General Encryption

, ,
1

Imported from previous forum

2

[ original email was from Clive Browning - cliveb@prodev.co.uk ]
We have been looking into including encryption within our FIX engine - using PGP and DES.

We have tried several 3rd party DES encryption engines. We have not been able to encrypt a message in one engine and decrypt it in another engine. Because of this we are concerned about which DES engine we should be using.

So we have a few questions:

Is there PGP and DES encryption software (API’s or COM objects) which anyone would recommend - which works on an NT platform?

Do many organisations actually use encryption built into the FIX engine, or is the network relied generally upon for its security e.g using a leased line?

Should we ignore the current security specifications of the FIX protocol and wait for a transport layer recommendation using SSL?

Any help would be useful.

Clive Browning

3

We use both DES and PGP-DES-MD5 with a lot of counterparties and have done so for several years.

  • Our FIX server is Unix-based and code is C++
  • Our DES implementation is "libdes-4.01" freely downloadable from an Australian website. The primary FTP site is: ftp://ftp.psy.uq.oz.au/pub/Crypto/DES/libdes-x.xx.tar.gz
  • Our PGP-DES-MD5 implementation uses a commercial PGP library (written by Phil Zimmerman, used to be called ViaCrypt, then PGP Inc., and now a Network Associates product) in conjunction with the reference implementation libraries available on the FIX website used as-is.
  • If you use Unix, I believe the OS-included “crypt” function and “crypt()” C function call is equivalent to FIX’s “Standard DES” (tag 98 value 2), but not absolutely certain.

Note re: "Standard DES", FIX tag 98 value 2 uses DES in "ECB mode" (no chaining) while the DES portion of PGP-DES-MD5 (FIX tag 98 value 5) uses DES in "CBC mode" (cyber block chaining).

> We have been looking into including encryption within our FIX engine - using PGP and DES.
>
> We have tried several 3rd party DES encryption engines. We have not been able to encrypt a message in one engine and decrypt it in another engine. Because of this we are concerned about which DES engine we should be using.
>
> So we have a few questions:
>
> Is there PGP and DES encryption software (API’s or COM objects) which anyone would recommend - which works on an NT platform?
>
> Do many organisations actually use encryption built into the FIX engine, or is the network relied generally upon for its security e.g using a leased line?
>
> Should we ignore the current security specifications of the FIX protocol and wait for a transport layer recommendation using SSL?
>
> Any help would be useful.
>
> Clive Browning
>
>
>
>
>

4

[ original email was from Ryan Pierce - rpierce@taltrade.com ]
> - If you use Unix, I believe the OS-included “crypt” function and “crypt()” C function call is equivalent to FIX’s “Standard DES” (tag 98 value 2), but not absolutely certain.

It is my understanding that the Unix crypt() function is for use primarily for password hashing (i.e. /etc/passwd). It is not standard DES. This was done so that commercially available DES cracking chips could not be used to accelerate cracking /etc/passwd.

From the Linux man page for crypt():

   The  DES  algorithm itself has a few quirks which make the
   use of the crypt(3) interface a very poor choice for  any-
   thing  other  than  password  authentication.   If you are
   planning on using the crypt(3) interface for a  cryptogra-
   phy  project,  don't  do it: get a good book on encryption
   and one of the widely available DES libraries.

The Unix crypt command has nothing at all to do with DES. It uses a simplified version of the German Enigma cypher with a 256 element rotor and reflector. It is considered trivial to break, and doesn’t need all that much compute power to do so.