Subject: The Seven Step Encryption - Password Substitutes Processing

From: Qilun Chen <[email-masked]>
Date: Wed, 1 Jul 1998 11:28:57 -0400

Password Substitutes Processing
-------------------------------
Both APPC and Client Access use well-known DES encryption algorithms
to create encrypted passwords.  A Network Station or Enhanced Client
can generate compatible encrypted passwords if they follow these steps,
details of which can be found in the DES (Data Encryption Standard) from
the Federal Information Processing Standards Publication 46, Data
Encryption Standard, January 15, 1977):

  1. Padded_PW = Left justified user password padded to the right with
     X'40's to 8 bytes

     The user's password must be left justified in an eight byte
     variable and padded to the right with X'40' up to an 8 byte length.
     If the user's password is 8 bytes in length, no padding would
     occur.  For computing password substitutes for passwords of length
     9 and 10 see section "Handling passwords of length 9 and 10" below.
     Passwords less than 1 byte or greater than 10 bytes in length are
     not valid.  Please note, if password is not in EBCDIC, it must be
     converted to EBCDIC uppercase.

  2. XOR_PW = Padded_PW xor X'5555555555555555'

     The padded password is exclusive ored with 8 bytes of X'55'.

  3. SHIFT_RESULT = XOR_PW << 1

     The entire 8 byte result is shifted 1 bit to the left; the left
     most bit value is discarded, and the right most bit value is
     cleared to 0.

  4. PW_TOKEN = DES_EBC_mode(SHIFT_RESULT, /* key*/
                             userID_in_EBCDIC_uppercase   /*data*/ )

     This shifted result is used as key to the DES ( Data Encryption
     Standard, Federal Information Processing Standards Publication 46,
     Data Encryption Standard, January 15, 1977)  to encipher the user
     identifier.  When the user identifier is less than 8 bytes, it is
     left justified in an 8 byte variable and padded to the right with
     X'40's.  When the user identifier is 9 or 10 bytes, it is first
     padded to the right with X'40' to a length of 10 bytes.  Then bytes
     9 and 10 are "folded" into bytes 1-8 using the following algorithm.

       (Bit 0 is the high order bit(i.e. has value of X'80').
       Byte 1, bits 0 and 1 are replaced with byte 1, bits 0 and 1
       exclusive or'ed with byte 9, bits 0 and 1.
       Byte 2, bits 0 and 1 are replaced with byte 2, bits 0 and 1
       exclusive or'ed with byte 9, bits 2 and 3.
       Byte 3, bits 0 and 1 are replaced with byte 3, bits 0 and 1
       exclusive or'ed with byte 9, bits 4 and 5.
       Byte 4, bits 0 and 1 are replaced with byte 4, bits 0 and 1
       exclusive or'ed with byte 9, bits 6 and 7.
       Byte 5, bits 0 and 1 are replaced with byte 5, bits 0 and 1
       exclusive or'ed with byte 10, bits 0 and 1.
       Byte 6, bits 0 and 1 are replaced with byte 6, bits 0 and 1
       exclusive or'ed with byte 10, bits 2 and 3.
       Byte 7, bits 0 and 1 are replaced with byte 7, bits 0 and 1
       exclusive or'ed with byte 10, bits 4 and 5.
       Byte 8, bits 0 and 1 are replaced with byte 8, bits 0 and 1
       exclusive or'ed with byte 10, bits 6 and 7.

     User identifier greater than 10 bytes or less than 1 byte are not
     The result of this encryption id known as PW_TOKEN in the paper.

  5. Increment PWSEQs and store it.

     Each LU must maintain a pair of sequence numbers for Attaches sent
     and received on each session.  Each time an attach is generated,
     (and password substitutes are in use on the session) the sending
     sequence number, PWSEQs, is incremented and saved for the next
     time.  Both values are set to zero art BIND time.  so the first use
     of PWSEQs has the value of 1, and increases by one with each use.
     A new field is added to the ATTACH to carry this sequence number.
     However, in certain error conditions, it is possible for the
     sending side to increment the sequence number and the receiver may
     not increment it.  When the sender sends a subsequent ATTACH, the
     receiver will detect a missing sequence.  This is allowed.  However
     the sequence number received must always be larger than the
     previous one, even if some are missing.

     The maximum number of consecutive missing sequence numbers allowed
     is 16.  If this is exceeded, the session is unbound with a protocol
     violation.

     Note: The sequence number must be incremented for every attach
     sent.  However, the sequence number field is only required to be
     included in the FMH5 if a password substitute is sent(byte 4, bit 3
     on).

  6. RDrSEQ = RDr + PWSEQs  /* RDr is server seed. */

     The current value of PWSEQs is added to RDr, the random value
     received from the partner LU on this session, yielding RDrSEQ,
     essentially a predictably modified value of the random value
     received from the partner LU at BIND time.

  7. PW_SUB = DES_CBC_mode(PW_TOKEN,        /* key */
                           (RDrSEQ,         /* 8 bytes */
                            RDs,            /* 8 bytes */
                            ID xor RDrSEQ,  /* 16 bytes */
                            PWSEQs,         /* 8 bytes */
                            )               /* data */
                           )

     The PW_TOKEN is used as a key to the DES function to generate a 8
     bytes value for the following string of inputs:

       RDrSEQ: the random data value received from the partner LU plus
               the sequence number.
       RDs:    the random data value sent to the partner LU on BIND for
               this session.
       A sixteen byte value created by:
           - padding the user identifier with x'40' to a length of 16
             bytes.
           - Exclusive OR the two eight byte halves of the padded user
             identifier with the RDrSEQ value.
           (Note: User ID must first be converted to EBCDIC upper case.)
       PWSEQs: the sequence number.

    This is similar to the process used on LU-LU verification as
    described in the Enhanced LU-LU Bind Security.  The resulting
    enciphered random data is the 'password substitute'.

Handling passwords of length 9 and 10

  1. Generate PW_TOKENa by using characters 1 to 8 of the password and
     step 1-4 described above.

  2. GENERATE PW_TOKENb by using characters 9 and 10 and steps 1-4.  In
     this case Padded_PW from step 1 will be characters 9 and 10 padded
     to the right with X'40' for a total length of 8.

  3. PW_TOKEN = PW_TOKENa xor PW_TOKENb

  4. Now compute PW_SUB by performing steps 5 to 7.

Qilun Chen (Kevin)        Internet Email: [email-masked]
IBM - AS/400 Division, TCP/IP Applications and Internet Connection Team
Tie Line: 8-852-5494  Office Phone: (607) 752-5494
__________________________________________________________________

---

From: Jack Porter <[email-masked]>
Date: Fri, 10 Jul 1998 19:22:15 -0400

Hello Qilun -

        Would you mind elaborating further on a couple of items in your recent mail ?

-----Original Message-----
From:   Qilun Chen [SMTP:[email-masked]]
Sent:   Wednesday, July 01, 1998 11:29 AM
To:     [email-masked]
Subject:        The Seven Step Encryption - Password Substitutes Processing

[Jack Porter]  In a previous mail (sent Mon 6/29/98 5:26 PM), you stated that "PWSEQs is a sequence number needed in the seven step encryption, and it is always one".  Should PWSEQs be initialized to zero each time a new Telnet connection is established ?

Suppose a client requests encrypted auto-signon (with PWSEQs = 1), and the server rejects the request and sends a standard sign-on screen.
If the client closes the connection, establishes a new connection, and again requests encrypted auto-signon, should PWSEQs = 1 again ?
On the other hand, if the client ignores the sign-on screen, keeps the current connection open, and again requests encrypted auto-signon, should PWSEQs = 2 then ?

[Jack Porter]  How does this apply to a Telnet connection ?

[Jack Porter]  Is PW_TOKEN also used as the initialization vector (IV) for the first block of data (RDrSEQ) in the CBC mode encryption ?
(See diagram below, from FIPS 81, page 7).  If not what is used as the IV ?