RSA Security 5.2.2 Initialization Vectors and Salts, DES Weak Keys, 3DES Weak and Semi-Weak Keys

Security Considerations

Initialization Vectors and Salts

Although IVs and salts are not secret information, it is still a good idea to use random values. If a salt is not random, an attacker will have much fewer precomputations to make in generating keys from possible password/salt combinations.

An IV should also be used for only one message. Using the same IV with the same key on two separate messages may provide an attacker with useful information.

DES Weak Keys

Researchers over the years have found that some DES keys are more susceptible to attack than others. Some of these keys are known as “weak”; others, when used in pairs, are called “semi-weak.” Using a weak key or a semi-weak pair may not necessarily pose a security risk; it could depend on the mode of DES. However, it is simply easier to avoid these keys (listed in Table 3-3) altogether.

Table 3-3DES Weak and Semi-Weak Keys

0101010101010101 FEFEFEFEFEFEFEFE 1F1F1F1F1F1F1F1F E0E0E0E0E0E0E0E0 01FE01FE01FE01FE 1FE01FE00EF10EF1 01E001E001F101F1 1FFE1FFE0EFE0EFE 011F011F010E010E E0FEE0FEF1FEF1FE FE01FE01FE01FE01 E01FE01FF10EF10E E001E001F101F101 FE1FFE1FFE0EFE0E 1F011F010E010E01 FEE0FEE0FEF1FEF1

9 4 R S A B S A F E C r y p t o - C D e v e l o p e r ’s G u i d e