des

• Details
• Compatibility
• Download

Description

des - encrypt or decrypt data using Data Encryption Standard

des ( -e | -E ) | ( -d | -D ) | ( -[cC][ckname] ) | [
-b3hfs ] [ -k key ] ] [ -u[uuname] [ input-file [ output-
file ] ]

DESCRIPTION
des encrypts and decrypts data using the Data Encryption
Standard algorithm. One of -e, -E (for encrypt) or -d, -D
(for decrypt) must be specified. It is also possible to
use -c or -C in conjunction or instead of the a
encrypt/decrypt option to generate a 16 character hexadec-
imal checksum, generated via the des_cbc_cksum.

Two standard encryption modes are supported by the des
program, Cipher Block Chaining (the default) and Elec-
tronic Code Book (specified with -b ).

The key used for the DES algorithm is obtained by prompt-
ing the user unless the `-k key' option is given. If the
key is an argument to the des command, it is potentially
visible to users executing ps(1) or a derivative. To min-
imise this possibility, des takes care to destroy the key
argument immediately upon entry. If your shell keeps a
history file be careful to make sure it is not world read-
able.

Since this program attempts to maintain compatability with
sunOS's des(1) command, there are 2 different methods used
to convert the user supplied key to a des key. Whenever
and one or more of -E, -D, -C or -3 options are used, the
key conversion procedure will not be compatible with the
sunOS des(1) version but will use all the user supplied
character to generate the des key. des command reads from
standard input unless input-file is specified and writes
to standard output unless output-file is given.

OPTIONS
-b Select ECB (eight bytes at a time) encryption mode.

-3 Encrypt using triple encryption. By default triple
cbc encryption is used but if the -b option is used
then triple ecb encryption is performed. If the
key is less than 8 characters long, the flag has no
effect.

-e Encrypt data using an 8 byte key in a manner com-
patible with sunOS des(1).

-E Encrypt data using a key of nearly unlimited length
(1024 bytes). This will product a more secure



1





DES(1) DES(1)


encryption.

-d Decrypt data that was encrypted with the -e option.

-D Decrypt data that was encrypted with the -E option.

-c Generate a 16 character hexadecimal cbc checksum
and output this to stderr. If a filename was spec-
ified after the -c option, the checksum is output
to that file. The checksum is generated using a
key generated in a sunOS compatible manner.

-C A cbc checksum is generated in the same manner as
described for the -c option but the DES key is gen-
erated in the same manner as used for the -E and -D
options

-f Does nothing - allowed for compatibility with sunOS
des(1) command.

-s Does nothing - allowed for compatibility with sunOS
des(1) command.

-k key Use the encryption key specified.

-h The key is assumed to be a 16 character hexadecimal
number. If the -3 option is used the key is
assumed to be a 32 character hexadecimal number.

-u This flag is used to read and write uuencoded
files. If decrypting, the input file is assumed to
contain uuencoded, DES encrypted data. If encrypt-
ing, the characters following the -u are used as
the name of the uuencoded file to embed in the
begin line of the uuencoded output. If there is no
name specified after the -u, the name text.des will
be embedded in the header.

SEE ALSO
ps (1) des_crypt(3)

BUGS
The problem with using the -e option is the short key
length. It would be better to use a real 56-bit key
rather than an ASCII-based 56-bit pattern. Knowing that
the key was derived from ASCII radically reduces the time
necessary for a brute-force cryptographic attack. My
attempt to remove this problem is to add an alternative
text-key to DES-key function. This alternative function
(accessed via -E, -D, -S and -3 ) uses DES to help gener-
ate the key.

Be carefully when using the -u option. Doing des -ud
<filename> will not decrypt filename (the -u option will



2





DES(1) DES(1)


gobble the d option).

The VMS operating system operates in a world where files
are always a multiple of 512 bytes. This causes problems
when encrypted data is send from unix to VMS since a 88
byte file will suddenly be padded with 424 null bytes. To
get around this problem, use the -u option to uuencode the
data before it is send to the VMS system.

AUTHOR
Eric Young (eay@mincom.oz.au or eay@psych.psy.uq.oz.au)

Tags

encryptencryptiondesdata encryption standard

Comments

No comments have been submitted against this application. Be the first!

You must be signed-in to post comments in the SCL. Not registered? Join our community.