DES and IDEA Cipher Suites for Transport Layer Security (TLS)
draft-ietf-tls-des-idea-02

TLS Working Group                                         P. Eronen, Ed.
Internet-Draft                                                     Nokia
Intended status: Informational                             June 25, 2008
Expires: December 27, 2008

     DES and IDEA Cipher Suites for Transport Layer Security (TLS)
                     draft-ietf-tls-des-idea-02.txt

Status of this Memo

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on December 27, 2008.

Abstract

   TLS specification versions 1.0 (RFC 2246) and 1.1 (RFC 4346) included
   cipher suites based on DES (Data Encryption Standard) and IDEA
   (International Data Encryption Algorithm) algorithms.  DES (when used
   in single-DES mode) and IDEA are no longer recommended for general
   use in TLS, and have been removed from TLS 1.2 main specification
   (RFC 5246).  This document specifies these cipher suites for
   completeness, and discusses reasons why their use is no longer
   recommended.

Eronen                  Expires December 27, 2008               [Page 1]
Internet-Draft     DES and IDEA Cipher Suites for TLS          June 2008

1.  Introduction

   TLS specification versions 1.0 [TLS10] and 1.1 [TLS11] included
   cipher suites based on DES (Data Encryption Standard) and IDEA
   (International Data Encryption Algorithm) algorithms.  DES (when used
   in single-DES mode) and IDEA are no longer recommended for general
   use in TLS, and have been removed from TLS 1.2 main specification
   [TLS12].

   This document specifies these cipher suites for completeness, and
   discusses reasons why their use is no longer recommended.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [REQ].

2.  DES Cipher Suites

   DES (Data Encryption Standard) is a block cipher which was originally
   approved as US federal standard in 1976, and is specified in [DES].

   For TLS key generation purposes, DES is treated as having a 64-bit
   key, but it still provides only 56 bits of protection, as 8 of the 64
   bits are not used by the algorithm.  DES uses a 64-bit block size.

   The following cipher suites have been defined for using DES in CBC
   mode in TLS:

      CipherSuite TLS_RSA_WITH_DES_CBC_SHA            = { 0x00,0x09 };
      CipherSuite TLS_DH_DSS_WITH_DES_CBC_SHA         = { 0x00,0x0C };
      CipherSuite TLS_DH_RSA_WITH_DES_CBC_SHA         = { 0x00,0x0F };
      CipherSuite TLS_DHE_DSS_WITH_DES_CBC_SHA        = { 0x00,0x12 };
      CipherSuite TLS_DHE_RSA_WITH_DES_CBC_SHA        = { 0x00,0x15 };
      CipherSuite TLS_DH_anon_WITH_DES_CBC_SHA        = { 0x00,0x1A };

   The key exchange algorithms (RSA, DH_DSS, DH_RSA, DHE_DSS, DHE_RSA,
   and DH_anon) and the MAC algorithm (SHA) are defined in the base TLS
   specification.

3.  IDEA Cipher Suite

   IDEA (International Data Encryption Algorithm) is a block cipher
   designed by Xuejia Lai and James Massey [IDEA] [SCH].  IDEA uses a
   128-bit key and operates on 64-bit blocks.

Eronen                  Expires December 27, 2008               [Page 2]
Internet-Draft     DES and IDEA Cipher Suites for TLS          June 2008

   The following cipher suite has been defined for using IDEA in CBC
   mode in TLS:

      CipherSuite TLS_RSA_WITH_IDEA_CBC_SHA           = { 0x00,0x07 };

   The key exchange algorithm (RSA) and the MAC algorithm (SHA) are
   defined in the base TLS specification.

4.  Security Considerations

4.1.  DES Cipher Suites

   DES has an effective key strength of 56 bits, which has been been
   known to be vulnerable to practical brute force attacks for over 20
   years [DH].  A relatively recent 2006 paper by Kumar et al.  [COPA]
   describes a system which performs exhaustive key search in less than
   nine days on average, and costs less than 10,000 USD to build.

   Given this, the single-DES cipher suites SHOULD NOT be implemented by
   TLS libraries.  If a TLS library implements these cipher suites, it
   SHOULD NOT enable them by default.  Experience has also shown that
   rarely used code is a source of security and interoperability
   problems, so existing implementations SHOULD consider removing these
   cipher suites.

4.2.  IDEA Cipher Suite

   IDEA has a 128-bit key, and thus is not vulnerable to exhaustive key
   search.  However, the IDEA cipher suite for TLS has not seen
   widespread use: most implementations either do not support it, do not
   enable it by default, or do not negotiate it when other algorithms
   (such as AES, 3DES, or RC4) are available.

   Experience has shown that rarely used code is a source of security
   and interoperability problems; given this, the IDEA cipher suite
   SHOULD NOT be implemented by TLS libraries, and SHOULD be removed
   from existing implementations.

5.  IANA Considerations

   IANA has already allocated values for the cipher suites described in
   this document in the TLS Cipher Suite Registry, defined in [TLS11].
   IANA is requested to update (has updated) the references of these
   cipher suites to point to this document:

Eronen                  Expires December 27, 2008               [Page 3]
Internet-Draft     DES and IDEA Cipher Suites for TLS          June 2008

   Value         Description                             Reference
   -----------   --------------------------------------  ---------
   0x00,0x07     TLS_RSA_WITH_IDEA_CBC_SHA               [RFCnnnn]
   0x00,0x09     TLS_RSA_WITH_DES_CBC_SHA                [RFCnnnn]
   0x00,0x0C     TLS_DH_DSS_WITH_DES_CBC_SHA             [RFCnnnn]
   0x00,0x0F     TLS_DH_RSA_WITH_DES_CBC_SHA             [RFCnnnn]
   0x00,0x12     TLS_DHE_DSS_WITH_DES_CBC_SHA            [RFCnnnn]
   0x00,0x15     TLS_DHE_RSA_WITH_DES_CBC_SHA            [RFCnnnn]
   0x00,0x1A     TLS_DH_anon_WITH_DES_CBC_SHA            [RFCnnnn]

   This document does not create any new registries to be maintained by
   IANA, and does not require any new assignments from existing
   registries.

6.  Acknowledgments

   The editor would like to thank Steven Bellovin, Uri Blumenthal,
   Michael D'Errico, Paul Hoffman, Simon Josefsson, Bodo Moeller, Tom
   Petch, Martin Rex, and Len Sassaman for their contributions to
   preparing this document.

7.  References

7.1.  Normative References

   [DES]    National Institute of Standards and Technology, "Data
            Encryption Standard (DES)", FIPS PUB 46-3, October 1999.

   [IDEA]   Lai, X., "On the Design and Security of Block Ciphers",
            ETH Series in Information Processing, v. 1, Konstanz:
            Hartung-Gorre Verlag, 1992.

   [REQ]    Bradner, S., "Key words for use in RFCs to Indicate
            Requirement Levels", BCP 14, RFC 2119, March 1997.

   [SCH]    Schneier, B., "Applied Cryptography: Protocols, Algorithms,
            and Source Code in C", 2nd ed., John Wiley & Sons, Inc.,
            1996.

   [TLS10]  Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
            RFC 2246, January 1999.

   [TLS11]  Dierks, T. and E. Rescorla, "The Transport Layer Security
            (TLS) Protocol Version 1.1", RFC 4346, April 2006.

   [TLS12]  Dierks, T. and E. Rescorla, "The Transport Layer Security

Eronen                  Expires December 27, 2008               [Page 4]
Internet-Draft     DES and IDEA Cipher Suites for TLS          June 2008

            (TLS) Protocol Version 1.2", RFC 5246, July 2008.

7.2.  Informative References

   [COPA]   Kumar, S., Paar, C., Pelzl, J., Pfeiffer, G., and M.
            Schimmler, "Breaking Ciphers with COPACOBANA - A Cost-
            Optimized Parallel Code Breaker", Workshop on Cryptographic
            Hardware and Embedded Systems (CHES 2006), Yokohama, Japan,
            October 2006.

   [DH]     Diffie, W. and M. Hellman, "Exhaustive Cryptanalysis of the
            NBS Data Encryption Standard", IEEE Computer, volume 10,
            issue 6, June 1977.

Author's Address

   Pasi Eronen (editor)
   Nokia Research Center
   P.O. Box 407
   FIN-00045 Nokia Group
   Finland

   Email: pasi.eronen@nokia.com

Eronen                  Expires December 27, 2008               [Page 5]
Internet-Draft     DES and IDEA Cipher Suites for TLS          June 2008

Full Copyright Statement

   Copyright (C) The IETF Trust (2008).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Eronen                  Expires December 27, 2008               [Page 6]