2
$\begingroup$

I was experimenting around with DES and decided to implement an IV (Initialization Vector) for it. I noticed that in DES, which is 56 bits and 8 parity bits, the IV would be 8 bytes in length. Does that mean that if I were to program DES but using a 128-bit key, the IV would be 16 bytes in length instead of 8 bytes in length? (Cryptography Rookie here)

$\endgroup$
3
$\begingroup$

The IV is part of the block cipher mode of operation, not of the block cipher itself. The block cipher simply doesn't have any input for an IV, it just takes an input block and produces an output block using a key. So you cannot implement an IV for DES itself.

The block size is however usually of influence to the mode of operation. Even then, the IV may still be different from the block size for some modes. To make it a bit more complex, some modes of operation such as CTR mode and GCM mode (for 128 bit block ciphers such as AES) may have different options to implement an IV or nonce.

The DES block size is always 64 bits, regardless of the key size, just like 128 bits is always the block size of AES. The key size is not (necessarily) of any influence to the block size, although it may be advantageous for the key size to be a multiple of the block size in case keys need to be encrypted by other keys (wrapping a key by another "wrapping" key).

For CBC mode, which is often explained as one of the first modes to starting cryptographers, the IV needs to be the full block size. Furthermore, for CBC the IV needs to be indistinguishable from random to any adversary. That means that the IV is always set to 8 bytes or 64 bits.


Note that DES itself only supports 64 bit keys, of which 8 bits are parity bits, so an effective key size of 56 bits. Triple DES or DES-EDE may use two keys. It then uses key A for the first encryption, key B for DES in decryption mode and keyA again for encryption, so an ABA-key.

However, as these block encrypts / decrypts are simply stacked on top of each other, the block size stays the same: 64 bits. Therefore, for CBC, the IV does need to be 64 bits / 8 bytes as well.

|improve this answer|||||
$\endgroup$
3
$\begingroup$

Actually, contrary to what kelalaka says, the length (and existence) of the IV depends on the exact mode of operation; some modes of operation take an IV whose length differs from the block size, and there are modes of operation (other than ECB) which don't take an IV at all.

Now, with DES, by far the most common mode of operation is CBC, which does take a 64 bit (block size) IV. Nowadays, there is little reason to use any other mode of operation (then again, there is little reason to use DES at all), so kelalaka's answer can be taken as 'practically correct' (and when he talks about DES key sizes, he is entirely correct). However, it may become misleading if you try to leverage that into the use of (for example) AES, which uses a considerably wider range of modes.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ I would argue that there are several reasons not to use CBC regardless of the block cipher used, including the wastefulness of padding, the risk of padding oracle attacks, the need for unpredictable IVs, the inability to parallelize encryption and the need to implement both directions of the block cipher. Some of those can be worked around by modifications to CBC, but some are fundamental. Using e.g. CTR mode avoids all of these problems, at the cost of a somewhat increased vulnerability to IV/nonce reuse bugs. SIV (or GCM-SIV) mode fixes that issue, and provides message authentication too. $\endgroup$ – Ilmari Karonen Jan 6 at 6:19
  • $\begingroup$ … That said, I fully agree with you that the issues with CBC mode are all of relatively minor importance compared to the insufficient key length of DES (and the poor performance and still limited security of 3DES compared to modern cipher like AES). $\endgroup$ – Ilmari Karonen Jan 6 at 6:22
3
$\begingroup$

DES is an (8-byte) 64-block cipher with 56-bit active key and 8-bit parity bit (which makes total 64), and the parity bits generally discarded, i.e. not checked.

When using a block cipher mode of operation you need an IV (or Nonce), except the insecure ECB mode. The IV size is determined by the mode of operation and in archaic modes (CBC, CTR, OFC, CFB) it is as same as the block size of the cipher, i.e 64-bit for DES. For some mode, like the IV/Nonce of GCM, it varies from the block size. GCM is not designed for DES.

There are also double and triple encryption of DES

  • 2DES which uses 112-bit key but provides around 57-bit security. It still has a 64-bit block size.
  • 3DES with variants two key and three key (EDE), in all, you still have 64-bit block cipher.

In short, in the archaic modes, the IV size is determined by the block size of the block cipher. You can use shorter IV but one needs to fill it to use properly, like in x-oring in CBC mode.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ @poncho is right. I've updated it. There are modes of operations that use IV sizes different than the block size. Like GCM. $\endgroup$ – kelalaka Jan 6 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.