=pod=head1 NAMEdes - encrypt or decrypt data using Data Encryption Standard=head1 SYNOPSISB<des>(B<-e>|B<-E>) | (B<-d>|B<-D>) | (B<->[B<cC>][B<ckname>]) |[B<-b3hfs>] [B<-k>I<key>]] [B<-u>[I<uuname>][I<input-file>[I<output-file>] ]=head1 NOTEThis page describes the B<des> stand-alone program, not the B<openssl des>command.=head1 DESCRIPTIONB<des>encrypts and decrypts data using theData Encryption Standard algorithm.One ofB<-e>, B<-E>(for encrypt) orB<-d>, B<-D>(for decrypt) must be specified.It is also possible to useB<-c>orB<-C>in conjunction or instead of the a encrypt/decrypt option to generatea 16 character hexadecimal checksum, generated via theI<des_cbc_cksum>.Two standard encryption modes are supported by theB<des>program, Cipher Block Chaining (the default) and Electronic Code Book(specified withB<-b>).The key used for the DESalgorithm is obtained by prompting the user unless theB<-k>I<key>option is given.If the key is an argument to theB<des>command, it is potentially visible to users executingps(1)or a derivative.  To minimise this possibility,B<des>takes care to destroy the key argument immediately upon entry.If your shell keeps a history file be careful to make sure it is notworld readable.Since this program attempts to maintain compatibility with sunOS'sdes(1) command, there are 2 different methods used to convert the usersupplied key to a des key.Whenever and one or more ofB<-E>, B<-D>, B<-C>orB<-3>options are used, the key conversion procedure will not be compatiblewith the sunOS des(1) version but will use all the user suppliedcharacter to generate the des key.B<des>command reads from standard input unlessI<input-file>is specified and writes to standard output unlessI<output-file>is given.=head1 OPTIONS=over 4=item B<-b>Select ECB(eight bytes at a time) encryption mode.=item B<-3>Encrypt using triple encryption.By default triple cbc encryption is used but if theB<-b>option is used then triple ECB encryption is performed.If the key is less than 8 characters long, the flag has no effect.=item B<-e>Encrypt data using an 8 byte key in a manner compatible with sunOSdes(1).=item B<-E>Encrypt data using a key of nearly unlimited length (1024 bytes).This will product a more secure encryption.=item B<-d>Decrypt data that was encrypted with the B<-e> option.=item B<-D>Decrypt data that was encrypted with the B<-E> option.=item B<-c>Generate a 16 character hexadecimal cbc checksum and output this tostderr.If a filename was specified after theB<-c>option, the checksum is output to that file.The checksum is generated using a key generated in a sunOS compatiblemanner.=item B<-C>A cbc checksum is generated in the same manner as described for theB<-c>option but the DES key is generated in the same manner as used for theB<-E>andB<-D>options=item B<-f>Does nothing - allowed for compatibility with sunOS des(1) command.=item B<-s>Does nothing - allowed for compatibility with sunOS des(1) command.=item B<-k> I<key>Use the encryption I<key>specified.=item B<-h>TheI<key>is assumed to be a 16 character hexadecimal number.If theB<-3>option is used the key is assumed to be a 32 character hexadecimalnumber.=item B<-u>This flag is used to read and write uuencoded files.  If decrypting,the input file is assumed to contain uuencoded, DES encrypted data.If encrypting, the characters following the B<-u> are used as the name ofthe uuencoded file to embed in the begin line of the uuencodedoutput.  If there is no name specified after the B<-u>, the name text.deswill be embedded in the header.=head1 SEE ALSOps(1),L<des_crypt(3)|des_crypt(3)>=head1 BUGSThe problem with using theB<-e>option is the short key length.It would be better to use a real 56-bit key rather than anASCII-based 56-bit pattern.  Knowing that the key was derived from ASCIIradically reduces the time necessary for a brute-force cryptographic attack.My attempt to remove this problem is to add an alternative text-key toDES-key function.  This alternative function (accessed viaB<-E>, B<-D>, B<-S>andB<-3>)uses DES to help generate the key.Be carefully when using the B<-u> option.  Doing B<des -ud> I<filename> willnot decrypt filename (the B<-u> option will gobble the B<-d> option).The VMS operating system operates in a world where files are always amultiple of 512 bytes.  This causes problems when encrypted data issend from Unix to VMS since a 88 byte file will suddenly be paddedwith 424 null bytes.  To get around this problem, use the B<-u> optionto uuencode the data before it is send to the VMS system.=head1 AUTHOREric Young (eay@cryptsoft.com)=cut