Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 92 views

    IBMcrypto

    Uploaded by

    rikcurl
    This document describes the IBM Cryptographic Subsystem introduced in 1977 to provide cryptographic support for communication between terminals and mainframes. The subsystem uses session keys encrypted under a host master key to encrypt data transmitted between a host and terminals. It employs four cryptographic instructions - ECPH and DCPH to encrypt and decrypt data using a session key, and DMK and RFMK to decrypt the session key at the terminal and re-encrypt it for transmission. A session involves generating a session key at the host, transmitting it encrypted under the terminal's key, and decrypting it at the terminal to establish a common encryption key between the host and terminal.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    IBMcrypto

    Uploaded by

    rikcurl
    92 views4 pages
    This document describes the IBM Cryptographic Subsystem introduced in 1977 to provide cryptographic support for communication between terminals and mainframes. The subsystem uses session keys encrypted under a host master key to encrypt data transmitted between a host and terminals. It employs four cryptographic instructions - ECPH and DCPH to encrypt and decrypt data using a session key, and DMK and RFMK to decrypt the session key at the terminal and re-encrypt it for transmission. A session involves generating a session key at the host, transmitting it encrypted under the terminal's key, and decrypting it at the terminal to establish a common encryption key between the host and terminal.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document describes the IBM Cryptographic Subsystem introduced in 1977 to provide cryptographic support for communication between terminals and mainframes. The subsystem uses session keys encrypted under a host master key to encrypt data transmitted between a host and terminals. It employs four cryptographic instructions - ECPH and DCPH to encrypt and decrypt data using a session key, and DMK and RFMK to decrypt the session key at the terminal and re-encrypt it for transmission. A session involves generating a session key at the host, transmitting it encrypted under the terminal's key, and decrypting it at the terminal to establish a common encryption key between the host and terminal.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    92 views4 pages

    IBMcrypto

    Uploaded by

    rikcurl
    This document describes the IBM Cryptographic Subsystem introduced in 1977 to provide cryptographic support for communication between terminals and mainframes. The subsystem uses session keys encrypted under a host master key to encrypt data transmitted between a host and terminals. It employs four cryptographic instructions - ECPH and DCPH to encrypt and decrypt data using a session key, and DMK and RFMK to decrypt the session key at the terminal and re-encrypt it for transmission. A session involves generating a session key at the host, transmitting it encrypted under the terminal's key, and decrypting it at the terminal to establish a common encryption key between the host and terminal.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    9/5/09

    T-1
    IBM Cryptographic Subsystem

    In 1977, IBM announced a family of products under the name IBM Cryptographic Subsystem,
    for cryptographic support of communication between terminals and mainframes [IBM77a,
    IBM77b]. A description of the design principles is given in [EHRS78], [LENN78], and
    [MATY78]. An independent and similar proposal was made in [EVER78].
    The IBM Cryptographic Subsystem is based on the concept of a session key, KS, a key
    shared by host and terminal and used only for the duration of a session. The basic features of the
    subsystem are:

    1. Two classes of keys, operational keys (session keys and device keys), which perform
    encryption (encipherment) and system keys, are used to encipher operational keys that
    are stored in the host.
    2. No operational key is stored in plaintext in the host.
    3. A single host master key, KMH, is stored at the host in a secure device capable of
    executing a small set of instructions. Two variants of the master key, KMH0 and KMH1,
    are obtained by complementing certain bits in KMH.
    4. Device (or terminal) master keys, KMT
    1
    , KMT
    2
    , KMT
    N
    , are stored in a secure
    manner at the devices (terminals). A host table contains (DES[KMH
    1
    , KMT
    i
    ] for i = 1, 2,
    , N).
    5. A session key KS is an operational key used to encipher transmissions between the host
    and a device (terminal). The session key is generated by the host at the initiation of the
    session.
    6. There are four nonprivileged instructions for enciphering/deciphering data: ECPH,
    DCPH, DMK, and RFMK.

    Figure 1 shows the operation of the ECPH (encipher data) instruction, which has the
    form:

    ECPH(DES
    1
    [KMH0, KS], PLAIN) = DES[KS, PLAIN] = CIPHER

    9/5/09
    T-2
    The session key is stored at the host encrypted using KMHO. When a block of plaintext
    is to be transmitted to a terminal, the session key must first be decrypted, and then used to
    encrypt the plaintext.
    Figure 2 shows the operation of the DCPH (decipher data) instruction, which has the
    form:

    DCPH(DES
    1
    [KMH0, KS], DES[KS, PLAIN]) = PLAIN = DES
    1
    [KS, CIPHER]

    In this case, the host receives encrypted plaintext, recovers the session key using KMHO,
    and uses the session key to recover the plaintext.
    Figure 3 shows the operation of DMK (decipher under terminal key), which is an
    instruction executed at a terminal (device), which has the form:

    DMK(KMT
    i
    , DES[KMT
    i
    , KS]) = DES
    1
    [KMT
    i
    , DES[KMT
    i
    , KS]] = KS

    Figure 4 shows a translation facility, RFMK (reencipher from master key), which has the
    form:

    RFMK(DES[KMH1, KMT
    i
    ], DES[KMH0, KS]) = DES[KMT
    i
    , KS]

    A session linking the ith device (terminal) to the host processor involves the following
    steps:

    1. A pseudorandom number RN is generated at the host by repeated DES encryption of the
    time-of-day clock. RN is interpreted as the encryption of the session key KS under
    KMH0.
    RN = DEX[KMH0, KS]

    RN is stored at the host in a table associated with the ith device for the duration of the
    session.
    9/5/09
    T-3
    2. The session key must be made available to the ith device. The translation facility is used
    for this purpose; RFMK with input arguments (1) the encryption of KMT
    i
    under KMH1,
    and (2) RN, which yields

    DES[KMT, KS] = RFMK(DES[KMH1, KMT
    i
    ], DES[KMH0, KS])

    This is transmitted by the host to the ith device.
    3. The ith device, having KMT
    i
    , uses DMK to obtain

    KS = DMK(KMT
    i
    , DES[KMT
    i
    , KS]) = DES
    1
    [KMT
    i
    , DES[KMT
    i
    , KS]]

    At the end of step 3, both parties to the communication, the host and the terminal, have
    now established and exchanged a common key KS. Plaintext can be encrypted with the key KS
    at the host with ECPH, and plaintext can be recovered at the host with DCPH.

    References

    EHRS78 Ehrsam, W., et al. "A Cryptographic Key Management Scheme for Implementing
    the Data Encryption Standard." IBM Systems Journal, Vol 17, No 2, 1978.

    EVER78 Everton. J. "A Hierarchical Basis for Encryption Key Management in a Computer
    Communication Network." Proceedings ICC'78, 1978.

    IBM77a IBM. Programmed Cryptographic Facility Program Product - General
    Information Manual. IBM Systems Library, GC28-0941, 1977.

    IBM77b IBM. IBM 3848 Cryptographic Unit Product Description and Operating
    Procedures. IBM Systems Library, GC22-7073, 1977.

    LENN78 Lennon, R. "Cryptographic Architecture for Information Security." IBM Systems
    Journal, Vol 17, No 2, 1978.

    MATY78 Matyas, S., and Meyer, C. "Generating, Distribution, and Installation of
    Cryptographic Keys." IBM Systems Journal, Vol 17, No 2, 1978.
    DES
    (D)
    DES[KHM0, KS]
    DES[KS, PLAIN]
    Figure 1 ECPH: encipher data
    KHM0
    KS
    PLAIN
    DES
    (E)
    DES
    (D)
    DES[KHM0, KS]
    PLAIN
    Figure 2 DCPH: decipher data
    KHM0
    KS
    DES[KS, PLAIN]
    DES
    (D)
    DES
    (D)
    DES[KMT
    !
    , KS]
    Figure 3 DMK: decipher under
    terminal (device) key
    KMT
    !
    KS
    DES
    (D)
    DES
    (D)
    DES[KHM1, KMT
    !
    ]
    DES[KMT
    !
    , KS]
    Figure 4 RFMK: recipher from
    master key
    KHM1
    KMT
    !
    KS
    DES[KMH0, KS]
    DES
    (E)
    KHM0

    You might also like