| blob | 6237e698f3054400b67a80b2b10c7be3e0e54020 |
1 \r
2 \r
3 \r
4 TLS Working Group P. Eronen, Ed.\r
5 Internet-Draft Nokia\r
6 Intended status: Informational February 14, 2008\r
7 Expires: August 17, 2008\r
8 \r
9 \r
10 DES and IDEA Cipher Suites for Transport Layer Security (TLS)\r
11 draft-ietf-tls-des-idea-00.txt\r
12 \r
13 Status of this Memo\r
14 \r
15 By submitting this Internet-Draft, each author represents that any\r
16 applicable patent or other IPR claims of which he or she is aware\r
17 have been or will be disclosed, and any of which he or she becomes\r
18 aware will be disclosed, in accordance with Section 6 of BCP 79.\r
19 \r
20 Internet-Drafts are working documents of the Internet Engineering\r
21 Task Force (IETF), its areas, and its working groups. Note that\r
22 other groups may also distribute working documents as Internet-\r
23 Drafts.\r
24 \r
25 Internet-Drafts are draft documents valid for a maximum of six months\r
26 and may be updated, replaced, or obsoleted by other documents at any\r
27 time. It is inappropriate to use Internet-Drafts as reference\r
28 material or to cite them other than as "work in progress."\r
29 \r
30 The list of current Internet-Drafts can be accessed at\r
31 http://www.ietf.org/ietf/1id-abstracts.txt.\r
32 \r
33 The list of Internet-Draft Shadow Directories can be accessed at\r
34 http://www.ietf.org/shadow.html.\r
35 \r
36 This Internet-Draft will expire on August 17, 2008.\r
37 \r
38 Copyright Notice\r
39 \r
40 Copyright (C) The IETF Trust (2008).\r
41 \r
42 Abstract\r
43 \r
44 TLS specification versions 1.0 (RFC 2246) and 1.1 (RFC 4346) included\r
45 cipher suites based on DES (Data Encryption Standard) and IDEA\r
46 (International Data Encryption Algorithm) algorithms. DES (when used\r
47 in single-DES mode) and IDEA are no longer recommended for general\r
48 use in TLS, and have been removed from TLS 1.2 main specification\r
49 (RFC NNNN). This document specifies these cipher suites for\r
50 completeness, and discusses reasons why their use is no longer\r
51 recommended.\r
52 \r
53 \r
54 \r
55 Eronen Expires August 17, 2008 [Page 1]\r
57 Internet-Draft DES and IDEA Cipher Suites for TLS February 2008\r
58 \r
59 \r
60 1. Introduction\r
61 \r
62 TLS specification versions 1.0 [TLS10] and 1.1 [TLS11] included\r
63 cipher suites based on DES (Data Encryption Standard) and IDEA\r
64 (International Data Encryption Algorithm) algorithms. DES (when used\r
65 in single-DES mode) and IDEA are no longer recommended for general\r
66 use in TLS, and have been removed from TLS 1.2 main specification\r
67 [TLS12].\r
68 \r
69 This document specifies these cipher suites for completeness, and\r
70 discusses reasons why their use is no longer recommended.\r
71 \r
72 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",\r
73 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this\r
74 document are to be interpreted as described in [REQ].\r
75 \r
76 \r
77 2. DES Cipher Suites\r
78 \r
79 DES (Data Encryption Standard) is a block cipher which was originally\r
80 approved as US federal standard in 1976, and is specified in [DES].\r
81 \r
82 For TLS key generation purposes, DES is treated as having a 64-bit\r
83 key, but it still provides only 56 bits of protection, as 8 of the 64\r
84 bits are not used by the algorithm. DES uses a 64-bit block size.\r
85 \r
86 The following cipher suites have been defined for using DES in CBC\r
87 mode in TLS:\r
88 \r
89 CipherSuite TLS_RSA_WITH_DES_CBC_SHA = { 0x00,0x09 };\r
90 CipherSuite TLS_DH_DSS_WITH_DES_CBC_SHA = { 0x00,0x0C };\r
91 CipherSuite TLS_DH_RSA_WITH_DES_CBC_SHA = { 0x00,0x0F };\r
92 CipherSuite TLS_DHE_DSS_WITH_DES_CBC_SHA = { 0x00,0x12 };\r
93 CipherSuite TLS_DHE_RSA_WITH_DES_CBC_SHA = { 0x00,0x15 };\r
94 CipherSuite TLS_DH_anon_WITH_DES_CBC_SHA = { 0x00,0x1A };\r
95 \r
96 The key exchange algorithms (RSA, DH_DSS, DH_RSA, DHE_DSS, DHE_RSA,\r
97 and DH_anon) and the MAC algorithm (SHA) are defined in the base TLS\r
98 specification.\r
99 \r
100 \r
101 3. IDEA Cipher Suites\r
102 \r
103 IDEA (International Data Encryption Algorithm) is block cipher\r
104 designed by Xuejia Lai and James Massey [IDEA] [SCH]. IDEA uses a\r
105 128-bit key and operates on 64-bit blocks.\r
106 \r
107 \r
108 \r
109 \r
110 \r
111 Eronen Expires August 17, 2008 [Page 2]\r
113 Internet-Draft DES and IDEA Cipher Suites for TLS February 2008\r
114 \r
115 \r
116 The following cipher suite has been defined for using IDEA in CBC\r
117 mode in TLS:\r
118 \r
119 CipherSuite TLS_RSA_WITH_IDEA_CBC_SHA = { 0x00,0x07 };\r
120 \r
121 The key exchange algorithm (RSA) and the MAC algorithm (SHA) are\r
122 defined in the base TLS specification.\r
123 \r
124 \r
125 4. Security Considerations\r
126 \r
127 4.1. DES Cipher Suites\r
128 \r
129 DES has an effective key strength of 56 bits, which has been been\r
130 known to be vulnerable to practical brute force attacks for over 20\r
131 years [DH]. A relatively recent 2006 paper by Kumar et al. [COPA]\r
132 describes a system which performs exhaustive key search in less than\r
133 nine days on average, and costs less than 10,000 USD to build.\r
134 \r
135 Given these, the single-DES cipher suites SHOULD NOT be implemented\r
136 by TLS libraries. If a TLS library implements these cipher suites,\r
137 it SHOULD NOT enable them by default. Experience has also shown that\r
138 rarely used code is a source of security and interoperability\r
139 problems, so existing implementations SHOULD consider removing these\r
140 cipher suites.\r
141 \r
142 4.2. IDEA Cipher Suites\r
143 \r
144 IDEA has a 128-bit key, and thus is not vulnerable to exhaustive key\r
145 search. However, IDEA cipher suites for TLS have not seen widespread\r
146 use: most implementations either do not support them, do not enable\r
147 them by default, or do not negotiate them when other algorithms (such\r
148 as AES, 3DES, or RC4) are available.\r
149 \r
150 Experience has shown that rarely used code is a source of security\r
151 and interoperability problems; given this, the IDEA cipher suites\r
152 SHOULD NOT be implemented by TLS libraries, and SHOULD be removed\r
153 from existing implementations.\r
154 \r
155 Several reasons have been suggested to explain why the IDEA cipher\r
156 suites have been rarely used. These include the existence of IPR\r
157 disclosures (which can be obtained from the IETF on-line IPR\r
158 repository at http://www.ietf.org/ipr); poor performance in software\r
159 on common CPU architectures; a 64-bit block size which is considered\r
160 short by modern standards; the existence of weak keys; lack of\r
161 government approval in many countries; and the availability of other\r
162 algorithms which addressed at least some of these reasons.\r
163 \r
164 \r
165 \r
166 \r
167 Eronen Expires August 17, 2008 [Page 3]\r
169 Internet-Draft DES and IDEA Cipher Suites for TLS February 2008\r
170 \r
171 \r
172 5. IANA Considerations\r
173 \r
174 IANA has already allocated values for the cipher suites described in\r
175 this document in the TLS Cipher Suite Registry, defined in [TLS11].\r
176 IANA is requested to update (has updated) the references of these\r
177 cipher suites to point to this document:\r
178 \r
179 Value Description Reference\r
180 ----------- -------------------------------------- ---------\r
181 0x00,0x07 TLS_RSA_WITH_IDEA_CBC_SHA [RFCnnnn]\r
182 0x00,0x09 TLS_RSA_WITH_DES_CBC_SHA [RFCnnnn]\r
183 0x00,0x0C TLS_DH_DSS_WITH_DES_CBC_SHA [RFCnnnn]\r
184 0x00,0x0F TLS_DH_RSA_WITH_DES_CBC_SHA [RFCnnnn]\r
185 0x00,0x12 TLS_DHE_DSS_WITH_DES_CBC_SHA [RFCnnnn]\r
186 0x00,0x15 TLS_DHE_RSA_WITH_DES_CBC_SHA [RFCnnnn]\r
187 0x00,0x1A TLS_DH_anon_WITH_DES_CBC_SHA [RFCnnnn]\r
188 \r
189 This document does not create any new registries to be maintained by\r
190 IANA, and does not require any new assignments from existing\r
191 registries.\r
192 \r
193 \r
194 6. Acknowledgments\r
195 \r
196 The editor would like to thank Steven Bellovin, Uri Blumenthal,\r
197 Michael D'Errico, Paul Hoffman, Simon Josefsson, Bodo Moeller, Martin\r
198 Rex, and Len Sassaman for their contributions to preparing this\r
199 document.\r
200 \r
201 \r
202 7. References\r
203 \r
204 7.1. Normative References\r
205 \r
206 [DES] National Institute of Standards and Technology, "Data\r
207 Encryption Standard (DES)", FIPS PUB 46-3, October 1999.\r
208 \r
209 [IDEA] Lai, X., "On the Design and Security of Block Ciphers",\r
210 ETH Series in Information Processing, v. 1, Konstanz:\r
211 Hartung-Gorre Verlag, 1992.\r
212 \r
213 [REQ] Bradner, S., "Key words for use in RFCs to Indicate\r
214 Requirement Levels", BCP 14, RFC 2119, March 1997.\r
215 \r
216 [SCH] Schneier, B., "Applied Cryptography: Protocols, Algorithms,\r
217 and Source Code in C", 2nd ed., John Wiley & Sons, Inc.,\r
218 1996.\r
219 \r
220 \r
221 \r
222 \r
223 Eronen Expires August 17, 2008 [Page 4]\r
225 Internet-Draft DES and IDEA Cipher Suites for TLS February 2008\r
226 \r
227 \r
228 [TLS10] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",\r
229 RFC 2246, January 1999.\r
230 \r
231 [TLS11] Dierks, T. and E. Rescorla, "The Transport Layer Security\r
232 (TLS) Protocol Version 1.1", RFC 4346, April 2006.\r
233 \r
234 [TLS12] Dierks, T. and E. Rescorla, "The Transport Layer Security\r
235 (TLS) Protocol Version 1.2", draft-ietf-tls-rfc4346-bis-09\r
236 (work in progress), February 2008.\r
237 \r
238 7.2. Informative References\r
239 \r
240 [COPA] Kumar, S., Paar, C., Pelzl, J., Pfeiffer, G., and M.\r
241 Schimmler, "Breaking Ciphers with COPACOBANA - A Cost-\r
242 Optimized Parallel Code Breaker", Workshop on Cryptographic\r
243 Hardware and Embedded Systems (CHES 2006), Yokohama, Japan,\r
244 October 2006.\r
245 \r
246 [DH] Diffie, W. and M. Hellman, "Exhaustive Cryptanalysis of the\r
247 NBS Data Encryption Standard", IEEE Computer, volume 10,\r
248 issue 6, June 1977.\r
249 \r
250 \r
251 Author's Address\r
252 \r
253 Pasi Eronen (editor)\r
254 Nokia Research Center\r
255 P.O. Box 407\r
256 FIN-00045 Nokia Group\r
257 Finland\r
258 \r
259 Email: pasi.eronen@nokia.com\r
260 \r
261 \r
262 \r
263 \r
264 \r
265 \r
266 \r
267 \r
268 \r
269 \r
270 \r
271 \r
272 \r
273 \r
274 \r
275 \r
276 \r
277 \r
278 \r
279 Eronen Expires August 17, 2008 [Page 5]\r
281 Internet-Draft DES and IDEA Cipher Suites for TLS February 2008\r
282 \r
283 \r
284 Full Copyright Statement\r
285 \r
286 Copyright (C) The IETF Trust (2008).\r
287 \r
288 This document is subject to the rights, licenses and restrictions\r
289 contained in BCP 78, and except as set forth therein, the authors\r
290 retain all their rights.\r
291 \r
292 This document and the information contained herein are provided on an\r
293 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS\r
294 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND\r
295 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS\r
296 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF\r
297 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED\r
298 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.\r
299 \r
300 \r
301 Intellectual Property\r
302 \r
303 The IETF takes no position regarding the validity or scope of any\r
304 Intellectual Property Rights or other rights that might be claimed to\r
305 pertain to the implementation or use of the technology described in\r
306 this document or the extent to which any license under such rights\r
307 might or might not be available; nor does it represent that it has\r
308 made any independent effort to identify any such rights. Information\r
309 on the procedures with respect to rights in RFC documents can be\r
310 found in BCP 78 and BCP 79.\r
311 \r
312 Copies of IPR disclosures made to the IETF Secretariat and any\r
313 assurances of licenses to be made available, or the result of an\r
314 attempt made to obtain a general license or permission for the use of\r
315 such proprietary rights by implementers or users of this\r
316 specification can be obtained from the IETF on-line IPR repository at\r
317 http://www.ietf.org/ipr.\r
318 \r
319 The IETF invites any interested party to bring to its attention any\r
320 copyrights, patents or patent applications, or other proprietary\r
321 rights that may cover technology that may be required to implement\r
322 this standard. Please address the information to the IETF at\r
323 ietf-ipr@ietf.org.\r
324 \r
325 \r
326 Acknowledgment\r
327 \r
328 Funding for the RFC Editor function is provided by the IETF\r
329 Administrative Support Activity (IASA).\r
330 \r
331 \r
332 \r
333 \r
334 \r
335 Eronen Expires August 17, 2008 [Page 6]\r