Subject: [TLS] Question about TLS_RSA_WITH_3DES_EDE_CBC_SHA

From: Stefan Winter <[email-masked]>
Date: Fri, 01 Jul 2011 13:58:08 +0200

Hello,

in radiusext, I need to make an assessment whether an I-D is compliant to a crypto-agility requirements document.

The draft (still) requires at least TLS 1.1 with its mandatory-to-implemnt cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA.

The crypto-agility document requires the mandatory-to-implement algorithm to be NIST approved, "Acceptable with no deprecation date" in NIST SP-800-131A. 

That document marks 
* two-key Triple DES Encryption as an encryption with deprecation date
* three-key Triple DES Encryption as an encryption without deprecation date

I'm not sure whether TLS_RSA_WITH_3DES_EDE_CBC_SHA is a two-key or a three-key 3DES algorithm. This condition would be the only one that could downgrade the I-D in question from "unconditionally compliant" to "conditionally compliant".

So... would anybody have some insight which of the variant(s) is/are used in TLS_RSA_WITH_3DES_EDE_CBC_SHA?

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

---

From: Adam Langley <[email-masked]>
Date: Fri, 1 Jul 2011 09:20:06 -0400

> I'm not sure whether TLS_RSA_WITH_3DES_EDE_CBC_SHA is a two-key or a three-key 3DES algorithm. This condition would be the only one that could downgrade the I-D in question from "unconditionally co…

I believe it's the 3-key algorithm. RFC 5246, App B covers this:

"DES can also be operated in a mode [3DES] where three independent
keys and three encryptions are used for each block of data; this uses
168 bits of key (24 bytes in the TLS key generation method) and
provides the equivalent of 112 bits of security."

Cheers

AGL

---

From: Martin Rex <[email-masked]>
Date: Fri, 1 Jul 2011 21:46:20 +0200 (MEST)

Adam Langley wrote:
> 
> Stefan Winter <[email-masked]> wrote:
> >
> > I'm not sure whether TLS_RSA_WITH_3DES_EDE_CBC_SHA is a two-key
> > or a three-key 3DES algorithm. This condition would be the only
> > one that could downgrade the I-D in question from
> > "unconditionally compliant" to "conditionally compliant".
> 

see also  http://tools.ietf.org/html/rfc2246#page-21

It is a probabilistic 3-key DES-EDE (encryption-decryption-encryption),
meaning that the algotihm is treated as a block cipher with a
keysize of 24 octets, blocksize of 8 octets and cbc-ivsize of 8 octets
(distinct keying material for direction client->server and server->client).

The first 8x7 bits (sans parity) differ from the final 8x7 bits of the key
on probabilistic grounds, there are no algorithmic provisions to ensure
this, and neither are there algorithmic provisions to ensure that
none of the 3 single-DES subkeys are weak DES keys.
 
(you're certainly better of with AES128-CBC, in particular because it
 is significantly faster--on x86 and x86_64  AES128-CBC has 6x higher
 data encryption rate than 3DES-EDE for optimized software-implementations.)

-Martin

---

From: Martin Rex <[email-masked]>
Date: Fri, 1 Jul 2011 21:58:43 +0200 (MEST)

>  data encryption rate than 3DES-EDE for optimized software-implementations.)

Thinking about it, checking whether the first 8x7 bits differ from
the middle 8x7 bits, and that the middle 8x7 bits differ from the final
8x7 bits might have be even more important, because either one being
equal would cause the 3DES-EDE operation to fold into a single-DES
operation.  :-o

-Martin

---

From: Marsh Ray <[email-masked]>
Date: Fri, 01 Jul 2011 15:25:24 -0500

> equal would cause the 3DES-EDE operation to fold into a single-DES

Doesn't the principle of full key space utilization require us to admit 
that possibility?

As an analogy, TLS uses "separate" encryption keys and MAC secrets in 
the C->S and S->C directions. But it doesn't require an implementation 
to actually verify that they are different. TLS doesn't require checks 
against weak DES keys either which seems even a bit more likely to occur.

One could imagine many ways such a check could go wrong, possibly 
revealing information about the secret material in the process.

- Marsh