Ciphers · Modern symmetric ciphers
Triple DES
DES three times over. How EDE works, why the strength is only 112 bits, and how the Sweet32 attack finished it.
Triple DES (3DES, officially TDEA) runs the old DES cipher three times on each block, with two or three keys. It turns the 56-bit key of a cipher that could be brute-forced in 1998 into one that can't. It bridged the gap between DES and AES and still turns up in older payment systems. It's being switched off now because its 64-bit block is too small for the amounts of data modern systems encrypt.
How it works
Each 64-bit block goes through DES three times, in the order encrypt with K1, decrypt with K2, encrypt with K3 (EDE). The middle step is a decryption on purpose. If K1 = K2 = K3, the first two steps cancel and the whole thing is single DES, so 3DES hardware can still talk to old DES systems. There are three keying options:
- Three independent keys (168 key bits). The strongest, though the meet-in-the-middle attack cuts its effective strength to about 112 bits.
- Two keys, with K3 = K1 (112 key bits). NIST assigned this about 80 bits of security and disallowed it in 2015.
- One key repeated, which is just DES. No longer allowed.
The library on this site implements it, and the test suite checks it against OpenSSL on random keys in both the two-key and three-key forms. It also confirms that with one key repeated, 3DES gives the single-DES result for the standard example (85E813540F0AB405). With the three keys 0123456789ABCDEF, 23456789ABCDEF01 and 456789ABCDEF0123, the block 0123456789ABCDEF becomes F2AFD84EE809E2B5.
The price is speed. Three DES operations of 16 rounds each make 48 rounds per block, so 3DES runs about three times slower than DES and much slower than AES, which needs 10 to 14 rounds on a block twice the size.
Why three, and not two or four
Why not just encrypt twice, with two keys (double DES)? Because of a meet-in-the-middle attack. An attacker who knows one plaintext and its ciphertext can encrypt the plaintext under every possible first key (256 results), decrypt the ciphertext under every possible second key (256 more), and look for a match in the middle. That takes about 257 operations, not the 2112 you'd expect, though it needs a large table. The same attack on three-key 3DES costs about 2112, which is why its strength is 112 bits and not 168. Three passes was the smallest number that put a brute-force attack out of reach.
History
Walter Tuchman proposed two-key triple encryption in 1978, and Ralph Merkle and Martin Hellman proposed the three-key version in 1981. After Deep Crack showed in 1998 that DES was too short, NIST's FIPS 46-3 of October 1999 made Triple DES the preferred form of the standard. As of 2008 the electronic payment industry used 3DES, including in EMV chip cards. It lived far longer than anyone planned, because the hardware in banks and cash machines was slow to change.
Why it's being retired: Sweet32
3DES's real problem is its 64-bit block. In a mode such as CBC, the ciphertext blocks of a long message eventually repeat by chance, and a repeat leaks the XOR of two plaintext blocks. By the birthday bound, a repeat becomes likely after about 232 blocks. At 8 bytes a block, that's 32 GiB, easily reached on a long-lived connection. Karthikeyan Bhargavan and Gaëtan Leurent showed in 2016 (the Sweet32 attack, discovered 24 August 2016, CVE-2016-2183) that this was practical against TLS and OpenVPN: they got a collision after about 220 blocks in 25 minutes. NIST SP 800-67 Rev. 2 limits each key bundle to 220 blocks, which is 8 MiB. NIST announced the deprecation of 3DES between 2017 and 2019 and disallowed every use except processing already-encrypted data after 2023. OpenSSL left it out of its default build from version 1.1.0 (August 2016), Microsoft announced it would retire it from Office 365 in December 2018, and Firefox 144 (2025) changed its saved-password encryption from 3DES to AES-256.
Every cipher with a 64-bit block shares the problem, including Blowfish. The 128-bit block of AES pushes the same bound out to 264 blocks, which nobody can reach.
The code
Triple DES on top of any single-DES function.
// Triple DES, encrypt-decrypt-encrypt. `des(block, key, decrypt)` is any single-DES function. With k1 = k2 = k3 the middle step undoes the
// first and this is single DES, which is how it stays compatible with old systems.
function tripleDes(des, block, k1, k2, k3, decrypt) {
if (!decrypt) return des(des(des(block, k1, false), k2, true), k3, false); // E(K1), then D(K2), then E(K3)
return des(des(des(block, k3, true), k2, false), k1, true); // the same steps backwards
}Common questions
Is Triple DES secure?
For small amounts of data under one key, no practical attack exists on three-key 3DES. For large amounts the 64-bit block allows the Sweet32 attack, which is why NIST first limited it and then disallowed it.
Why does it encrypt, decrypt, encrypt?
So that setting all three keys the same gives single DES, which keeps new equipment compatible with old.
Is Triple DES three times as strong as DES?
No. It has 168 key bits, 112 more than DES's 56, but meet-in-the-middle attacks cut the effective strength to about 112 bits. It's also about three times slower.
Can I still decrypt old 3DES data?
Yes. NIST's rules allow processing data that was already encrypted, and OpenSSL and other libraries still include the cipher when you ask for it. The rules forbid new encryption with it, so re-encrypt old data with a modern cipher when you can.
On the timeline
- 1978 Walter Tuchman proposes two-key Triple DES; the three-key form follows from Merkle and Hellman in 1981.
- 25 October 1999 FIPS 46-3 makes Triple DES the preferred form of DES.