Choosing an algorithm

For a general discussion on cryptographic algorithms, refer to 2.1, “Cryptographic algorithms” on page 12. For a discussion on key strengths, refer to 3.2, “Size matters” on page 26.

6.3.1 Cipher algorithm

In this section we discuss our recommendations for using a cipher algorithm.

i5/OS Cryptographic Services

Common Crypto Architecture

SQL built-ins Java Cryptography

Use 򐂰 General purpose 򐂰 General purpose

򐂰 Financial 򐂰 DB2 column encryption 򐂰 General purpose Cryptographic service provider 򐂰 i5/OS LIC 򐂰 2058a

a. The 2058 Cryptographic Accelerator is no longer available. However, if you have one, it is still supported.

򐂰 4758b

򐂰 4764

b. The 4758 Cryptographic Coprocessor is no longer available. However, if you have one, it is still supported.

򐂰 i5/OS LIC 򐂰 Java Crypto Extension Supported algorithms 򐂰 DES 򐂰 TDES 򐂰 AES 򐂰 RC2 򐂰 RC4 򐂰 RSA 򐂰 D-H 򐂰 MD5 򐂰 SHA1 򐂰 SHA2 򐂰 DES 򐂰 TDES 򐂰 RSA 򐂰 MDC 򐂰 MD5 򐂰 SHA1 򐂰 RIPEMD-160 򐂰 RC2 򐂰 TDES 򐂰 DES 򐂰 TDES 򐂰 AES 򐂰 RC2 򐂰 MARS 򐂰 Blowfish 򐂰 RC4 򐂰 SEAL 򐂰 RSA 򐂰 D-H 򐂰 DSA 򐂰 MD2 򐂰 MD5 򐂰 SHA1 򐂰 SHA2

Key management 򐂰 MK protected KSc

򐂰 MKs stored in LIC

c. Master key protected keystore.

򐂰 MK protected KS 򐂰 MKs stored on secure hardware 򐂰 No key management 򐂰 PW protected keystored

d. Password protected keystore.

Pre-req’se

e. Prior to V5R4, 5722-AC3 Cryptographic Service Provider, a no-charge program product, is required to enable cryptography on the system. In V5R4, this product is no longer required.

򐂰 򐂰 SS1 Option 35

򐂰 5733CY1 (4764)

򐂰 򐂰 5722JV1 JDK™

Cost 򐂰 Part of i5/OS 򐂰 $$ for coprocessor

DES

NIST withdrew DES as a standard in 2005. Because of its short key length, it is no longer considered secure against the power of today’s processors. In fact, DES keys have been broken in under 24 hours. Do not use DES.

AES

AES is the official replacement for DES. AES is an excellent choice both for security and speed. AES is available through the Cryptographic Services APIs and Java Cryptography. AES supports three key lengths: 128 bits (16 bytes), 192 bits (24 bytes), and 256 bits (32 bytes). It is best to use a 256-bit key. Because of collision attacks, it actually gives you 128-bit security.

Use CBC mode to hide patterns in the data. If the size of your data is not on a block size boundary, you have the following options.

򐂰 Select the pad option. This increases the size of your ciphertext to the next block-size

multiple.

򐂰 To keep your ciphertext the same size as your plaintext, implement CUSP mode of

operation. CUSP mode can be implemented as follows:

a. Use CBC mode to encrypt up to the last partial block of plaintext. b. Encrypt the last block of ciphertext again.

c. XOR the last partial block of plaintext data with the same number of bytes from step b. If the data length is less than the block size, the initialization vector is used in place of the last block of ciphertext in step a. This process is identical for encrypting or decrypting. Cryptographic Services supports three AES block sizes:128 bits (16 bytes), 192 bits (24 bytes), and 256 bits (32 bytes). A 256-bit block size is best because a larger block size reduces the number of ciphertext collisions that leak information. However, the AES standard only specifies a 128-bit block size. Therefore, when using a 256-bit key with a 128-bit block size, it is important to limit how much total data is encrypted with a single key. (Otherwise, you might as well use a smaller key size.) With CBC mode, you should limit it to 232 blocks or so.

TDES

If AES is not a choice, use triple DES. Three-key TDES is preferable over two-key TDES. Use CBC mode to hide patterns in the data. If your data is not on a block size boundary, you have the following options:

򐂰 Select the pad option. This increases the size of your ciphertext to the next 8-byte

boundary.

򐂰 Implement CUSP mode, as explained above, for the last partial data block. This keeps

your ciphertext the same size as your plaintext.

򐂰 With Cryptographic Services, you can also use OFB or CFB modes to keep your

ciphertext the same size as your plaintext. Even though these modes use TDES like a stream cipher, Cryptographic Services requires the length of your data to be a multiple of eight. Therefore, perform the following steps:

a. Pad out your data (for example, with nulls) to the next 8-byte block boundary.

Chapter 6. Choosing a data encryption method 75

Decryption is similar. You must pad out the ciphertext (for example, with nulls) to the next 8-byte boundary and then decrypt.

RC2

Although RC2 has been around since 1987, the details of the algorithm were kept secret until 1996. There does not appear to be as much analysis of RC2 as there is for TDES and AES. We believe that it is preferable to use AES or TDES over RC2.

RC4

RC4 is a stream cipher and is available through Cryptographic Services and Java

Cryptography. One of the attractions of RC4 is that the ciphertext is always equal in length to the plaintext. However, key management can be a problem. Because of the nature of the RC4-compatible algorithm, using the same key for more than one message severely compromises security. If keeping the ciphertext length equal to the plaintext length is a requirement, we prefer that you use a block cipher with CUSP or CFB modes of operation, rather than RC4.

6.3.2 Hash and HMAC algorithms

Use a strong hash algorithm like SHA-256 or SHA-512 if possible. (Do not bother using SHA-384. The underlying function performs all the work of SHA-512 and then throws away part of the results.) Because of weaknesses in the SHA hash functions, it is best to perform a double hash (that is, hash the data then hash the result). Do not use MD5.

We recommend SHA-256 HMAC for your authentication function, as well. Use all 256 bits (32 bytes) for your MAC value if possible. A double hash is not needed for HMAC operations.