RFC 2420 (rfc2420) - Page 2 of 8

The PPP Triple-DES Encryption Protocol (3DESE)

RFC 2420               PPP Triple-DES Encryption          September 1998


1. Introduction

   The purpose of encrypting packets exchanged between two PPP
   implementations is to attempt to insure the privacy of communication
   conducted via the two implementations. There exists a large variety
   of encryption algorithms, where one is the DES algorithm. The DES
   encryption algorithm is a well studied, understood and widely
   implemented encryption algorithm.  Triple-DES means that this
   algorithm is applied three times on the data to be encrypted before
   it is sent over the line. The variant used is the DES-EDE3-CBC, which
   is described in more detail in the text. It was also chosen to be
   applied in the security section of IP [5].

   This document shows how to send via the Triple-DES algorithm
   encrypted packets over a point-to-point-link. It lies in the context
   of the generic PPP Encryption Control Protocol [2].

   Because of the use of the CBC-mode a sequence number is provided to
   ensure the right order of transmitted packets. So lost packets can be
   detected.

   The padding section reflects the result of the discussion on this
   topic on the ppp mailing list.

   In this document, the key words "MUST", "SHOULD", and "recommended"
   are to be interpreted as described in [3].

1.1  Algorithm

   The DES-EDE3-CBC algorithm is a simple variant of the DES-CBC
   algorithm.  In DES-EDE3-CBC, an Initialization Vector (IV) is XOR'd
   with the first 64-bit (8 octet) plaintext block (P1).  The keyed DES
   function is iterated three times, an encryption (E) followed by a
   decryption (D) followed by an encryption (E), and generates the
   ciphertext (C1) for the block. Each iteration uses an independent
   key: k1, k2 and k3.

   For successive blocks, the previous ciphertext block is XOR'd with
   the current 8-octet plaintext block (Pi). The keyed DES-EDE3
   encryption function generates the ciphertext (Ci) for that block.











Kummert                     Standards Track