Triple DES

Triple DES
Company type	Symmetric-key block cipher
Industry	Cryptography
Founded	1978
Founder	Walter Tuchman
Products	Data encryption algorithm

In the field of cryptography, Triple DES (also known as 3DES or TDES), formally called the Triple Data Encryption Algorithm (TDEA or Triple DEA), is a symmetric-key block cipher that executes the DES algorithm three times on each data block. Since the original DES utilized a 56-bit key, which is now insufficient against contemporary cryptanalysis techniques and advanced computing capabilities, Triple DES boosts security by effectively providing a 112-bit key strength. A notable security flaw identified in 2016 (CVE-2016-2183) revealed vulnerabilities within both DES and 3DES, leading NIST to phase out 3DES in 2019 and prohibit its use—except for legacy systems—by the conclusion of 2023. Consequently, it has been replaced by the more robust AES.

Within US governmental and industry documentation, the algorithm is often abbreviated as TDES or TDEA, whereas RFC 1851 introduced the designation 3DES, which has since become prevalent among vendors, practitioners, and cryptographers alike.

History

The concept of applying triple encryption with DES using two separate 56-bit keys was initially proposed by Walter Tuchman in 1978. Later, in 1981, Merkle and Hellman developed a more secure variant employing three keys, achieving an effective security level of 112 bits.

Standards

The Triple Data Encryption Algorithm is specified across multiple authoritative standards:

RFC 1851, titled The ESP Triple DES Transform (approved in 1995)
ANSI ANS X9.52-1998 Triple Data Encryption Algorithm Modes of Operation (approved in 1998, withdrawn in 2008)
FIPS PUB 46-3 Data Encryption Standard (DES) (approved in 1999, withdrawn in 2005)
NIST Special Publication 800-67 Revision 2 Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher (approved in 2017, withdrawn in 2024)
ISO/IEC 18033-3:2010 Part 3: Block ciphers (approved in 2005)

Algorithm

At the time of its creation, the original DES cipher's 56-bit key length was adequate; however, advancements in computing power have rendered it susceptible to brute-force attacks. To enhance security without redesigning the underlying cipher, Triple DES increases the effective key length.

A straightforward method to improve DES security involves double encryption with two keys <math>(K1, K2)</math> using <math>E_{K2}(E_{K1}(\textrm{plaintext}))</math>. Nevertheless, this approach is vulnerable to the meet-in-the-middle attack, which diminishes the anticipated security level from <math>2^{2n}</math> to approximately <math>2^{n+1}</math> operations.

Triple DES employs a "key bundle" comprising three separate 56-bit DES keys: <math>K1</math>, <math>K2</math>, and <math>K3</math>. The encryption procedure follows this sequence:

<math>\textrm{ciphertext} = E_{K3}(D_{K2}(E_{K1}(\textrm{plaintext})))</math>

(that is, encrypt with <math>K1</math>, decrypt with <math>K2</math>, then encrypt again with <math>K3</math>). Decryption involves applying these steps in reverse order.

Each triple-stage operation handles a 64-bit data block. The intermediate decryption step enhances security under keying option 2 and maintains backward compatibility with DES when using option 3.

EEE operation

Although the standard Triple DES mode is EDE (encrypt-decrypt-encrypt), some implementations allow an alternative "EEE" (encrypt-encrypt-encrypt) mode, applicable in both two- and three-key configurations.

Keying options

There are three recognized keying configurations:

Keying option 1: All three keys are distinct (3 × 56 = 168 bits), often referred to as 3TDEA or triple-length keys. This provides the highest security level, though it remains susceptible to meet-in-the-middle attacks requiring about <math>2^{112}</math> computations.

Keying option 2: The first two keys are independent (<math>K_1</math> and <math>K_2</math>), while the third matches the first (<math>K_3 = K_1</math>). Known as 2TDEA or double-length keys, this option yields an effective key length of 112 bits. It represents a middle ground between single DES and option 1 but was deprecated by NIST in 2015 due to security vulnerabilities.

Keying option 3: All three keys are identical (<math>K_1 = K_2 = K_3</math>), ensuring backward compatibility with single DES. However, this configuration is no longer accepted by NIST or ISO standards.

Each DES key consists of eight bytes with odd parity (56 bits of effective key plus 8 parity bits). Consequently, key bundles require 24 bytes for option 1, 16 bytes for option 2, and just 8 bytes for option 3.

NIST and Trusted Platform Module guidelines forbid usage of any among 64 specific weak keys (expressed in hexadecimal), including their binary complements and reversed permutations. This restriction supports approving Triple DES only under keying options 1 and 2.

For optimal security, it is advised to generate keys from robust random sources and exclusively employ keying option 1.

Encryption of more than one block

As with all block ciphers, encrypting or decrypting multiple data blocks involves various modes of operation, which are typically specified independently from the cipher itself. Nonetheless, standards such as ANS X9.52 and NIST SP 800-67 (referencing SP 800-38A) impose particular conditions on certain modes that may not be present in broader standards. For instance, ANS X9.52 requires a unique initialization vector for every use of cipher block chaining, a rule not mandated by ISO/IEC 10116. Meanwhile, FIPS PUB 46-3 and ISO/IEC 18033-3 define only the single-block algorithm without placing restrictions on multi-block modes.

Security

Triple DES employing three distinct keys (keying option 1) nominally provides a 168-bit key length; however, due to the meet-in-the-middle attack, its effective security is reduced to 112 bits. When using keying option 2, the effective key size is also 112 bits since the third key repeats the first one. Nevertheless, this mode is susceptible to specific chosen-plaintext and known-plaintext attacks, prompting NIST to assign it a security rating of only 80 bits. These vulnerabilities played a role in NIST's decision in 2017 to phase out Triple DES.

The cipher's 64-bit block size makes it vulnerable to block collision attacks during encryption of large datasets with the same key. The Sweet32 attack highlighted this weakness in TLS and OpenVPN contexts, requiring approximately 785 GB of data for a complete exploit but able to detect collisions after processing significantly less data (~2^20 blocks) within minutes.

In response to these security issues, OpenSSL removed 3DES from its default cipher suite starting with version 1.1.0 (August 2016), labeling it as a "weak cipher."

Usage

By 2008, Triple DES remained integral to the electronic payment sector, underpinning standards such as EMV that continue to evolve around it.

Earlier iterations of Microsoft OneNote, Microsoft Outlook 2007, and Microsoft System Center Configuration Manager 2012 utilized Triple DES for encrypting user passwords and system information. However, Microsoft announced in December 2018 that they would discontinue support for 3DES throughout their Office 365 platform.

Implementations

Triple DES is supported by numerous major cryptographic libraries, including:

While some recent library versions may omit Triple DES from default configurations, they often retain decryption capabilities for compatibility with legacy data.

References and notes