1
$\begingroup$

I have two keys and they have the same KCV. How is this possible?

I have encrypted data with both keys and I have the same result. Both keys are the result of the derivation of the same IMK, one was done by a software and the other one was done by manual process.

Key A: 04 A4 49 F2 DC 46 D3 2A 3E A7 C7 E3 D3 A1 AB BA
Key B: 05 A4 49 F2 DC 46 D2 2A 3E A6 C6 E3 D2 A1 AB BB

Data: FF FF FF FF FF FF FF FF 11 11 11 11 11 11 11 11

Encrypted with key A: 22 17 FE 9C BC 6E DC F1 F2 D1 13 CA 70 74 54 AA
Encrypted with key B: 22 17 FE 9C BC 6E DC F1 F2 D1 13 CA 70 74 54 AA
$\endgroup$
2
  • $\begingroup$ Possible duplicate of Will two KEK's provide the same KCV or should these be different? $\endgroup$ Aug 24, 2018 at 11:29
  • $\begingroup$ I think that that question was not that good and that my answer there should not count as a dupe of this question. We could possibly merge it, but for now it would be too tricky to find the answer somewhere in the middle of the second section. $\endgroup$
    – Maarten Bodewes
    Aug 25, 2018 at 0:33

1 Answer 1

3
$\begingroup$

You're using 2-key 3DES, right?

DES and 3DES has the property that the least significant bits of the key don't actually contribute to the encryption process; hence any two keys that differ only in the least significant bits will be equivalent (and hence have the same KCV value)

Your KeyA and KeyB has exactly this property.

Aso, is there a specific reason you're not using a more modern cipher, such as AES?

As a side note: normally, when we encrypt data, we typically stir in some uniqueness (such as an IV); hence encrypting the same data twice with the same key generally results in different ciphertexts. We do this for several reasons: to hide when we do encrypt the same thing twice, in order to disguise when we encrypt different but related plaintexts, and to foil some potential chosen plaintext attacks. You obviously don't do this; you use using 'ECB mode'? If so, well, that's rarely the correct option...

BTW: I suspect that KeyA was done by software, and KeyB was done manually. Here's why: every byte in KeyA has odd parity. The original DES documents suggest that the lsbit of each byte be set so that the byte has odd parity (both to catch some simple typo's (it was anticipated that humans would manually enter the keys), and also to justify the otherwise unused lsbits). I suspect that the software actually attempts to conform to this, and automatically adjusts the lsbits appropriately.

$\endgroup$
1
  • $\begingroup$ Hi, Thanks for the answer, it was really worth and solve my doubt. Regarding the questions that you did me, I am using the DES3 as you said. Also, the Key A was generated by software and the Key B was done by me as you said. Finally, I am using the 3DES algorithm instead of AES because is is defined in the standard of the application that I am using. $\endgroup$
    – againzz
    Aug 25, 2018 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.