- Sanjoy Kumer Dev
- February 18, 2020
Cryptography With the DES Algorithm
Cryptography With the DES Algorithm
Nowadays, information security is the main concern on the Internet. With web data continuously flowing from one end to another, to ensure data security, there are many procedures that must be implemented. Different organizations are working to find a more secure way to protect data.
There are also some key terms when it comes to information security — like confidentiality, integrity, availability, etc. Confidentiality means that only authorized users can gain access to sensitive data. Integrity confirms that data has not been modified by any mid-level person. Additionally, this means that the data reached the other user without changes or a breach. Lastly, availability means that data is available for any authorized user. There are many procedures that confirm data confidentiality, integrity, and availability. Almost all procedures use some type of encryption/decryption algorithm to keep data secure from middle attacks. And there are two kinds of security algorithms: symmetric algorithms (use the same secret key to encrypt/decrypt data) and asymmetric algorithms (use different secret keys to encrypt/decrypt data). The main goal of this article is to describe DES algorithm and how it secures data.
DES Algorithm
The DES algorithm is the most popular security algorithm. It's a symmetric algorithm, which means that the same keys are used to encrypt/decrypt sensitive data. Key length is 8 byte (64 bit). So, to encrypt/decrypt data, the DES algorithm uses an 8-byte key, but 1 byte (8 bit) for parity checking. It's a block cipher algorithm — that's why the data block size of DES algorithm is 64 bit. To encrypt/decrypt data, the DES algorithm uses the Feistel structure. So, it uses some round to encrypt/decrypt data. Though data block size is 64 bit, the number of rounds will be 16 rounds. So, it will use different subkeys for each round. so the number of subkeys will be 16 subkeys. For more info on the process of finding subkeys, you can learn more here. However, for this tutorial, we will be skipping this part.
Modes of Operation
There are different modes of operation when using the DES algorithm. If each 64 bit is encrypted or decrypted independently, then this mode is ECB.
If each 64-bit data is dependent on the previous one, then this mode is called CBC or CFB mode.
Here, in CBC mode, we can see that there is a new term called the Initial Vector (IV), which will be the same as the data block size. The data block will be XOR with IV and then encrypted with the key. Then, the output ciphertext uses the IV of the next block. The reverse process is used during decryption. So, we can say that the encryption of the current block is dependent on the encryption of the previous data block. Therefore, it's more secure than that of ECB.
In CFB mode, the intial vector is encrypted with a key, and then, the data block will XOR with encrypted output. Ciphertext, again, goes to it as an input for encryption function and again XOR with next plaintext block and so on.
Terms to Memorize
- The DES algorithm is a block cipher algorithm
- The data block size of the DES algorithm is 64 bit (8 bytes)
- Key size is 64 bit (8 bytes), but 1 byte is used for parity, so the actual key size is 56 bit
- Without ECB, for others, IV is mandatory
- There are different types of padding algorithms. If you use NoPadding, the data size should be a multiple of 8.
Implementation
For implementation, we have to use a security provider. In this case, we will use the bouncycastle provider. We can use a secret key as a plaintext or byte array that will be defined by us, or we can generate a random secret key using the
KeyGenerator from javax.crypto package. We will see both methods. So now, we have to add a provider.
And for encryption and decryption, we will use the following methods. I have created an interface to declare these methods.
Here, the first two methods will be used for randomly generated secret keys, and the next two methods will be used for the user-provided secret key. Implementation of this interface is demonstrated below:
Here, we can see that we are not using IV for ECB. We created a cipher instance and init this with DES parameters. For encryption, we are using the Cipher mode ENCRYPT_MODE, and for decrypt, we are using DECRYPT_MODE. Other parameters remain the same for both encryption and decryption. The key should be the same for encryption and decryption.
Now, we will call these methods from our main application class.
Here, we can see that we added the bouncy castle provider first and then created a random secret key. Also we are using a user-provided secret key as the byte format. This is shown below:
Then, we are calling interface methods and getting the expected output. Yes, we are providing the algorithm, ciphermode, and padding mechanism with the
getAlgo() method. If we run this code exactly as given in this article, we can get this result for the inputsanjoysystem:Test With Different Combination
Now, we will check the DES algorithm with a different combination. For example, we will select the ECB mode as a cipher mode. We have to change the following code:
Now, if we run this code, we will get the following result.
Now, if we change the padding mechanism to NoPadding, let's check what the result will be. Just change this for method callings:
Now, I am getting this result:
Yes, this is correct because the data block is not a multiple of 8. The length of the sanjoysystem is 12. There is no padding mechanism being used now. That's why the data remains the same, but if we use another padding mechanism, then the mechanism will add padding with actual data. And the input of the encryption data will be multiplied by 8. And during decryption, this padded data will be removed. Try this with
sanjoysy; we will get the correct result.
Now, we will check this by changing the key size. We will change the key size to 65 (which is more than 8 bytes, and we can define the key size between 56 to 64 for the DES key). The key generator only accepts key sizes 56 to 64 bit. Then, it will generate an 8-byte size key for the Cipher. Change on following
keySize to 65:
We will get the following output because
KeyGenerator cannot generate a key for keySize smaller than 56 bit or more than 64 bit.
Or, we can change the user-defined key (
baseKey).
We will get the following exception. Because the DES key should be 8 bytes, Cipher — for the DES algorithm only — accepts the 8-byte key. With a random key size of 56,
KeyGenerator internally generates 8-byte size key and then supplies to Cipher.
However, you can try more combinations than just those defined above.
The entire source code from this article is available here.
Happy encrypting!