integer stating how many bytes of that final block are from the plaintext
file, and encrypt the resulting block. file, and encrypt the resulting block.
@ -219,84 +225,84 @@ and the final byte contains an integer between 0 and one less than the number
of bytes being used as the mode. of bytes being used as the mode.
(This was another reason that the mode size must be a multiple of 8 for those (This was another reason that the mode size must be a multiple of 8 for those
modes.) modes.)
.PP .Pp
Unlike Sun's implementation, unused bytes of that last block are not filled Unlike Sun's implementation, unused bytes of that last block are not filled
with random data, but instead contain what was in those byte positions in with random data, but instead contain what was in those byte positions in
the preceding block. the preceding block.
This is quicker and more portable, and does not weaken the encryption This is quicker and more portable, and does not weaken the encryption
significantly. significantly.
.PP .Pp
If the key is entered in ASCII, the parity bits of the key characters are set If the key is entered in ASCII, the parity bits of the key characters are set
so that each key character is of odd parity. so that each key character is of odd parity.
Unlike Sun's implementation, it is possible to enter binary or hexadecimal Unlike Sun's implementation, it is possible to enter binary or hexadecimal
keys on the command line, and if this is done, the parity bits are keys on the command line, and if this is done, the parity bits are
.I not .Em not
reset. reset.
This allows testing using arbitrary bit patterns as keys. This allows testing using arbitrary bit patterns as keys.
.PP .Pp
The Sun implementation always uses an initialization vector of 0 The Sun implementation always uses an initialization vector of 0
(that is, all zeroes). (that is, all zeroes).
By default, By default,
.I bdes .Nm
does too, but this may be changed from the command line. does too, but this may be changed from the command line.
.SH SEE ALSO .Sh SEE ALSO
crypt(3), getpass(3) .Xr crypt 3 ,
.sp .Xr getpass 3
.IR "Data Encryption Standard" , .Pp
.Em "Data Encryption Standard" ,
Federal Information Processing Standard #46, Federal Information Processing Standard #46,
National Bureau of Standards, National Bureau of Standards,
U.S. Department of Commerce, U.S. Department of Commerce,
Washington DC Washington DC
(Jan. 1977) (Jan. 1977).
.sp .Pp
.IR "DES Modes of Operation" , .Em "DES Modes of Operation" ,
Federal Information Processing Standard #81, Federal Information Processing Standard #81,
National Bureau of Standards, National Bureau of Standards,
U.S. Department of Commerce U.S. Department of Commerce
Washington DC Washington DC
(Dec. 1980) (Dec. 1980).
.sp .Pp
Dorothy Denning, Dorothy Denning,
.IR "Cryptography and Data Security" , .Em "Cryptography and Data Security" ,
Addison-Wesley Publishing Co., Addison-Wesley Publishing Co.,
Reading, MA Reading, MA
\(co1982. \(co1982.
.sp .Pp
Matt Bishop, Matt Bishop,
.IR "Implementation Notes on bdes(1)" , .Em "Implementation Notes on bdes(1)" ,
Technical Report PCS-TR-91-158, Technical Report PCS-TR-91-158,
Department of Mathematics and Computer Science, Department of Mathematics and Computer Science,
Dartmouth College, Dartmouth College,
Hanover, NH 03755 Hanover, NH 03755
(Apr. 1991). (Apr. 1991).
.sp .Pp
M.J. Wiener, M.J. Wiener,
.IR "Efficient DES Key Search" , .Em "Efficient DES Key Search" ,
Technical Report 244, Technical Report 244,
School of Computer Science, School of Computer Science,
Carleton University Carleton University
(May 1994). (May 1994).
.sp .Pp
Bruce Schneier, Bruce Schneier,
.IR "Applied Cryptography (2nd edition)" , .Em "Applied Cryptography (2nd edition)" ,
John Wiley & Sons, Inc., John Wiley & Sons, Inc.,
New York, NY New York, NY
\(co1996. \(co1996.
.sp .Pp
M. Matsui, M. Matsui,
.IR "Linear Cryptanalysis Method for DES Cipher" , .Em "Linear Cryptanalysis Method for DES Cipher" ,
Advances in Cryptology -- Eurocrypt '93 Proceedings, Advances in Cryptology -- Eurocrypt '93 Proceedings,
Springer-Verlag Springer-Verlag
\(co1994. \(co1994.
.sp .Pp
Blaze, Diffie, Rivest, Schneier, Shimomura, Thompson, and Wiener, Blaze, Diffie, Rivest, Schneier, Shimomura, Thompson, and Wiener,
.IR "Minimal Key Lengths for Symmetric Ciphers To Provide Adequate Commercial Security", .Em "Minimal Key Lengths for Symmetric Ciphers To Provide Adequate Commercial Security" ,
Business Software Alliance, Business Software Alliance,
http://www.bsa.org/policy/encryption/cryptographers.html http://www.bsa.org/policy/encryption/cryptographers.html
(January 1996). (January 1996).
.Sh DISCLAIMER
.SH DISCLAIMER .Bd -literal
.nf
THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@ -308,8 +314,8 @@ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE. SUCH DAMAGE.
.fi .Ed
.SH BUGS .Sh BUGS
When this document was originally written, there was a controversy When this document was originally written, there was a controversy
raging over whether the DES would still be secure in a few years. raging over whether the DES would still be secure in a few years.
There is now near-universal consensus in the cryptographic community There is now near-universal consensus in the cryptographic community
@ -322,27 +328,24 @@ devices has brought an attack using only commodity hardware into the
realm of possibility. Schneier and others currently recommend using realm of possibility. Schneier and others currently recommend using
cryptosystems with keys of at least 90 bits when long-term security is cryptosystems with keys of at least 90 bits when long-term security is
needed. needed.
.PP .Pp
As the key or key schedule is stored in memory, the encryption can be As the key or key schedule is stored in memory, the encryption can be
compromised if memory is readable. compromised if memory is readable.
Additionally, programs which display programs' arguments may compromise the Additionally, programs which display programs' arguments may compromise the
key and initialization vector, if they are specified on the command line. key and initialization vector, if they are specified on the command line.
To avoid this To avoid this
.I bdes .Nm
overwrites its arguments, however, the obvious race cannot currently be overwrites its arguments, however, the obvious race cannot currently be
avoided. avoided.
.PP .Pp
Certain specific keys should be avoided because they introduce potential Certain specific keys should be avoided because they introduce potential
weaknesses; these keys, called the weaknesses; these keys, called the
.I weak .Em weak
and and
.I semiweak .Em semiweak
keys, are (in hex notation, where p is either 0 or 1, and P is either keys, are (in hex notation, where p is either 0 or 1, and P is either
e or f): e or f):
.sp .Bd -literal -offset indent
.nf
.in +10n
.ta \w'0x0p0p0p0p0p0p0p0p\0\0\0'u+5n
0x0p0p0p0p0p0p0p0p 0x0p1P0p1P0p0P0p0P 0x0p0p0p0p0p0p0p0p 0x0p1P0p1P0p0P0p0P
0x0pep0pep0pfp0pfp 0x0pfP0pfP0pfP0pfP 0x0pep0pep0pfp0pfp 0x0pfP0pfP0pfP0pfP
0x1P0p1P0p0P0p0P0p 0x1P1P1P1P0P0P0P0P 0x1P0p1P0p0P0p0P0p 0x1P1P1P1P0P0P0P0P
@ -351,10 +354,11 @@ e or f):
0xepepepepepepepep 0xepfPepfPfpfPfpfP 0xepepepepepepepep 0xepfPepfPfpfPfpfP
0xfP0pfP0pfP0pfP0p 0xfP1PfP1PfP0PfP0P 0xfP0pfP0pfP0pfP0p 0xfP1PfP1PfP0PfP0P
0xfPepfPepfPepfPep 0xfPfPfPfPfPfPfPfP 0xfPepfPepfPepfPep 0xfPfPfPfPfPfPfPfP
.fi .Ed
.in -10n .Pp
.sp
This is inherent in the DES algorithm (see Moore and Simmons, This is inherent in the DES algorithm (see Moore and Simmons,
\*(LqCycle structure of the DES with weak and semi-weak keys,\*(Rq .Do
.I "Advances in Cryptology \- Crypto '86 Proceedings" , Cycle structure of the DES with weak and semi-weak keys
.Dc ,
.Em "Advances in Cryptology \- Crypto '86 Proceedings" ,
Springer-Verlag New York, \(co1987, pp. 9-32.) Springer-Verlag New York, \(co1987, pp. 9-32.)