Allied Telesis AT-S63 - Manual (Page 701)

AT-S63 Management Software Menus Interface User’s Guide
Section VII: Management Security 701
algorithm and key. For a given input block of plaintext ECB always
produces the same block of ciphertext.
ˆ Cipher Block Chaining (CBC) is the most popular form of DES
encryption. CBC also operates on 64-bit blocks of data, but includes a
feedback step which chains consecutive blocks so that repetitive
plaintext data, such as ASCII blanks, does not yield identical
ciphertext. CBC also introduces a dependency between data blocks
which protects against fraudulent data insertion and replay attacks.
The feedback for the first block of data is provided by a 64-bit
Initialization Vector (IV). This is the DES mode used for the switch’s
data encryption process.
ˆ Cipher FeedBack (CFB) is an additive-stream-cipher method which
uses DES to generate a pseudo-random binary stream that is
combined with the plaintext to produce the ciphertext. The ciphertext is
then fed back to form a portion of the next DES input block.
ˆ Output FeedBack (OFB) combines the first IV DES algorithms with
the plaintext to form ciphertext. The ciphertext is then used as the next
IV.
The DES algorithm has been optimized to produce very high speed
hardware implementations, making it ideal for networks where high
throughput and low latency are essential.
Triple DES Encryption Algorithms
The Triple DES (3DES) encryption algorithm is a simple variant on the
DES CBC algorithm. The DES function is replaced by three rounds of that
function, an encryption followed by a decryption followed by an encryption.
This can be done by using either two DES keys (112-bit key) or three DES
keys (168-bit key).
The two-key algorithm encrypts the data with the first key, decrypts it with
the second key and then encrypts the data again with the first key. The
three-key algorithm uses a different key for each step. The three-key
algorithm is the most secure algorithm due to the long key length.
There are several modes in which Triple DES encryption can be
performed. The two most common modes are:
ˆ Inner CBC mode encrypts the entire packet in CBC mode three times
and requires three different initial is at ion vectors (IV’s).
ˆ Outer CBC mode triple encrypts each 8-byte block of a packet in CBC
mode three times and requires one IV.
Asymmetrical (Public Key) Encryption
Asymmetrical encryption algorithms use two keys—one for encryption and
one for decryption. The encryption key is called the public key because it
cannot be used to decrypt a message and therefore does not need be kept