Re: [TLS] Question about TLS_RSA_WITH_3DES_EDE_CBC_SHAx

[Marsh Ray <[e-mail]>]

On 07/01/2011 02:58 PM, Martin Rex wrote:
> Martin Rex wrote:
>>
>> It is a probabilistic 3-key DES-EDE (encryption-decryption-encryption),
>> meaning that the algotihm is treated as a block cipher with a
>> keysize of 24 octets, blocksize of 8 octets and cbc-ivsize of 8 octets
>> (distinct keying material for direction client->server and server->client).
>>
>> The first 8x7 bits (sans parity) differ from the final 8x7 bits of the key
>> on probabilistic grounds, there are no algorithmic provisions to ensure
>> this, and neither are there algorithmic provisions to ensure that
>> none of the 3 single-DES subkeys are weak DES keys.
>
> Thinking about it, checking whether the first 8x7 bits differ from
> the middle 8x7 bits, and that the middle 8x7 bits differ from the final
> 8x7 bits might have be even more important, because either one being
> equal would cause the 3DES-EDE operation to fold into a single-DES
> operation.  :-o

Doesn't the principle of full key space utilization require us to admit 
that possibility?

As an analogy, TLS uses "separate" encryption keys and MAC secrets in 
the C->S and S->C directions. But it doesn't require an implementation 
to actually verify that they are different. TLS doesn't require checks 
against weak DES keys either which seems even a bit more likely to occur.

One could imagine many ways such a check could go wrong, possibly 
revealing information about the secret material in the process.

- Marsh