silk.crypto.des.

When to use#

Use TripleDes only when an old format or protocol names it, such as des-ede3-cbc in OpenSSL or Node.js. Its 8-byte block wears out after a few gigabytes under one key, and NIST has withdrawn it for new encryption. Run it in a mode from silk.crypto.block_cipher, such as Cbc<TripleDes>. For new designs, use silk.crypto.aes_gcm.

Details#

A 24-byte key holds three DES keys K1, K2, K3 (des-ede3); a 16-byte key holds K1 and K2 and uses K1 again as K3 (des-ede). A block is encrypted with K1, decrypted with K2, and encrypted with K3. The parity bit of each key byte is ignored, as in OpenSSL. TripleDes conforms to BlockCipher with a block of 8 bytes. Nothing allocates.

Gotchas#

The S-boxes are table lookups, so the time of a block can depend on the key and the data through the cache. Keys with K1 = K2 or K2 = K3 reduce to single DES and are accepted, as OpenSSL does. The value holds key material and is not erased when it is dropped.

Examples#

Encrypt one block#

import silk.crypto.block_cipher { BlockCipher, BlockCipherError }
import silk.crypto.des { TripleDes }
import silk.core.result { Result }

pub fn main() -> i32 {
  // With K1 = K2 = K3, Triple DES is single DES: the classic 133457799BBCDFF1 example.
  let key: [u8; 24] = [
    0x13, 0x34, 0x57, 0x79, 0x9b, 0xbc, 0xdf, 0xf1, 0x13, 0x34, 0x57, 0x79, 0x9b, 0xbc, 0xdf, 0xf1,
    0x13, 0x34, 0x57, 0x79, 0x9b, 0xbc, 0xdf, 0xf1,
  ]
  let cipher = match TripleDes.make(&key) {
    Result<TripleDes, BlockCipherError>.Success { value } => move value
    Result<TripleDes, BlockCipherError>.Failure { error: _ } => {
      return 1
    }
  }
  let mut block: [u8; 16] = [0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0, 0, 0, 0, 0, 0, 0, 0]
  cipher.encryptBlock(&mut block)
  if block[0] != 0x85 || block[1] != 0xe8 || block[7] != 0x05 {
    return 1
  }
  return 0
}

Import as TripleDes with import silk.crypto.des { TripleDes }.

Public declarations: 1.

TripleDes#

pub struct TripleDes

A Triple DES (EDE) key schedule.

Details#

Make one with TripleDes.make and run it in a mode from silk.crypto.block_cipher, or call encryptBlock and decryptBlock of BlockCipher, which use the first 8 bytes of the array.

Implementation TripleDes#

impl TripleDes

Associated function make#

pub fn make(key: &[u8]) -> Result<TripleDes, BlockCipherError>

Returns the key schedule of key: 24 bytes for K1, K2, K3, or 16 bytes for K1, K2 with K3 = K1.

Errors#

• InvalidKeyLength if key is not 16 or 24 bytes.

Implementation BlockCipher for TripleDes#

impl BlockCipher for TripleDes

Operation blockLength#

fn blockLength(self: &Self) -> usize

Returns 8.

Operation encryptBlock#

fn encryptBlock(self: &Self, block: &mut [u8; 16]) -> ()

Encrypts the first 8 bytes of block in place.

Operation decryptBlock#

fn decryptBlock(self: &Self, block: &mut [u8; 16]) -> ()

Decrypts the first 8 bytes of block in place.

Category: Cryptography.

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, wasm32-wasip1, wasm32-wasip2, x86_64-pc-windows-msvc, wasm64-unknown-unknown.