Repository: pyca/cryptography

Issue:
3DES with ECB not supported?
While playing around with `cryptography` I was surprised to find out that (on my Linux box, so I presume OpenSSL is the default backend there) ECB mode encryption using TripleDES (3DES) is not supported:

`cipher 3DES in ECB mode is not supported by this backend`

The same code using AES works just fine. This sounds like a bug to me.

(Yes, I know this is neither a secure algorithm nor a secure mode.)



Discussion:
Looks like we have 3DES ECB vectors available from NIST so exposing this is trivial. As you noted this is a terrible alg+mode combo, but we should still support it. I'll put together a PR in a bit.


Resolving patch:
diff --git a/cryptography/hazmat/backends/commoncrypto/backend.py b/cryptography/hazmat/backends/commoncrypto/backend.py
--- a/cryptography/hazmat/backends/commoncrypto/backend.py
+++ b/cryptography/hazmat/backends/commoncrypto/backend.py
@@ -178,6 +178,7 @@ def _register_default_ciphers(self):
             )
         for mode_cls, mode_const in [
             (CBC, self._lib.kCCModeCBC),
+            (ECB, self._lib.kCCModeECB),
             (CFB, self._lib.kCCModeCFB),
             (CFB8, self._lib.kCCModeCFB8),
             (OFB, self._lib.kCCModeOFB),
diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py
--- a/cryptography/hazmat/backends/openssl/backend.py
+++ b/cryptography/hazmat/backends/openssl/backend.py
@@ -181,6 +181,11 @@ def _register_default_ciphers(self):
                 mode_cls,
                 GetCipherByName("des-ede3-{mode.name}")
             )
+        self.register_cipher_adapter(
+            TripleDES,
+            ECB,
+            GetCipherByName("des-ede3")
+        )
         for mode_cls in [CBC, CFB, OFB, ECB]:
             self.register_cipher_adapter(
                 Blowfish,


Test patch:
diff --git a/tests/hazmat/primitives/test_3des.py b/tests/hazmat/primitives/test_3des.py
--- a/tests/hazmat/primitives/test_3des.py
+++ b/tests/hazmat/primitives/test_3des.py
@@ -174,3 +174,40 @@ class TestTripleDESModeCFB8(object):
         ),
         lambda iv, **kwargs: modes.CFB8(binascii.unhexlify(iv)),
     )
+
+
+@pytest.mark.supported(
+    only_if=lambda backend: backend.cipher_supported(
+        algorithms.TripleDES("\x00" * 8), modes.ECB()
+    ),
+    skip_message="Does not support TripleDES ECB",
+)
+@pytest.mark.cipher
+class TestTripleDESModeECB(object):
+    test_KAT = generate_encrypt_test(
+        load_nist_vectors,
+        os.path.join("ciphers", "3DES", "ECB"),
+        [
+            "TECBinvperm.rsp",
+            "TECBpermop.rsp",
+            "TECBsubtab.rsp",
+            "TECBvarkey.rsp",
+            "TECBvartext.rsp",
+        ],
+        lambda keys, **kwargs: algorithms.TripleDES(binascii.unhexlify(keys)),
+        lambda **kwargs: modes.ECB(),
+    )
+
+    test_MMT = generate_encrypt_test(
+        load_nist_vectors,
+        os.path.join("ciphers", "3DES", "ECB"),
+        [
+            "TECBMMT1.rsp",
+            "TECBMMT2.rsp",
+            "TECBMMT3.rsp",
+        ],
+        lambda key1, key2, key3, **kwargs: algorithms.TripleDES(
+            binascii.unhexlify(key1 + key2 + key3)
+        ),
+        lambda **kwargs: modes.ECB(),
+    )