Mailing List Archive: Disable Weak cipher check for DES KCV

Disable Weak cipher check for DES KCV

Dec 20, 2019, 5:40 PM

Post #1 of 7 (1159 views)

Hi,

We have a problem here where I need to encrypt a block of data with zeros.

<>
gcry_check_version (NULL);
unsigned char key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
unsigned char out[8];
unsigned char data[8];
gcry_error_t err = 0;
gcry_cipher_hd_t hd = nullptr;
err = gcry_cipher_open(&hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0);
//auto blklen = gcry_cipher_get_algo_blklen(GCRY_CIPHER_DES);
//auto algolen = gcry_cipher_get_algo_keylen (GCRY_CIPHER_DES);
err = gcry_cipher_setkey (hd, key, sizeof(key));
std::cerr << "gpg_err_code: " << gpg_err_code(err) << std::endl;
std::cerr << "gpg_strerror: " << gpg_strerror(err) << std::endl;
gcry_cipher_encrypt(hd, out, sizeof(key), data, 8);
if (err) {
std::cerr << "Failed to perform cryptography" << std::endl;
std::cerr << " cipher: " << static_cast<int>(GCRY_CIPHER_DES) << std::endl;
std::cerr << " mode: " << static_cast<int>(GCRY_CIPHER_MODE_ECB) << std::endl;
//std::cerr << " keyBlock: " << BinToHex<std::string>(key) << std::endl;
//std::cerr << " out: " << BinToHex<std::string>(out) << std::endl;
//std::cerr << " data: " << BinToHex<std::string>(encryptedData) << std::endl;
}
</>

This blows on:

gpg_err_code: 43
gpg_strerror: Weak encryption key
cipher_encrypt: key not set

Tracked back t in a source to libcrypt / cipher / des.c

r. 1384 do_des_setkey
r. 1021 is_weak_key

if (is_weak_key (key)) {
_gcry_burn_stack (64);
return GPG_ERR_WEAK_KEY;
}

cipher.c
r.797

rc = c->spec->setkey (&c->context.c, key, keylen, c);
if (!rc) {

} else
c->marks.key = 0;

... then disallows weak key setting completely, resulting in a failure.

This has quite an impact on multiple (still) in-use KCV operations (e.g. KCV_METHOD_VISA) where key needs to be encrypted with a zero key to get its KCV.

May I propose a patch? (See in attachment).

Thanks & Cheers,
Jan

Re: Disable Weak cipher check for DES KCV [ In reply to ]

gcrypt-devel at gnupg

Dec 22, 2019, 3:36 AM

Post #2 of 7 (1159 views)

Permalink

Hello,

On 21.12.2019 3.40, Jan Bilek wrote:
> Hi,
>
> We have a problem here where I need to encrypt a block of data with zeros.
>
> <>
>   gcry_check_version (NULL);
> unsigned char key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
> unsigned char out[8];
> unsigned char data[8];
> gcry_error_t err = 0;
> gcry_cipher_hd_t hd = nullptr;
> err = gcry_cipher_open(&hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0);
> //auto blklen = gcry_cipher_get_algo_blklen(GCRY_CIPHER_DES);
> //auto algolen = gcry_cipher_get_algo_keylen (GCRY_CIPHER_DES);
> err = gcry_cipher_setkey (hd, key, sizeof(key));
> std::cerr << "gpg_err_code: " << gpg_err_code(err) << std::endl;
> std::cerr << "gpg_strerror: " << gpg_strerror(err) << std::endl;
> gcry_cipher_encrypt(hd, out, sizeof(key), data, 8);
> if (err) {
> std::cerr << "Failed to perform cryptography" << std::endl;
> std::cerr << " cipher: " << static_cast<int>(GCRY_CIPHER_DES) << std::endl;
> std::cerr << " mode: " << static_cast<int>(GCRY_CIPHER_MODE_ECB) << std::endl;
> //std::cerr << " keyBlock: " << BinToHex<std::string>(key) << std::endl;
> //std::cerr << " out: " << BinToHex<std::string>(out) << std::endl;
> //std::cerr << " data: " << BinToHex<std::string>(encryptedData) << std::endl;
> }
> </>
>
> This blows on:
>
> gpg_err_code: 43
> gpg_strerror: Weak encryption key
> cipher_encrypt: key not set
>
> Tracked back t in a source to libcrypt / cipher / des.c
>
> r. 1384 do_des_setkey
> r. 1021 is_weak_key
>
>   if (is_weak_key (key)) {
> _gcry_burn_stack (64);
> return GPG_ERR_WEAK_KEY;
> }
>
> cipher.c
> r.797
>
> rc = c->spec->setkey (&c->context.c, key, keylen, c);
> if (!rc) {
>
>   } else
> c->marks.key = 0;
>
> ... then disallows weak key setting completely, resulting in a failure.
>
> This has quite an impact on multiple (still) in-use KCV operations (e.g. KCV_METHOD_VISA) where key needs to be encrypted with a zero key to get its KCV.

I tried to find KCV specification where zero key is used to encrypt actual key as input block for KCV value, but all KCV algorithms I managed to find encrypt zero input block with the actual key as key. Can you check your documentation for KCV if zero key is really used and give pointer/link to that spec for us?

-Jussi

>
> May I propose a patch? (See in attachment).
>
> Thanks & Cheers,
> Jan
>
> _______________________________________________
> Gcrypt-devel mailing list
> Gcrypt-devel@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gcrypt-devel
>

_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

RE: Disable Weak cipher check for DES KCV [ In reply to ]

jan.bilek at eftlab

Jan 4, 2020, 2:33 AM

Post #3 of 7 (1153 views)

Permalink

Ping?

On 2019-12-21 11:40:06+10:00 Jan Bilek wrote:

Hi,

We have a problem here where I need to encrypt a block of data with zeros.

<>
gcry_check_version (NULL);
unsigned char key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
unsigned char out[8];
unsigned char data[8];
gcry_error_t err = 0;
gcry_cipher_hd_t hd = nullptr;
err = gcry_cipher_open(&hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0);
//auto blklen = gcry_cipher_get_algo_blklen(GCRY_CIPHER_DES);
//auto algolen = gcry_cipher_get_algo_keylen (GCRY_CIPHER_DES);
err = gcry_cipher_setkey (hd, key, sizeof(key));
std::cerr << "gpg_err_code: " << gpg_err_code(err) << std::endl;
std::cerr << "gpg_strerror: " << gpg_strerror(err) << std::endl;
gcry_cipher_encrypt(hd, out, sizeof(key), data, 8);
if (err) {
std::cerr << "Failed to perform cryptography" << std::endl;
std::cerr << " cipher: " << static_cast<int>(GCRY_CIPHER_DES) << std::endl;
std::cerr << " mode: " << static_cast<int>(GCRY_CIPHER_MODE_ECB) << std::endl;
//std::cerr << " keyBlock: " << BinToHex<std::string>(key) << std::endl;
//std::cerr << " out: " << BinToHex<std::string>(out) << std::endl;
//std::cerr << " data: " << BinToHex<std::string>(encryptedData) << std::endl;
}
</>

This blows on:

gpg_err_code: 43
gpg_strerror: Weak encryption key
cipher_encrypt: key not set

Tracked back t in a source to libcrypt / cipher / des.c

r. 1384 do_des_setkey
r. 1021 is_weak_key

if (is_weak_key (key)) {
_gcry_burn_stack (64);
return GPG_ERR_WEAK_KEY;
}

cipher.c
r.797

rc = c->spec->setkey (&c->context.c, key, keylen, c);
if (!rc) {

} else
c->marks.key = 0;

... then disallows weak key setting completely, resulting in a failure.

This has quite an impact on multiple (still) in-use KCV operations (e.g. KCV_METHOD_VISA) where key needs to be encrypted with a zero key to get its KCV.

May I propose a patch? (See in attachment).

Thanks & Cheers,
Jan

Re: Disable Weak cipher check for DES KCV [ In reply to ]

gcrypt-devel at gnupg

Jan 5, 2020, 6:36 AM

Post #4 of 7 (1151 views)

Permalink

Hello,

Apparently my first reply went only to the mailing list.

There I wrote: "I tried to find KCV specification where zero key is used to encrypt actual key as input block for KCV value, but all KCV algorithms I managed to find encrypt zero input block with the actual key as key. Can you check your documentation for KCV if zero key is really used and give pointer/link to that spec for us?"

-Jussi

On 4.1.2020 12.33, Jan Bilek wrote:
> Ping?
>
>
> On 2019-12-21 11:40:06+10:00 Jan Bilek wrote:
>
> Hi,
>
> We have a problem here where I need to encrypt a block of data with zeros.
>
> <>
>   gcry_check_version (NULL);
> unsigned char key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
> unsigned char out[8];
> unsigned char data[8];
> gcry_error_t err = 0;
> gcry_cipher_hd_t hd = nullptr;
> err = gcry_cipher_open(&hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0);
> //auto blklen = gcry_cipher_get_algo_blklen(GCRY_CIPHER_DES);
> //auto algolen = gcry_cipher_get_algo_keylen (GCRY_CIPHER_DES);
> err = gcry_cipher_setkey (hd, key, sizeof(key));
> std::cerr << "gpg_err_code: " << gpg_err_code(err) << std::endl;
> std::cerr << "gpg_strerror: " << gpg_strerror(err) << std::endl;
> gcry_cipher_encrypt(hd, out, sizeof(key), data, 8);
> if (err) {
> std::cerr << "Failed to perform cryptography" << std::endl;
> std::cerr << " cipher: " << static_cast<int>(GCRY_CIPHER_DES) << std::endl;
> std::cerr << " mode: " << static_cast<int>(GCRY_CIPHER_MODE_ECB) << std::endl;
> //std::cerr << " keyBlock: " << BinToHex<std::string>(key) << std::endl;
> //std::cerr << " out: " << BinToHex<std::string>(out) << std::endl;
> //std::cerr << " data: " << BinToHex<std::string>(encryptedData) << std::endl;
> }
> </>
>
> This blows on:
>
> gpg_err_code: 43
> gpg_strerror: Weak encryption key
> cipher_encrypt: key not set
>
> Tracked back t in a source to libcrypt / cipher / des.c
>
> r. 1384 do_des_setkey
> r. 1021 is_weak_key
>
>   if (is_weak_key (key)) {
> _gcry_burn_stack (64);
> return GPG_ERR_WEAK_KEY;
> }
>
> cipher.c
> r.797
>
> rc = c->spec->setkey (&c->context.c, key, keylen, c);
> if (!rc) {
>
>   } else
> c->marks.key = 0;
>
> ... then disallows weak key setting completely, resulting in a failure.
>
> This has quite an impact on multiple (still) in-use KCV operations (e.g. KCV_METHOD_VISA) where key needs to be encrypted with a zero key to get its KCV.
>
> May I propose a patch? (See in attachment).
>
> Thanks & Cheers,
> Jan
>
>
> _______________________________________________
> Gcrypt-devel mailing list
> Gcrypt-devel@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gcrypt-devel
>

_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

RE: Disable Weak cipher check for DES KCV [ In reply to ]

jan.bilek at eftlab

Jan 8, 2020, 5:57 PM

Post #5 of 7 (1147 views)

Permalink

Hi Jussi,

No problem and thanks for coming back on my email.

You are right - "all KCV algorithms I managed to find encrypt zero input block with the actual key as key" - except cases where the key is a weak key. While this might sound ridiculous there are many cases like this - in production as well as in test environments. E.g. Thales HSM default-load key-set works with some weak keys and while doing symmetric crypto we need to support those as well (in testing / dev environments Thales HSM is almost always loaded with a default key set so crypto can be reproduced and validated).

Hope it makes better sense now.

Cheers,
Jan

On 2020-01-06 00:36:19+10:00 Jussi Kivilinna wrote:

Hello,

Apparently my first reply went only to the mailing list.

There I wrote: "I tried to find KCV specification where zero key is used to encrypt actual key as input block for KCV value, but all KCV algorithms I managed to find encrypt zero input block with the actual key as key. Can you check your documentation for KCV if zero key is really used and give pointer/link to that spec for us?"

-Jussi

On 4.1.2020 12.33, Jan Bilek wrote:
&gt; Ping?
&gt; &nbsp;
&gt;
&gt; On 2019-12-21 11:40:06+10:00 Jan Bilek wrote:
&gt;
&gt; Hi,
&gt;
&gt; We have a problem here where I need to encrypt a block of data with zeros.
&gt;
&gt; &lt;&gt;
&gt; &nbsp;&nbsp;gcry_check_version (NULL);
&gt; &nbsp; unsigned char key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
&gt; &nbsp; unsigned char out[8];
&gt; &nbsp; unsigned char data[8];
&gt; &nbsp; gcry_error_t err = 0;
&gt; &nbsp; gcry_cipher_hd_t hd = nullptr;
&gt; &nbsp; err = gcry_cipher_open(&amp;hd, GCRY_CIPHER_DES, GCRY_CIPHER_MODE_ECB, 0);
&gt; &nbsp; //auto blklen = gcry_cipher_get_algo_blklen(GCRY_CIPHER_DES);
&gt; &nbsp; //auto algolen = gcry_cipher_get_algo_keylen (GCRY_CIPHER_DES);
&gt; &nbsp; err = gcry_cipher_setkey (hd, key, sizeof(key));
&gt; &nbsp; std::cerr &lt;&lt; "gpg_err_code: " &lt;&lt; gpg_err_code(err) &lt;&lt; std::endl;
&gt; &nbsp; std::cerr &lt;&lt; "gpg_strerror: " &lt;&lt; gpg_strerror(err) &lt;&lt; std::endl;
&gt; &nbsp; gcry_cipher_encrypt(hd, out, sizeof(key), data, 8);
&gt; &nbsp; if (err) {
&gt; &nbsp; &nbsp; std::cerr &lt;&lt; "Failed to perform cryptography" &lt;&lt; std::endl;
&gt; &nbsp; &nbsp; std::cerr &lt;&lt; " &nbsp;cipher: &nbsp; &nbsp; " &lt;&lt; static_cast<int>(GCRY_CIPHER_DES) &lt;&lt; std::endl;
&gt; &nbsp; &nbsp; std::cerr &lt;&lt; " &nbsp;mode: &nbsp; &nbsp; &nbsp; " &lt;&lt; static_cast<int>(GCRY_CIPHER_MODE_ECB) &lt;&lt; std::endl;
&gt; &nbsp; &nbsp; //std::cerr &lt;&lt; " &nbsp;keyBlock: &nbsp; " &lt;&lt; BinToHex<std::string>(key) &lt;&lt; std::endl;
&gt; &nbsp; &nbsp; //std::cerr &lt;&lt; " &nbsp;out: &nbsp; &nbsp; &nbsp; &nbsp;" &lt;&lt; BinToHex<std::string>(out) &lt;&lt; std::endl;
&gt; &nbsp; &nbsp; //std::cerr &lt;&lt; " &nbsp;data: &nbsp; &nbsp; &nbsp; " &lt;&lt; BinToHex<std::string>(encryptedData) &lt;&lt; std::endl;
&gt; &nbsp; }
&gt;
&gt;
&gt; This blows on:
&gt;
&gt; gpg_err_code: 43
&gt; gpg_strerror: Weak encryption key
&gt; cipher_encrypt: key not set
&gt;
&gt; Tracked back t&nbsp;in a source&nbsp;to libcrypt / cipher / des.c
&gt;
&gt; r. 1384&nbsp;do_des_setkey
&gt; r. 1021 is_weak_key
&gt;
&gt; &nbsp;&nbsp;if (is_weak_key (key)) {
&gt; &nbsp; &nbsp; _gcry_burn_stack (64);
&gt; &nbsp; &nbsp; return GPG_ERR_WEAK_KEY;
&gt; &nbsp; }
&gt;
&gt; cipher.c
&gt; r.797&nbsp;
&gt;
&gt; &nbsp;rc = c-&gt;spec-&gt;setkey (&amp;c-&gt;context.c, key, keylen, c);
&gt; &nbsp; if (!rc) {
&gt;
&gt; &nbsp;&nbsp;} else
&gt; &nbsp; &nbsp; c-&gt;marks.key = 0;
&gt; &nbsp;
&gt; ... then disallows weak key setting completely, resulting in a failure.
&gt;
&gt; This has quite an impact on multiple (still) in-use KCV operations (e.g. KCV_METHOD_VISA) where key needs to be encrypted with a zero key to get its KCV.
&gt;
&gt; May I propose a patch? (See in attachment).
&gt;
&gt; Thanks &amp; Cheers,
&gt; Jan
&gt;
&gt;
&gt; _______________________________________________
&gt; Gcrypt-devel mailing list
&gt; Gcrypt-devel@gnupg.org
&gt; http://lists.gnupg.org/mailman/listinfo/gcrypt-devel
&gt;

</std::string></std::string></std::string></int></int>

Re: Disable Weak cipher check for DES KCV [ In reply to ]

jussi.kivilinna at iki

Jan 22, 2020, 1:08 PM

Post #6 of 7 (1131 views)

Permalink

Hello,

On 9.1.2020 3.57, Jan Bilek wrote:
> Hi Jussi,
>
> No problem and thanks for coming back on my email.
>
> You are right - "all KCV algorithms I managed to find encrypt zero input block with the actual key as key" - except cases where the key is a weak key. While this might sound ridiculous there are many cases like this - in production as well as in test environments. E.g. Thales HSM default-load key-set works with some weak keys and while doing symmetric crypto we need to support those as well (in testing / dev environments Thales HSM is almost always loaded with a default key set so crypto can be reproduced and validated).
>
> Hope it makes better sense now.

Ok. I guess for such testing use-case, we could add new gcry_cipher_ctl command to allow weak-keys on cipher object. After command is given to cipher object, setkey would still return weak-key error code, but otherwise setup algorithm for encryption/decryption. Usage would be like this:

err = gcry_cipher_open(&handle, algo, mode, 0)
assert(err == 0)
err = gcry_cipher_ctl(handle, GCRYCTL_ALLOW_WEAK_KEY, NULL, 1)
assert(err == 0)
err = gcry_cipher_setkey(handle, weak_key_buf, weak_key_len)
assert(err == GPG_ERR_WEAK_KEY)
err = gcry_cipher_encrypt(handle, out, outlen, in, inlen)
assert(err == 0)
err = gcry_cipher_close(handle)
assert(err == 0)

-Jussi

_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

RE: Disable Weak cipher check for DES KCV [ In reply to ]

jan.bilek at eftlab

Jan 22, 2020, 2:57 PM

Post #7 of 7 (1131 views)

Permalink

I love it! Let me know if we can support this somehow from our side.

BR,
Jan

On 2020-01-23 07:09:02+10:00 Jussi Kivilinna wrote:

Hello,

On 9.1.2020 3.57, Jan Bilek wrote:
&gt; Hi Jussi,
&gt;
&gt; No problem and thanks for coming back on my email.
&gt;
&gt; You are right - "all KCV algorithms I managed to find encrypt zero input block with the actual key as key" - except cases where the key is a weak key. While this might sound ridiculous there are many cases like this - in production as well as in test environments. E.g. Thales HSM default-load key-set works with some weak keys and while doing symmetric crypto we need to support those as well (in testing / dev environments Thales HSM is almost always loaded with a default key set so crypto can be reproduced and validated).
&gt;
&gt; Hope it makes better sense now.

Ok. I guess for such testing use-case, we could add new gcry_cipher_ctl command to allow weak-keys on cipher object. After command is given to cipher object, setkey would still return weak-key error code, but otherwise setup algorithm for encryption/decryption. Usage would be like this:

err = gcry_cipher_open(&amp;handle, algo, mode, 0)
assert(err == 0)
err = gcry_cipher_ctl(handle, GCRYCTL_ALLOW_WEAK_KEY, NULL, 1)
assert(err == 0)
err = gcry_cipher_setkey(handle, weak_key_buf, weak_key_len)
assert(err == GPG_ERR_WEAK_KEY)
err = gcry_cipher_encrypt(handle, out, outlen, in, inlen)
assert(err == 0)
err = gcry_cipher_close(handle)
assert(err == 0)

-Jussi

Mailing List Archive

Mailing List Archive

Attached Files: