545 lines
24 KiB
Plaintext
545 lines
24 KiB
Plaintext
This NCSL Bulletin initiates a new publication series at the
|
|
National Computer Systems Laboratory (NCSL). Each bulletin will
|
|
present an in-depth discussion of a single topic of significant
|
|
interest to the information systems community. Bulletins will be
|
|
issued on an as-needed basis and are available from NCSL
|
|
Publications, National Institute of Standards and Technology,
|
|
Room B151, Technology Building, Gaithersburg, MD 20899,
|
|
telephone (301) 975-2821 or FTS 879-2821.
|
|
|
|
|
|
DATA ENCRYPTION STANDARD
|
|
JUNE 1990
|
|
Introduction
|
|
|
|
The National Computer Systems Laboratory (NCSL) of the National
|
|
Institute of Standards and Technology (NIST) has received many
|
|
inquiries related to the Data Encryption Standard (DES). This
|
|
NCSL Bulletin addresses those frequently asked questions and
|
|
provides sources of additional information. This document does
|
|
not issue new policy; rather, it summarizes and clarifies
|
|
existing policies.
|
|
|
|
Background
|
|
|
|
NIST (formerly the National Bureau of Standards) issued Federal
|
|
Information Processing Standard (FIPS) 46 in 1977 to provide a
|
|
system for the cryptographic protection of the confidentiality
|
|
and integrity of federal sensitive unclassified computer
|
|
information. DES has been reviewed and reaffirmed twice, most
|
|
recently in 1988. The current standard, which was issued as FIPS
|
|
46-1, reaffirms the standard until 1993. The DES algorithm is
|
|
based on work of the International Business Machines Corporation
|
|
and has been adopted as American National Standard X3.92-
|
|
1981/R1987.
|
|
|
|
Technical Overview
|
|
|
|
The Data Encryption Standard specifies a cryptographic algorithm
|
|
that converts plaintext to ciphertext using a 56-bit key. The
|
|
same algorithm is used with the same key to convert ciphertext
|
|
back to plaintext, a process called decryption. The DES
|
|
algorithm consists of 16 "rounds" of operations that mix the data
|
|
and key together in a prescribed manner using the fundamental
|
|
operations of permutation and substitution. The goal is to
|
|
completely scramble the data and key so that every bit of the
|
|
ciphertext depends on every bit of the data plus every bit of the
|
|
key (a 56-bit quantity for DES).
|
|
|
|
Security Provided by DES
|
|
|
|
The security provided by a cryptographic system depends on
|
|
several factors: mathematical soundness of the algorithm, length
|
|
of the keys, key management, mode of operation, and
|
|
implementation.
|
|
|
|
DES was developed to protect unclassified computer data in
|
|
federal computer systems against a number of passive and active
|
|
attacks in communications and computer systems. It was assumed
|
|
that a knowledgeable person might seek to compromise the security
|
|
system by employing resources commensurate with the value of the
|
|
protected information. Appropriate applications of DES include
|
|
Electronic Funds Transfer, privacy protection of personal
|
|
information, personal authentication, password protection, access
|
|
control, etc.
|
|
|
|
DES has been evaluated by several organizations and has been
|
|
determined to be mathematically sound. Some individuals have
|
|
analyzed the DES algorithm and have concluded that the algorithm
|
|
would not be secure if a particular change were made (e.g., if
|
|
fewer "rounds" were used). Modifications of this sort are not in
|
|
accordance with the standard and, therefore, may provide
|
|
significantly less security.
|
|
|
|
NIST believes that DES provides more than adequate security for
|
|
its intended unclassified applications and plans to continue its
|
|
support of the standard. It is currently the only cryptographic
|
|
standard approved in the federal government to protect
|
|
unclassified computer information (except for a special category
|
|
of information described below). The next review of DES is
|
|
scheduled for 1993. NIST plans to augment DES with other
|
|
cryptographic algorithms to form a family of standards that will
|
|
provide new types of protection in special applications.
|
|
|
|
Applicability
|
|
|
|
Subject to agency waivers as discussed below, use of DES is
|
|
mandatory for all federal agencies, including defense agencies,
|
|
for the protection of sensitive unclassified information when the
|
|
agency or department determines that cryptographic protection is
|
|
required.
|
|
|
|
The National Security Agency (NSA) of the U.S. Department of
|
|
Defense develops and promulgates requirements for
|
|
telecommunications and automated information systems operated by
|
|
the U.S. government, its contractors, or agents, that contain
|
|
classified information or, as delineated in 10 U.S.C. Section
|
|
2315, the function, operation, or use of which:
|
|
|
|
- involves intelligence activities;
|
|
- involves cryptologic activities related to national
|
|
security;
|
|
- involves the direct command and control of military
|
|
forces;
|
|
- involves equipment which is an integral part of a
|
|
weapon or weapon systems; or
|
|
- is critical to the direct fulfillment of a military or
|
|
intelligence mission.
|
|
|
|
Note that the term unclassified information as used in this
|
|
document excludes information covered by 10 U.S.C. 2315.
|
|
|
|
DES may be used by private-sector individuals or organizations at
|
|
their discretion.
|
|
|
|
Waivers for the Mandatory Use of DES
|
|
|
|
The head of a federal department or agency may waive the use of
|
|
DES for the protection of unclassified information in accordance
|
|
with the provisions of FIPS 46-1, section 17, page 4, as
|
|
discussed below:
|
|
|
|
A waiver is necessary if cryptographic devices
|
|
performing an algorithm other than that which is
|
|
specified in this standard are to be used by a federal
|
|
agency for data subject to cryptographic protection
|
|
under this standard. No waiver is necessary if
|
|
classified communications security equipment is to be
|
|
used. Software implementations of this algorithm for
|
|
operational use in general purpose computer systems do
|
|
not comply with this standard and each such
|
|
implementation must also receive a waiver.
|
|
Implementation of the algorithm in software for testing
|
|
or evaluation does not require waiver approval.
|
|
Implementation of other special purpose cryptographic
|
|
algorithms in software for limited use within a computer
|
|
system (e.g., encrypting password files) or
|
|
implementation of cryptographic algorithms in software
|
|
which were being utilized in computer systems before the
|
|
effective date of this standard do not require a waiver.
|
|
However, these limited uses should be converted to the
|
|
use of the standard when the system or equipment
|
|
involved is upgraded or redesigned to include general
|
|
cryptographic protection of computer data. Waivers will
|
|
be considered for devices certified by the National
|
|
Security Agency as complying with the Commercial COMSEC
|
|
Endorsement Program (CCEP) when such devices offer
|
|
equivalent cost/performance features when compared with
|
|
devices conforming to this standard.
|
|
|
|
Waiver Procedures
|
|
|
|
As mentioned above, the heads of federal departments or agencies
|
|
may waive the mandatory use of DES. This authority may be
|
|
redelegated only to a senior official designated pursuant to 44
|
|
U.S.C. section 3506(b). Waivers shall be granted only when:
|
|
|
|
- compliance with the standard would adversely affect the
|
|
accomplishment of the mission of an operator of a federal
|
|
computer system; or
|
|
|
|
- compliance would cause a major adverse financial impact on
|
|
the operator which is not offset by governmentwide savings.
|
|
|
|
Agency heads may act upon a written waiver request containing the
|
|
information detailed above. Agency heads may also act without a
|
|
written waiver request when they determine that conditions for
|
|
meeting the standard cannot be met. Agency heads may approve
|
|
waivers only by a written decision which explains the basis on
|
|
which the agency head made the required finding(s). A copy of
|
|
each such decision, with procurement-sensitive or classified
|
|
portions clearly identified, shall be sent to:
|
|
|
|
National Institute of Standards and Technology
|
|
Attention: FIPS Waiver Decisions
|
|
Technology Building, Room B-154
|
|
Gaithersburg, MD 20899
|
|
|
|
In addition, notice of each waiver granted and each delegation of
|
|
authority shall be sent promptly to the Committee on Government
|
|
Operations of the House of Representatives and the Committee on
|
|
Governmental Affairs of the Senate and shall be published
|
|
promptly in the Federal Register.
|
|
|
|
When the determination on a waiver applies to the procurement of
|
|
equipment and/or services, a notice of the waiver determination
|
|
must be published in the Commerce Business Daily as a part of the
|
|
notice of solicitation for offers of an acquisition or, if the
|
|
waiver determination is made after that notice is published, by
|
|
amendment to such notice.
|
|
|
|
A copy of the waiver, any supporting documents, the document
|
|
approving the waiver and any supporting or accompanying
|
|
documents, with such deletions as the agency is authorized and
|
|
decides to make under 5 U.S.C. Section 552(b), shall be part of
|
|
the procurement documentation and retained by the agency.
|
|
|
|
Endorsement of DES Products
|
|
|
|
DES products for use in telecommunications equipment and systems
|
|
are no longer being endorsed by NSA for conformance to FIPS 140,
|
|
General Security Requirements for Equipment Using the Data
|
|
Encryption Standard, (formerly Federal Standard 1027). Federal
|
|
agencies may purchase FIPS 140 products that have not been
|
|
validated under the NSA endorsement program without processing a
|
|
waiver. To do so, agencies must require written affirmation from
|
|
vendors that their products are in conformance with the
|
|
provisions of the current standard.
|
|
|
|
Also, NIST has notified the heads of federal departments that
|
|
they may wish to consider waiving certain requirements of FIPS
|
|
140 in order to buy equipment which may not meet all of the
|
|
criteria in the standard. This action will enable agencies to
|
|
procure cost-effective equipment that meets their needs, but has
|
|
not been endorsed by NSA.
|
|
|
|
FIPS 140 is currently under revision to be reissued as FIPS 140-
|
|
1. All issues contained within the scope of the original
|
|
standard are being readdressed. NIST is also examining various
|
|
methods for conducting conformance testing against the
|
|
requirements of FIPS 140-1.
|
|
|
|
DES Cryptographic Keys
|
|
|
|
U.S. government users of DES products which have been endorsed by
|
|
NSA under Federal Standard 1027 may obtain DES cryptographic keys
|
|
for these products from NSA upon request at no cost. (Note that
|
|
NSA is no longer endorsing products under Federal Standard 1027.)
|
|
Contact your responsible Communications Security (COMSEC) officer
|
|
for further information.
|
|
|
|
Alternatively, users of DES, including federal organizations, may
|
|
generate their own cryptographic keys. DES keys must be properly
|
|
generated and managed in order to assure a high level of
|
|
protection to computer data. Key Management includes generation,
|
|
distribution, storage, and destruction of cryptographic keys.
|
|
Information on this subject may be obtained from the following
|
|
documents: FIPS 74, FIPS 140-1 (future), and ANSI X9.17. (See
|
|
reference list for availability of the documents.)
|
|
|
|
Exportability of DES Devices and Software Products
|
|
|
|
Hardware- and software-based implementations of DES are subject
|
|
to federal export controls as specified in Title 22, Code of
|
|
Federal Regulations (CFR), Parts 120 - 128, the International
|
|
Traffic in Arms Regulations (ITAR). Specific information
|
|
regarding export applications, application procedures, types of
|
|
licenses, and necessary forms may be found in the CFR.
|
|
Responsibility for granting export licenses (except for those DES
|
|
implementations noted below) rests with:
|
|
|
|
Office of Munitions Control
|
|
Bureau of Politico-Military Affairs
|
|
U.S. Department of State
|
|
Washington, DC, 20250
|
|
Telephone: (202) 875-6650
|
|
|
|
The Office of Munitions Control, U.S. Department of State, issues
|
|
either individual or distribution licenses. Under a distribution
|
|
license, annual reports must be submitted by the distributor
|
|
describing to whom the licensed products have been sold. License
|
|
requests for products to be shipped to certain prohibited
|
|
countries (see Section 126.1 of the ITAR) are denied for foreign
|
|
policy reasons by the Department of State.
|
|
|
|
Licenses are normally granted if the end users are either
|
|
financial institutions or American subsidiaries abroad. In
|
|
general, either individual or distribution licenses may be used
|
|
for financial institutions while only individual licenses may be
|
|
used for subsidiaries of U.S. corporations.
|
|
|
|
Specific Cryptographic Implementations under Jurisdiction of the
|
|
Department of Commerce
|
|
|
|
The Bureau of Export Administration, U.S. Department of Commerce,
|
|
is responsible for the granting of export licenses for the
|
|
following categories of cryptographic products (including DES):
|
|
|
|
- Authentication. Software or hardware which calculates a
|
|
Message Authentication Code (MAC) or similar result to
|
|
assure no alteration of text has taken place, or to
|
|
authenticate users, but does not allow for encryption of
|
|
data, text, or other media other than that needed for the
|
|
authentication.
|
|
|
|
- Access Control. Software or hardware which protects
|
|
passwords or Personal Identification Numbers (PIN) or
|
|
similar data to prevent unauthorized access to computing
|
|
facilities, but does not allow for encryption of files or
|
|
text, except as directly related to password or PIN
|
|
protection.
|
|
|
|
- Proprietary Software Protection. Decryption-only routines
|
|
for encrypted proprietary software, fonts, or other
|
|
computer-related proprietary information for the purpose of
|
|
maintaining vendor control over said information when such
|
|
decryption routines are not accessible to users of said
|
|
software, font, or other information, and cannot be used
|
|
for any other purpose.
|
|
|
|
- Automatic Teller Devices. Devices limited to the issuance
|
|
of cash or traveler's checks, acceptance of deposits, or
|
|
account balance reporting.
|
|
|
|
Vendors of products in the above four categories should contact
|
|
the following for a product classification determination:
|
|
|
|
Bureau of Export Administration
|
|
U.S. Department of Commerce
|
|
P.O. Box 273
|
|
Washington, DC 20044
|
|
Telephone: (202) 377-0708
|
|
|
|
Following this determination, the vendor will be informed whether
|
|
an export license from the U.S. Department of Commerce is
|
|
necessary. The Bureau of Export Administration will provide
|
|
vendors with license procedures and further information as
|
|
appropriate.
|
|
|
|
Please note that vendors whose products do not fall clearly into
|
|
the above categories should follow procedures set forth in the
|
|
ITAR, 22 CFR 120-130.
|
|
|
|
Validation of Devices for Compliance with FIPS 46 and 113
|
|
|
|
NIST performs validations of products for compliance with FIPS 46
|
|
and 113. For further information about submitting products for
|
|
validation or to obtain a list of devices validated under either
|
|
standard, please contact:
|
|
|
|
Manager, Security Technology Group
|
|
Computer Security Division
|
|
National Computer Systems Laboratory
|
|
Building 225, Room A216
|
|
National Institute of Standards and Technology
|
|
Gaithersburg, MD 20899
|
|
Telephone (301) 975-2920
|
|
|
|
Reference Documents
|
|
|
|
NIST Documents
|
|
|
|
NIST has issued FIPS and other publications regarding DES, its
|
|
implementation, and modes of operation.
|
|
|
|
FIPS 46-1, Data Encryption Standard
|
|
|
|
This standard provides the technical specifications for DES.
|
|
|
|
FIPS 74, Guidelines for Implementing and Using the NBS Data
|
|
Encryption Standard
|
|
|
|
This guideline on DES discusses how and when data encryption
|
|
should be used, various encryption methods, the reduction of
|
|
security threats, implementation of DES, and key management.
|
|
|
|
FIPS 81, DES Modes of Operation
|
|
|
|
FIPS 81 defines four modes of operation for DES which may be
|
|
used in a wide variety of applications. The modes specify how
|
|
data will be encrypted and decrypted. The four modes are: (1)
|
|
Electronic Codebook (ECB), (2) Cipher Block Chaining (CBC), (3)
|
|
Cipher Feedback (CFB), and (4) Output Feedback (OFB).
|
|
|
|
FIPS 113, Computer Data Authentication
|
|
|
|
This standard specifies a Data Authentication Algorithm, based
|
|
upon DES, which may be used to detect unauthorized
|
|
modifications, both intentional and accidental, to data. The
|
|
Message Authentication Code as specified in ANSI X9.9 is
|
|
computed in the same manner as the Data Authentication Code as
|
|
specified in this standard.
|
|
|
|
FIPS 139, Interoperability and Security Requirements for Use of
|
|
the Data Encryption Standard in the Physical Layer of Data
|
|
Communications
|
|
|
|
This standard specifies interoperability and security-related
|
|
requirements for using encryption at the Physical Layer of the
|
|
ISO Open Systems Interconnection (OSI) Reference Model in
|
|
telecommunications systems conveying digital information. FIPS
|
|
139 was previously issued by the General Services Administration
|
|
as Federal Standard 1026.
|
|
|
|
FIPS 140, General Security Requirements for Equipment Using the
|
|
Data Encryption Standard
|
|
|
|
This document establishes the physical and logical security
|
|
requirements for the design and manufacture of DES equipment.
|
|
FIPS 140 was previously issued by the General Services
|
|
Administration as Federal Standard 1027.
|
|
|
|
FIPS 141, Interoperability and Security Requirements for Use of
|
|
the Data Encryption Standard With CCITT Group 3 Facsimile
|
|
Equipment
|
|
|
|
This document specifies interoperability and security related
|
|
requirements for use of encryption with the International
|
|
Telegraph and Telephone Consultative Committee (CCITT), Group 3-
|
|
type facsimile equipment.
|
|
|
|
NBS Special Publication 500-20, Validating the Correctness of
|
|
Hardware Implementations of the NBS Data Encryption Standard
|
|
|
|
This publication describes the design and operation of the
|
|
testbed that is used for the validation of hardware
|
|
implementations of DES. A particular implementation is verified
|
|
if it correctly performs a set of 291 test cases that have been
|
|
defined to exercise every basic element of the algorithm.
|
|
|
|
NBS Special Publication 500-27, Computer Security and the Data
|
|
Encryption Standard
|
|
|
|
This publication contains the proceedings of the Conference on
|
|
Computer Security and the Data Encryption Standard held at the
|
|
National Bureau of Standards on February 15, 1977. Subjects of
|
|
the papers and presentations include physical security, risk
|
|
assessment, software security, computer network security,
|
|
applications and implementation of the Data Encryption Standard.
|
|
|
|
NBS Special Publication 500-54, A Key Notarization System for
|
|
Computer Networks
|
|
|
|
This document describes a system for key notarization, which can
|
|
be used with an encryption device, to improve data security in
|
|
computer networks. The key notarization system can be used to
|
|
communicate securely between two users, communicate via
|
|
encrypted mail, protect personal files, and provide a digital
|
|
signature capability.
|
|
|
|
NBS Special Publication 500-61, Maintenance Testing for the Data
|
|
Encryption Standard
|
|
|
|
This special publication describes the design of four
|
|
maintenance tests for the Data Encryption Standard. The tests
|
|
consist of an iterative procedure that tests the operation of
|
|
DES devices using a small program and minimal data. The tests
|
|
are defined as four specific stopping points in a general
|
|
testing process and satisfy four testing requirements of
|
|
increasing degree of completeness depending on the thoroughness
|
|
of testing desired.
|
|
|
|
NBS Special Publication 500-156, Message Authentication Code
|
|
(MAC) Validation System: Requirements and Procedures
|
|
|
|
This special publication describes a Message Authentication Code
|
|
(MAC) Validation System (MVS) to test message authentication
|
|
devices for conformance to two data authentication standards:
|
|
FIPS 113 and ANSI X9.9-1986, Financial Institution Message
|
|
Authentication (Wholesale). The MVS is designed to perform
|
|
automated testing on message authentication devices which are
|
|
remote to NIST. This publication provides brief overviews of
|
|
the two data authentication standards and introduces the basic
|
|
design and configuration of the MVS. The requirements and
|
|
administrative procedures to be followed by those seeking formal
|
|
NIST validation of a message authentication device are
|
|
presented.
|
|
|
|
Copies of these publications are for sale by the National
|
|
Technical Information Service, at:
|
|
|
|
National Technical Information Service
|
|
U.S. Department of Commerce
|
|
5285 Port Royal Road
|
|
Springfield, VA 22161
|
|
Telephone (703) 487-4650, FTS: 737-4650
|
|
|
|
Other Documents
|
|
|
|
DES has been incorporated into a number of other standards,
|
|
including:
|
|
|
|
"American national standard for financial institution key
|
|
management (wholesale)," ANSI X9.17-1985, American Bankers
|
|
Association, 10 Jay Gould Ct., Waldorf, MD 20602.
|
|
|
|
"American national standard for financial institution message
|
|
authentication," ANSI X9.9-1986 (Revised), American Bankers
|
|
Association, 10 Jay Gould Ct., Waldorf, MD 20602.
|
|
|
|
"American national standard for financial message encryption,"
|
|
ANSI X9.23-1988, American Bankers Association, 10 Jay Gould Ct.,
|
|
Waldorf, MD 20602.
|
|
|
|
"American national standard for information systems - Data
|
|
encryption algorithm - Modes of operation," ANSI X3.106-1983,
|
|
American National Standards Institute, 1430 Broadway, New York,
|
|
NY 20018.
|
|
|
|
"American national standard for information systems - Data link
|
|
encryption," ANSI X3.105-1983, American National Standards
|
|
Institute, 1430 Broadway, New York, NY 20018
|
|
|
|
"American national standard for personal identification number
|
|
(PIN) Management and Security," ANSI X9.8-1982, American Bankers
|
|
Association, 10 Jay Gould Ct., Waldorf, MD 20602.
|
|
|
|
"American national standard for retail message authentication,"
|
|
ANSI X9.19-1985, American Bankers Association, 10 Jay Gould Ct.,
|
|
Waldorf, MD 20602.
|
|
|
|
"Banking - Key management (wholesale)," IS 8732, Association for
|
|
Payment Clearing Services, London, England, Dec. 1987.
|
|
|
|
"Banking - Requirements for message authentication (wholesale),"
|
|
IS 8730, Association for Payment Clearing Services, London,
|
|
England, July 1987.
|
|
|
|
"Data encryption algorithm," ANSI X3.92-1981, American National
|
|
Standards Institute, 1430 Broadway, New York, NY 20018.
|
|
|
|
"Draft American national standard for financial institution
|
|
sign-on authentication for wholesale financial systems: Secure
|
|
transmission of personal authenticating information and node
|
|
authentication," ANSI X9-26-199_, American Bankers Association,
|
|
10 Jay Gould Ct., Waldorf, MD 20602.
|
|
Related Documents
|
|
|
|
"The Data Encryption Standard: Past and Future," Smid and
|
|
Branstad, Proceedings of the IEEE, Vol. 76, No. 5, May 1988.
|
|
|
|
NIST's Computer Security Program
|
|
|
|
For further information regarding other aspects of NIST's
|
|
computer security program, including NIST's federal agency
|
|
assistance program, please contact:
|
|
|
|
Computer Security Division
|
|
National Computer Systems Laboratory
|
|
Building 225, Room A216
|
|
National Institute of Standards and Technology
|
|
Gaithersburg, MD 20899
|
|
Telephone (301) 975-2934
|
|
|
|
Who we are
|
|
|
|
NCSL is one of five major science and engineering research
|
|
components of the National Institute of Standards and Technology
|
|
(NIST) of the Department of Commerce. We develop standards and
|
|
test methods, conduct research on computer and related
|
|
telecommunications systems, and provide technical assistance to
|
|
government and industry. We seek to overcome barriers to the
|
|
efficient use of computer systems, to the cost-effective exchange
|
|
of information, and to the protection of valuable information
|
|
resources in computer systems from threats of all kinds.
|
|
James H. Burrows, Director |