6.1. PBES1

6.1. PBES1

PBES1 combines the PBKDF1 function (Section 5.1) with an underlying block cipher, which shall be either DES [NIST46] or RC2 [RFC2268] in cipher block chaining (CBC) mode [NIST81]. PBES1 is compatible with the encryption scheme in PKCS #5 v1.5 [PKCS5_15].

PBES1 is recommended only for compatibility with existing applications, since it supports only two underlying encryption schemes, each of which has a key size (56 or 64 bits) that may not be large enough for some applications.

6.1.1. PBES1 Encryption Operation

The encryption operation for PBES1 consists of the following steps, which encrypt a message M under a password P to produce a ciphertext C:

1. Select an eight-octet salt S and an iteration count c, as outlined in Section 4.

2. Apply the PBKDF1 key derivation function (Section 5.1) to the password P, the salt S, and the iteration count c to produce a derived key DK of length 16 octets:

   DK = PBKDF1 (P, S, c, 16)

3. Separate the derived key DK into an encryption key K consisting of the first eight octets of DK and an initialization vector IV consisting of the next eight octets:

   K   = DK<0..7>
   IV  = DK<8..15>

4. Concatenate M and a padding string PS to form an encoded message EM:

   EM = M || PS

   where the padding string PS consists of 8-(||M|| mod 8) octets each with value 8-(||M|| mod 8). The padding string PS will satisfy one of the following statements:

   PS = 01, if ||M|| mod 8 = 7 ;
   PS = 02 02, if ||M|| mod 8 = 6 ;
   ...
   PS = 08 08 08 08 08 08 08 08, if ||M|| mod 8 = 0.

   The length in octets of the encoded message will be a multiple of eight, and it will be possible to recover the message M unambiguously from the encoded message. (This padding rule is taken from RFC 1423 [RFC1423].)

5. Encrypt the encoded message EM with the underlying block cipher (DES or RC2) in CBC mode under the encryption key K with initialization vector IV to produce the ciphertext C. For DES, the key K shall be considered as a 64-bit encoding of a 56-bit DES key with parity bits ignored (see [NIST46]). For RC2, the "effective key bits" shall be 64 bits.

6. Output the ciphertext C.

The salt S and the iteration count c may be conveyed to the party performing decryption in an AlgorithmIdentifier value (see Appendix A.3).

6.1.2. PBES1 Decryption Operation

The decryption operation for PBES1 consists of the following steps, which decrypt a ciphertext C under a password P to recover a message M:

1. Obtain the eight-octet salt S and the iteration count c.

2. Apply the PBKDF1 key derivation function (Section 5.1) to the password P, the salt S, and the iteration count c to produce a derived key DK of length 16 octets:

   DK = PBKDF1 (P, S, c, 16)

3. Separate the derived key DK into an encryption key K consisting of the first eight octets of DK and an initialization vector IV consisting of the next eight octets:

   K = DK<0..7>
   IV  = DK<8..15>

4. Decrypt the ciphertext C with the underlying block cipher (DES or RC2) in CBC mode under the encryption key K with initialization vector IV to recover an encoded message EM. If the length in octets of the ciphertext C is not a multiple of eight, output "decryption error" and stop.

5. Separate the encoded message EM into a message M and a padding string PS:

   EM = M || PS

   where the padding string PS consists of some number psLen octets each with value psLen, where psLen is between 1 and 8. If it is not possible to separate the encoded message EM in this manner, output "decryption error" and stop.

6. Output the recovered message M.