0
$\begingroup$

I have a device, HASP, which has functionality to encrypt 8 byte data using 3DES in ECB mode, with three different keys, I am interested how secure is this? I know it might not be most secure, but how much? Attacker may query HASP to encrypt something, and try to bruteforce keys from this?

Idea is I thought if I need CBC in my application, I will query the HASP as many times as needed and perform chaining of blocks on PC side.

Or is it better to tell HASP producers to implement encryption of single block however in CBC mode?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

If double key DES is used then it is not very secure (63-80 bit security). If tree separate DES keys are used then you'd still have about 112 bits of security.

That's still not that much, but it would probably not be commercially viable to retrieve the keys of a sentinel using brute force as hacking the application itself is probably a lot more cost effective.

How secure the mode of operation is depends strongly on how the device is used. I'd strongly advice against using the device for anything other than (software protection and) licensing.

These kind of devices often use deprecated encryption that are just barely able to perform the task they've been designed for. When you are encrypting multiple blocks you may already go outside this framework.

That said, in principle the block cipher protects the key whatever mode is used. You'd still not be able to retrieve the key whichever mode you are using - outside brute force and attacking other locations that contain the key or key derivation information of course.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Thanks but like I said if I want to encrypt some data using it, I will perform chaining like in CBC mode on the PC side, is that what you mean? (HASP will only encrypt in ECB mode, but chaining will be done by my computer). PS. My old HASP was using only DES in similar way. PPS I need the device to encrypt or authenticate some data. That is why we moved from DES to 3DES $\endgroup$
    – user31507
    Commented Feb 19, 2016 at 12:06
  • $\begingroup$ Thats possible of course. You'd have to send each block separately though. $\endgroup$
    – Maarten Bodewes ♦
    Commented Feb 19, 2016 at 12:08
  • $\begingroup$ Any reference for a method leaving double-key 3DES with 63-80 bit security? AFAIK, the best mildly credible attacks require $2^{88}$ RAM memory accesses and $2^{90}$ DES, and so much RAM that they are arguably still impractical. $\endgroup$
    – fgrieu ♦
    Commented Feb 19, 2016 at 13:08
  • 2
    $\begingroup$ "112 bits of security... that's still not that much..." I would have to disagree; if we assume that the attacker had 1 trillion cores (processors, FPGA elements, whatever), each of which can do 100 billion calculations per second (100 per nanosecond), then we're still talking over 1000 years to perform that work effort. I rather suspect the NSA would be hardpressed to assemble that many resources $\endgroup$
    – poncho
    Commented Feb 19, 2016 at 15:56
  • $\begingroup$ I've been a bit cautious here and kept to the best attacks that are currently known. Yes 112 bits is still a lot, but AES is at least 128 bits and doesn't have as many issues... $\endgroup$
    – Maarten Bodewes ♦
    Commented Feb 19, 2016 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.