Cryptography - Please help me understand Key Length Requirements

Question

I'm having a bit of difficulty getting an understand of key length requirements in cryptography. I'm currently using DES which I believe is 56 bits... now, by converting an 8 character password to a byte[] my cryptography works. If I use a 7 digit password, it doesn't.

Now, forgive me if I'm wrong, but is that because ASCII characters are 7 bits, therefor 8 * 7 = 56bits?

That just doesn't seem right to me. If I want to use a key, why can I not just pass in a salted hash of my secret key, i.e. an MD5 hash?

I'm sure this is very simple, but I can't get a clear understanding of what's going on.

Thanks in advance.

Answer 1

You shouldn't pass you passwords straight into the algorithm. Use for instance the Rfc2898DeriveBytes class that will salt your passwords, too. It will work with any length.

Have a look here for an example.

EDIT: D'Oh - your question is not C# or .Net tagged :/

Answer 2

According to MSDN DES supports a key length of 64 bits.

Answer 3

The key must have size 64-bits but only 56-bits are used from the key. The other 8-bits are parity bits (internal use).

ASCII chars have 8-bit size.

Answer 4

Each algorithm is designed to accept a certain key length. The key is used as part of the algorithm, and as such, can't be whatever your heart desires.

Common key sizes are:

• DES: 56bit key
• AES: 128-256bit key (commonly used values are 128, 192 and 256)
• RSA (assymetric cryptography): 1024, 2048, 4096 bit key

A number, such as 1234567 is only a 4-byte variable. The key is expected to be a byte array, such as "1234567" (implicitly convertible to one in C) or `{ '1', '2', '3', '4', '5', '6', '7' }.

If you wish to pass the MD5 hash of your salted key to DES, you should use some key compression technique. For instance, you could take the top 7 bytes (somewhat undesirable), or perform DES encryption on the MD5 hash (with a known constant key), and take all but the last byte as the key for DES operation.

edit: The DES I'm talking about here is the implementation per the standard released by NIST. It could so be (as noted above), that your specific API expects different requirements on the length of the key, and derives the final 7-byte key from it.

Answer 5

DES uses a 56-bit key: 8 bytes where one bit in each byte is a parity bit.

In general, however, it is recommended to use an accepted, well-known key derivation algorithm to convert a text password to a symmetric cipher key, regardless of the algorithm.

The PBKDF2 algorithm described in PKCS #5 (RFC 2898) is a widely-used key derivation function that can generate a key of any length. At its heart, PBKDF2 is combining salt and the password through in hash function to produce the actual key.

The older version, PBKDF1, can generate keys for DES encryption, but DES and PBKDF1 aren't recommended for new applications.

Most platforms with cryptographic support include PKCS #5 key-derivation algorithms in their API.

Answer 6

To avoid this issue and increase the overall security of one's implementation, typically we'll pass some hashed variant of the key to crypto functions, rather than the key itself.

Also, it's good practice to 'salt' the hash with a value which is particular to the operation you are doing and won't change (e.g., internal userid). This assures you that for any two instances of the key, the resulting has will be different.

Once you have your derived key, you can pull off the first n-bites of it as required by your particular crypto function.