How can two keys have the same KCV?

Question

I have two keys and they have the same KCV. How is this possible?

I have encrypted data with both keys and I have the same result. Both keys are the result of the derivation of the same IMK, one was done by a software and the other one was done by manual process.

Key A: 04 A4 49 F2 DC 46 D3 2A 3E A7 C7 E3 D3 A1 AB BA
Key B: 05 A4 49 F2 DC 46 D2 2A 3E A6 C6 E3 D2 A1 AB BB

Data: FF FF FF FF FF FF FF FF 11 11 11 11 11 11 11 11

Encrypted with key A: 22 17 FE 9C BC 6E DC F1 F2 D1 13 CA 70 74 54 AA
Encrypted with key B: 22 17 FE 9C BC 6E DC F1 F2 D1 13 CA 70 74 54 AA

Answer 1

You're using 2-key 3DES, right?

DES and 3DES has the property that the least significant bits of the key don't actually contribute to the encryption process; hence any two keys that differ only in the least significant bits will be equivalent (and hence have the same KCV value)

Your KeyA and KeyB has exactly this property.

Aso, is there a specific reason you're not using a more modern cipher, such as AES?

As a side note: normally, when we encrypt data, we typically stir in some uniqueness (such as an IV); hence encrypting the same data twice with the same key generally results in different ciphertexts. We do this for several reasons: to hide when we do encrypt the same thing twice, in order to disguise when we encrypt different but related plaintexts, and to foil some potential chosen plaintext attacks. You obviously don't do this; you use using 'ECB mode'? If so, well, that's rarely the correct option...

BTW: I suspect that KeyA was done by software, and KeyB was done manually. Here's why: every byte in KeyA has odd parity. The original DES documents suggest that the lsbit of each byte be set so that the byte has odd parity (both to catch some simple typo's (it was anticipated that humans would manually enter the keys), and also to justify the otherwise unused lsbits). I suspect that the software actually attempts to conform to this, and automatically adjusts the lsbits appropriately.