Subject: CFB padding q

From: Erron Criddle <[email-masked]>
Date: Fri, 28 Jul 2000 17:07:10 +0800

To all,

I have noticed that in the RFC, it says to use PKCS-1 padding for "Public 
Key Encrypted Session key Packets", however, I was wondering what padding 
to use for symmetrical encryption using OpenPGP's version of CFB?

I can't seem to find any references anywhere.

Cheers.

Regards

Erron Criddle
Comasp Ltd.
Level 2, 45 Stirling Hwy
NEDLANDS  WA  6009
Australia

Fax: 08 9386 9473
Tel: 08 9386 9534

http://www.comasp.com
[email-masked]

---

From: Edwin Woudt <[email-masked]>
Date: Fri, 28 Jul 2000 09:40:21 -0400

> I can't seem to find any references anywhere.

You do not need padding with CFB and OpenPGP CFB.
CFB turns a block cipher into a stream cipher.

Edwin

---

From: Erron Criddle <[email-masked]>
Date: Sat, 29 Jul 2000 11:51:37 +0800

Edwin,

>CFB turns a block cipher into a stream cipher.

I'm not sure what you're saying Edwin.

 From section 12.8, item 12, it says; "FRE is xored with the next BS octets."

 From this, I read that the CFB requires the plaintext to be a multiple of 
the blocksize of the symmetrical algorithm. My question is, then, how do 
you pad the plaintext to make it equal to the blocksize of the symmetrical 
algorithm?

For example, if we are using twofish that has a blocksize of 128 bits and 
we only have 96 bits of plaintext, what/how do I pad the plaintext up to 
128 bits?

Cheers.

Regards

Erron Criddle
Comasp Ltd.
Level 2, 45 Stirling Hwy
NEDLANDS  WA  6009
Australia

Fax: 08 9386 9473
Tel: 08 9386 9534

http://www.comasp.com
[email-masked]

---

From: "Jeroen C. van Gelderen" <[email-masked]>
Date: Sat, 29 Jul 2000 09:53:01 -0400

Erron Criddle wrote:
[...]
> the blocksize of the symmetrical algorithm. 

I guess that strictly speaking the RFC is not correct. It 
should read:

 if( BS < remainder ):
    FRE is xored with the next 'BS' octets.
    go to step 12
 else:
    FRE is xored with the next 'remainder' octets.
    exit

Have a look at Bruce Schneier's description of standard CFB
mode on page 200 of Applied Cryptography, 2nd Edition. The
only difference between openpgpCFB and CFB mode is that the
openpgpCFB sometimes does an encryption before the shift
register is full.

> we only have 96 bits of plaintext, what/how do I pad the plaintext up to

You prefix 18 bytes as per RFC 2440, giving you 30 bytes to
encrypt. Initialize the shift register with an IV of all 
zeros.

Encrypt the shift register, which gives you 16 bytes of key 
stream. Encrypt the first 16 bytes by xor-ing 'em with the 
16 bytes of key stream and shift the encrypted bytes into the 
shift register as you go. (The shift register holds 16 bytes
so all the old bytes fall off the left end.)

Now encrypt the shift register again, which gives you the 
next 16 bytes of key stream. Encrypt the next *two* bytes by 
xor-ing with the first two key stream bytes and shift the
encrypted two bytes into the shift register. (Only two bytes
fall off the left end.)

Encrypt the shift register again (yes, you just threw away
14 of your key stream bytes unused) giving you the next 16 
bytes of key stream. Encrypt next 12 bytes by xor-ing and 
throw away the unused 4 bytes of your keystream.

No padding needed. A working implementation can be found at:

http://anoncvs.cryptix.org/cgi-bin/cvsweb.cgi/projects/  \
   jce/src/cryptix.jce.provider.cipher/                  \
   ModeCFB.java?rev=1.2&content-type=text/x-cvsweb-markup

HTH,
Jeroen
-- 
Jeroen C. van Gelderen          o      _     _         _
[email-masked]  _o     /\_   _ \\o  (_)\__/o  (_)
                      _< \_   _>(_) (_)/<_    \_| \   _|/' \/
                     (_)>(_) (_)        (_)   (_)    (_)'  _\o_