Subject: RE: PKCS#7 and algorithm identifiers

From: "SIEVANEN Markku" <[email-masked]>
Date: Tue, 30 Jan 2007 09:11:12 +0100

> Hi,
> 
> I try to find out, what are the most commonly used Triple-DES based encryption modes inside PKCS#7 envelope?
> 
> The only used mode that I found was:
>            SEQUENCE {
>                OBJECT_IDENTIFIER { "1.2.840.113549.3.7" },  -- DES-EDE3-CBC
>                OCTET_STRING {
>                   #61B3C21F91B94884
>                }
>             },
> 
> 
> 1. I didn't find registered OIDs for other Triple DES modes, like for example DES-EDE3 (ECB mode)? Is it so, that other Triple-DES modes doesn't have registered OIDs and are not used in current implementations?
> 2. The RFC 3370 indicates, that this same OID ("1.2.840.113549.3.7") is used also for DES-EDE2-CBC, two key version Triple-DES? So, what is the common practice: use three key or two key schemes in current implementations (PKCS#7 envelopes, S/MIME) under this OID?
> 
> BR,
> MaSi
> --------------------------------------------
> Markku Sievänen
> R&D Services Development - Identity
> Gemalto c/o Setec Oy
> Tel: +358 (0)9 8941 4253 - +358 (0)40 843 9495
> Fax: +358 (0)9 8941 4143
> P.O.Box 31 (Turvalaaksonkaari 2)
> FI-01741 Vantaa, FINLAND
> [email-masked]
> www.gemalto.com
> --------------------------------------------
>

---

From: Mike Markowitz <[email-masked]>
Date: Tue, 30 Jan 2007 11:56:16 -0600

At 02:11 AM 1/30/2007, SIEVANEN Markku wrote:

1.
I didn't find registered OIDs for other Triple DES modes, like for
example DES-EDE3 (ECB mode)? Is it so, that other Triple-DES modes
doesn't have registered OIDs and are not used in current
implementations?

Markku:

DES-EDE3-ECB appears to be registered under {iso(1)
identified-organization(3) oiw(14) secsig(3) algorithms(2) desEDE(17)}
("1.3.14.3.2.17"). It's used for voice encryption and
specified

in ITU-T Recommendation H.325.

Other variations:

3DesECB: {iso(1) identified-organization(3) dod(6) internet(1) private(4)
enterprise(1) 4929 1 7}

("1.3.6.1.4.1.4929.1.7")

DES_3ECB_pad: {iso(1) identified-organization(3) teletrust(36)
algorithm(3) encryptionAlgorithm(1) des-3(3) 1 1}
("1.3.36.3.1.3.1.1")

e.g.:

DES_3ECB_ISOpad: {iso(1) identified-organization(3) teletrust(36)
algorithm(3) encryptionAlgorithm(1) des-3(3) 1 1 1}
("1.3.36.3.1.3.1.1.1")

And other modes from our Russian friends:

3DesCBC: {iso(1) identified-organization(3) dod(6) internet(1) private(4)
enterprise(1) 4929 1 8}

("1.3.6.1.4.1.4929.1.8")

3DesCFB: {iso(1) identified-organization(3) dod(6) internet(1) private(4)
enterprise(1) 4929 1 10}

("1.3.6.1.4.1.4929.1.10")

3DesOFB: {iso(1) identified-organization(3) dod(6) internet(1) private(4)
enterprise(1) 4929 1 9}

("1.3.6.1.4.1.4929.1.9")

2.
The RFC 3370 indicates, that this same OID
("1.2.840.113549.3.7") is used also for DES-EDE2-CBC, two key
version Triple-DES? So, what is the common practice: use three key or two
key schemes in current implementations (PKCS#7 envelopes, S/MIME) under
this OID?

Not sure there is any "common practice," except for maybe
choosing one scheme for output

and making sure you're able to handle anything on input... assuming
you're worried

about compatibility.

-mjm