Track C · Cryptography

You will be able to

• Explain block size and key length
• Build two-key and three-key TDES keys
• Choose and recognise ECB, CBC, CFB and OFB
• Apply ISO 9797 padding methods 1 and 2, PKCS #7 and ISO 7816-4
• Tell why ECB is acceptable for single-block keys and PIN blocks but not for data

The lesson

1. Why it matters
2. The concept
3. Step by step: CBC encryption
4. In the real world
5. Common mistakes
6. What to test

In the module

• The lesson, with diagrams, common mistakes and what to test
• A worked example you can change: CBC encryption, block by block
• Practice: 5 kinds of generated exercise, each with a step-by-step solution
• A quiz of 9 questions

Key terms

AES (Advanced Encryption Standard)

The modern block cipher with 128-bit blocks and 128-, 192- or 256-bit keys. It replaces triple DES in new payment standards.

Block cipher

A cipher that encrypts fixed-size blocks: 8 bytes for DES and triple DES, 16 bytes for AES.

CBC (Cipher block chaining)

The mode that XORs each block with the previous ciphertext before encrypting it. It needs an IV and is the basis of CBC-MAC.

DES (Data Encryption Standard)

The 1970s block cipher with 64-bit blocks and a 56-bit key (stored in 8 bytes with parity). Too weak alone today; it survives inside triple DES.

Double-length key

A 16-byte triple DES key (K1 K2, with K3 = K1).

ECB (Electronic codebook)

The mode that encrypts each block on its own. Fine for single blocks such as PIN blocks and keys; equal blocks give equal ciphertext.

Initialisation vector (IV)

The starting block for CBC and similar modes. In payment MACs it is usually zero.

Padding

Bytes added to fill the last block. ISO 9797-1 method 1 adds zeros; method 2 adds 80 then zeros; PKCS#7 adds bytes equal to the pad length.

Symmetric key

A key used both to encrypt and decrypt, shared by both sides. DES, triple DES and AES are symmetric.

Triple DES (TDES, TDEA, 3DES)

DES applied three times (encrypt-decrypt-encrypt) with two or three keys. Still common in payments, being replaced by AES.

Triple-length key

A 24-byte triple DES key with three independent parts.

Weak key

A DES key for which encryption and decryption are the same, such as all 01 bytes. A triple DES key with K1 = K2 is no stronger than single DES.

Tools for this module: DES / 3DESAES

Read the opening of the lesson →