4
$\begingroup$

While bruteforcing a ciphertext, I've found multiple keys which produce the same result.

Mode is DES with ECB and PKCS5 padding.
ciphertext is TXcmk8KwIPxTHR45zAIGJPEFYj6dsgVOGseZnMcedCOhl/Qp5a8Qig==
keys are used: { !*}, { +}, { *}

The tried keys are delimited by brackets {} and white space included.

The ciphertext will be decrypted as 'Does DES had multiple key for Enc/Dec?' with these keys..

tested at http://8gwifi.org/CipherFunctions.jsp and with pyDES(https://pypi.python.org/pypi/pyDes/)

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

The DES operation (both encryption and decryption) ignores the lsbit of each byte of the key. That is, if you flip any of the lsbits within the key, the operation remains the same. That's what is happening in the keys you tried: the ASCII code for space is 0x20, while the ASCII code for ! is 0x21; they differ only in the lsbit. So, if the key has a byte with the ASCII code for a space, you could replace it with a !, and it'll still be able to decrypt. Similarly, the ASCII code for * is 0x2a, while the ASCII code for + is 0x2b; also differs only in the lsbit.

In the original DES standard, the lsbit was supposed to be used as a parity check bit (with each byte always having odd parity). It was supposed to be a weak error check for manually entered keys. Nowadays, no one does this parity check, and so the lsbit gets ignored.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Nitpick: I still find some TripleDES implementations here and there that check parity on key, presumably like their earlier single-length versions, but I'd definitely support almost no one (and obviously not pyDES). $\endgroup$
    – dave_thompson_085
    Dec 3, 2015 at 21:48
  • 2
    $\begingroup$ I suspect the parity check thing to really be an excuse for the 56-bit rather than 64-bit key size, intended to make brute force attack easier; in support of that, a partially declassified NSA document states: NSA worked closely with IBM to strengthen the algorithm against all except brute force attacks and to strengthen substitution tables, called S-boxes. Conversely, NSA tried to convince IBM to reduce the length of the key from 64 to 48 bits. Ultimately, they compromised on a 56-bit key. See this for reference. $\endgroup$
    – fgrieu ♦
    Dec 3, 2015 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.