Triple DES

Triple DES

1. Construction: EDE with 2–3 Keys (FIPS 46-3, 1999)

Why Decrypt in the middle (EDE, not EEE)? Backward compatibility: $K_1 = K_2 = K_3$ collapses to single DES (talks to legacy boxes); $K_1 = K_3
e K_2$= **2-key 3DES** (112 key bits); all distinct = **3-key 3DES** (168 bits). The middle$D$is just$E$ with reversed subkeys — same DES circuit thrice, no new hardware.

2. Effective Security (Numbers to Quote)

Variant	Key bits	Naive hope	MITM reality	Status
3-key EDE ($K_1
e K_2
e K_3$) | 168 |$2^{168}$|$\approx 2^{112}$(MITM with$2^{56}$ data)	Legacy-safe; NIST disallowed post-2023 for new use
2-key EDE ($K_1 = K_3$)	112	$2^{112}$	$\approx 2^{80}$ (van Oorschot–Wiener)	Deprecated — below 112-bit minimum
Single DES	56	$2^{56}$	$2^{55}$ brute force	Broken

Worked MITM sketch (3-key): attacker guesses $K_1, K_2$ ($2^{112}$) and checks against $2^{56}$ known pairs — Lucks's analysis: $2^{112}$ time + $2^{56}$ memory/data. Still infeasible, but far from $2^{168}$. Sweet32 (2016): 64-bit blocks collide after $2^{32}$ blocks ($\approx 32$ GB on one TLS connection) → 3DES banned in TLS (RFC 7525, SWEET32 CVE-2016-2183).

3. Performance and Migration Status

• 3× DES cost ($\approx 48$ Feistel rounds) for 112-bit effective security vs AES-128's 10 rounds — ~3–6× slower in software, bigger gates in HW.
• NIST SP 800-131A: 3-key 3DES allowed only for legacy decryption; new systems must use AES (2018+); payments industry (PCI) migrated to AES by 2023.
• Where it lingered: EMV cards, old VPNs, .NET TripleDESCryptoServiceProvider — exam "legacy-system" examples.
• Lesson: multiple encryption bought 20 years of migration time (1999–2020s) — exactly its design goal.

4. Triple DES vs AES (Closing Contrast)

Point	3-key 3DES	AES-128
Effective bits	$\approx 112$	$128$ (no MITM shortcut)
Block	64 (Sweet32)	128 (birthday $2^{64}$ blocks)
Speed	3× DES	~5× faster + AES-NI
Standard	Legacy-only	Current (FIPS-197)

Exam Points

• EDE formula + backward-compatibility logic ($K_1 = K_2 \Rightarrow$ single DES) — 2-mark opener.
• 2-key vs 3-key table with MITM numbers ($2^{80}$, $2^{112}$) — 5-mark core.
• Sweet32 $2^{32}$-block / 32 GB collision + TLS ban — favourite 2–3 marker.
• Performance-vs-AES migration verdict.