SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 5: Elementary Cryptography3DES (pronounced “triple DEZ”) became the DES interim replacement.3DES increased the key space from 256 to 2168 by simply performingthree consecutive encryption passes using DES and a different 56-bitkey for each pass. Effectively, this created an algorithm that usedthree 56-bit keys, which is equivalent to a 168-bit key size.AESThe Advanced Encryption Standard (AES) was developed by theNational Institute of Standards and Technology (NIST) to replace DESthrough a competitive process, in which 15 competitors submitted proposedalgorithms. The Rijndael algorithm proposed by Vincent Rijmenand Joan Daemen, two Belgian engineers, was selected as the newencryption standard in 2000. The AES is defined in the Federal InformationProcessing Standards (FIPS) publication 197. The Rijndaelalgorithm is a symmetric key block cipher which supports keys with128 bits, 192 bits, and 256 bits (AES-128, AES-192, and AES-256respectively). It was rapidly adopted by the industry and most commercialapplications for encryption of data-at-rest use AES-256.The AES standard is the first to use an open cipher that is available toanyone, distinguishing it from its predecessor DES. Although there hadbeen some controversy around DES, which was co-developed by theNational Security Agency (NSA), as to whether the NSA had created aback door into the algorithm, the open nature of the AES standard hasall but eliminated this possibility.Diffie-HellmanWhitfield Diffie and Martin Hellman were the first to publish the conceptof public key cryptography in 1976. In actual fact, the public keyprivatekey theorem was first developed independently by James Ellisin 1969 and the algorithm problem was solved by Clifford Cox in 1973.However, their work was not published before the publication of thework of Diffie-Hellman. Without going into too many details of how thisalgorithm works, it is based on the process of factoring very largeprime numbers, which is very difficult to do.Diffie-Hellman (DH) was the first practical implementation of publickey cryptography and is ubiquitous in the IT security industry. It is anintegral part of several standards and protocols. In the FC industry, theFC-SP (Fibre Channel-Security Protocol) uses DH-CHAP (DH-ChallengeHandshake Authentication Protocol) to authenticate devices orswitches joining a fabric.84 Securing Fibre Channel Fabrics