S 2.164 Selection of a suitable cryptographic procedure

Initiation responsibility: IT Security Officer

Implementation responsibility: IT Security Officer

The selection of a cryptographic procedure can be divided into the following two tasks:

• selection of the cryptographic algorithm and
• selection of a technical implementation.

Before users commit to using certain procedures, they should have an exact idea of the requirements they need to place on the confidentiality and authenticity of the data processed at every point of the informationprocessing system.

Selection of cryptographic algorithms

When selecting cryptographic algorithms, it is necessary to clarify what type of cryptographic procedure is needed, i.e. a symmetric, asymmetric, or hybrid procedure, and then to select suitable algorithms, i.e. one offering a mechanism of the right strength.

Encryption methods

• Symmetric encryption: The advantages and disadvantages of symmetric procedures are described in safeguard S 3.23 Introduction to basic cryptographic terms. Suitable algorithms include, for example, AES-128, AES-192, AES-256, SERPENT, with the key length being at least 128 bits.
• Asymmetric encryption: The advantages and disadvantages of asymmetric procedures are described in safeguard S 3.23 Introduction to basic cryptographic terms. Suitable algorithms include, for example, RSA or encryption procedures based on elliptic curves (see below for the appropriate key length).

Authentication procedure

• Message authentication
  Various techniques can be used for message authentication, for example a Message Authentication Code (MAC) or a digital signature method. The use of MACs offers advantages when extremely high data transfer rates are required (or there is only low computing power available) and the risk of disclosing the keys is very low at both ends. The use of a digital signature method offers advantages when the risk of disclosing the (signature) key is significantly higher on one end than on the other end and is generally recommended when binding services are required. It should again be noted that an infrastructure of trustworthy third parties must be available for the binding service.
  
  The best-known MAC algorithm is the encryption of a message using DES or another block cipher method in the CBC or CFB mode.
  
  In this case, the last block encrypted is appended to the message as the MAC. Variants of this type of algorithm are specified in the ISO 8731-1 and ISO 9797 standards.
  
  Other proposals for block cipher-based MAC constructions have been offered recently, and the C-MAC procedure (previously called OMAC1) standardized by the American NIST has become a generally accepted standard MAC procedure. In addition, there are dedicated MAC constructions based on hash functions. The most notable procedure of this type is the widely accepted and widely used HMAC from RFC 2104.
  
  Suitable algorithms for digital signatures include, for example, RSA, DSA (Digital Signature Algorithm), and the DSA variants based on elliptic curves, for example ISO/IEC 15946-2, IEEE Standard P1363, Section 5.3.3 ("DSA version"). More detailed information can be found in the "Algorithms catalogue" published annually by the Federal Network Agency (see below).
  
  The electronic signatures, as defined in the EU directives and statutory provisions of Germany, must be differentiated from the digital signatures mentioned here. The extent to which the digital signatures mentioned here may be deemed electronic signatures within the meaning of these legal standards must be reviewed separately and is not the subject of this safeguard.
• Authentication of users or components
  One simple method of authentication is to query for a password. If the passwords are transmitted unencrypted over a network, though, it is relatively easy to read the passwords. For this reason, better methods should be used for authentication. Suitable methods include the following, for example:
• • One-time passwords (see also S 5.34 Use of one time passwords), which can be generated with software or hardware support. Preference should be given to hardware-based authentication methods in this case, because they require less organisational work and offer greater security.
  • Authentication by means of PAP, or preferably CHAP, which are used in conjunction with the point-to-point protocol (see also S 5.50 Authentication via PAP/CHAP).
  • Authentication by means of CLIP/COLP, which is used for communication via ISDN (see also S 5.48 Authentication via CLIP/COLP).
  • One other familiar procedure is the authentication protocol Kerberos, which was developed at MIT (Massachusetts Institute of Technology). It is used in networks for the mutual authentication of users/clients and servers. The central authority in Kerberos is the ticket-granting server, which issues tickets by means of which clients and servers can authenticate themselves to each other. Once authentication has been completed, users can request session keys for a wide variety of services with the aid of these tickets.

Hash methods

Great progress has been made recently in the cryptographic analysis of hash functions. Due to the progress made, SHA-1 is not recommended unconditionally any more for all applications, but it is still possible to use HMAC as its use is still not considered critical.

Suitable algorithms include, in particular, the newer SHA-2 versions (SHA-224, SHA-256, SHA-384, SHA-512), which are designed for applications with higher collision resistance requirements, in addition to RIPEMD-160 (for lower collision resistance requirements, i.e. with about 80 bits of complexity).

The MD5 hash algorithm is outdated and has known weaknesses that can be demonstrated today based on practical examples. For these reasons, MD5 should not be used any more.

Selection criteria

The strength of the mechanism / key length

One of the most important criteria for the selection of a cryptographic procedure is the strength of its mechanism. For symmetric procedures, the key length in particular should be adequately long. The longer the key length of the key used for a cryptographic procedure, the longer it takes to calculate the key (for example using a brute force attack). On the other hand, the procedures are slower when using longer keys, which means it is necessary to decide which key length to use by weighing the benefits obtained using a longer key against the lowered performance aspects. A general rule of thumb for a procedure considered good today (Triple DES, IDEA, RC5, AES ...) for an application with average protection requirements is that the key used should be at least 100 bits long. When using block ciphers, larger, structured amounts of data should not be encrypted in the ECB mode. The CBC or the CFB mode should be used instead. For this reason, at least one of these operating modes should be implemented.

When using asymmetric procedures, the strength of the mechanism should be selected in such a way that the underlying mathematical problems require an unreasonably large amount of computing time to solve or are practically impossible to solve (for this reason, the strength of the mechanism to be selected depends on the current state of development of the algorithm and computing technology). At the current time, you can assume you are on the safe side when using the following:

• module lengths of 1536 bits for RSA and/or
• subgroup orders of at least 200 bits in size for ElGamal procedures applied to a suitable elliptic

curve. Well-known experts estimate that 1024-bit RSA moduli can be factored after approximately 280 operations, and the number of operations required by the best generic algorithms to solve the discrete logarithm problem in a group is in the order of 160 bits, which is in about the same magnitude. Since the time required to perform 280 operations is slowly coming in the range of technical feasibility due to the progress in computer technology, algorithms with 80-bit security levels (e.g. 1024-bit RSA) currently in use should not be used any more for new developments and should be replaced entirely in the long term.

For security applications that will be used in the long term, 2048-bit RSA moduli or subgroup orders of at least 224 bits should be used. Examples of suitable elliptic curves can be found on the internet at www.ecc-brainpool.org.

"Unknown" algorithms should not be used, meaning algorithms that have been published, intensively examined by a wide range of experts, and in which there are currently no known security vulnerabilities should be used instead. Manufacturers frequently offer security products using new algorithms that are supposedly "much more secure and even faster" than other algorithms. However, we would like to warn you about using unknown algorithms from sources whose cryptographic competence has not been adequately verified.

Symmetric or hybrid procedures?

For performance reasons, no implementations based solely on public key techniques should be used for encryption purposes. All common implementations of public key cryptography use hybrid procedures (see also S 3.23 Introduction to basic cryptographic terms).

In applications with large or open user groups, it is usually recommended to use a hybrid procedure (due to the advantages in the key management). For small, closed user groups (and especially when there is only one user), the selection should be restricted to symmetric procedures. When using hybrid procedures, it makes sense to use a symmetric and an asymmetric procedure with the same strength. Since numerous keys need to be encrypted by the asymmetric procedure for use in the symmetric procedure before exchanging keys, the asymmetric algorithm should be designed to be slightly stronger.

Feasibility of technical requirements

The cipher algorithms must be designed in such a way that the technical requirements, and especially the performance required, can be met by a suitable implementation. This includes requirements on the error propagation (for example when sending over very noisy channels), but also requirements on synchronisation overhead and time delay (in case "real-time" encryption of large amounts of data is required, for example).

Example: Voice encryption with ISDN

When planning a communication network, a host of parameters must be taken into account which have an influence on the expected quality of the voice transmission and appearing in the form of hissing, crackling, crosstalk, or whistling. Such influencing factors include, for example, the encryption method used. In order to obtain a satisfactory level of voice quality, all of the equipment in a transmission route needs to be examined and assessed.

Although examining an individual component alone should not be considered justified due to the interaction of each of the relevant effects, it is nevertheless important to know the factors influencing each individual component (e.g. the encryption component). The general conditions for realisation as well as for selection can then be derived from this information.

The response of an encryption component is therefore primarily characterised by the following factors:

• the time it takes to encrypt a block of data (generally leads to delays),
• the control information added to the data stream for synchronisation purposes (can lead to fluctuations under some circumstances),
• the maximum data throughput the crypto components will need to provide (can also lead to fluctuations when it is necessary to buffer the data temporarily),
• the error propagation resulting from encryption (generally leads to a higher error rate).

The influencing factors mentioned above have a negative effect on voice encryption in particular (as a real-time service) and lead to an increase in the end-to-end transmission time, more fluctuation in the transmission time, as well as higher error rates, which in turn means reduced quality that is measurable and can be attributed to the encryption components.

Other influencing factors

Some cryptographic algorithms (IDEA, for example) are patented and it may be necessary to pay licence fees when using them in commercial applications (which also includes applications in government).

Publications of the Federal Network Agency

In the Federal Gazette, the Federal Network Agency regularly publishes an overview of the algorithms that can be considered suitable for generating signature keys, hashing data to be signed, or generating and examining qualified electronic signatures. These publications can also be downloaded from the website of the Federal Network Agency (www.bundesnetzagentur.de). They can provide additional information to help you select a procedure.

Review questions:

• Is a currently recommended key length used when using cryptographic procedures?
• Is it ensured that established algorithms are used that were examined intensively by experts and that are not characterised by any known security gaps?