Page MenuHomeFreeBSD

Drop ed(1) "crypto"
ClosedPublic

Authored by cem on Nov 3 2018, 10:13 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Apr 22, 2:47 PM
Unknown Object (File)
Mar 11 2024, 4:16 PM
Unknown Object (File)
Mar 11 2024, 4:16 PM
Unknown Object (File)
Mar 11 2024, 4:16 PM
Unknown Object (File)
Mar 9 2024, 9:31 PM
Unknown Object (File)
Mar 9 2024, 1:09 PM
Unknown Object (File)
Mar 8 2024, 1:19 PM
Unknown Object (File)
Mar 8 2024, 2:15 AM
Subscribers

Details

Summary

You should not be using DES. You should not have been using DES for the
past 30 years.

The ed DES scheme lacked several desirable properties of a sealed
document system, even ignoring DES itself. In particular, it did not
provide the "integrity" cryptographic property (detection of tampering), and
it treated ASCII passwords as 64-bit keys (instead of using a KDF like
scrypt or PBKDF2).

Some general approaches ed(1) users might consider to replace the removed
DES mode:

  1. Full disk encryption with something like AES-XTS. This is easy to

conceptualize, design, and implement, and it provides confidentiality for
data at rest. Like ECB, it lacks tampering protection. Examples include
GELI, LUKS, FileVault2.

  1. Encrypted overlay ("stackable") filesystems (EncFS, PEFS?, CryptoFS,

others).

  1. Native encryption at the filesystem layer. Ext4/F2FS, ZFS, APFS, and

NTFS all have some flavor of this.

  1. Storing your files unencrypted. It's not like DES was doing you much

good.

If you have DES-ECB scrambled files produced by ed(1) prior to this change,
you may descrypt them with:

openssl des-cbc -d -iv 0 -K <key in hex> -in <inputfile> -out <plaintext>

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision is now accepted and ready to land.Nov 4 2018, 5:23 AM

Yeah, it was just an oversight that we didn't remove this along with bdes back in February 2017.

It should have been retired a LONG time ago.

This revision was automatically updated to reflect the committed changes.