Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently working on crypto tools to encrypt/decrypt 4 blocks of messages using Triple-DES with 2 keys. So, I've reached the final cipher text, but now I have to do the reverse and get the plaintext message. However I'm sort of confused with the decryption process.

For the Encryption, I encrypted using K1, decrypted used K2 and encrypted again using K1, then I XOR-ed the result with the 2nd block of plaintext message and so on, until I reached the last one. Now I want to decrypt and I'm sort of confused on where the XOR-ing comes in.

share|improve this question

See the Wikipedia article on 3DES:

First of all, you are only using 2 keys, so you may want to follow a hybrid technique like this:

encrypted = eK1( dK2( plainText ) )
plainText = eK2( dK1( encrypted ) )

However, because I'm not familiar with the DES algorithm, I can't guarentee that this approach is even secure. You may want to follow 3DES more strictly and use 3 different randomly-generated keys. Or use a more secure algorithm.

As for the CBC aspect (the XOR-ing), you need to follow the algorithm:

For encryption, you use the result ciphertext as the IV for the next encryption. For decryption, you use the pre-ciphertext as the IV for the next decryption.

share|improve this answer
I searched it up and it's basically a triple DES using a CBC mode (Cipher block chaining mode) where the output of the first E-D-E process is considered as the IV for the next round so that is where the XOR-ING comes in. As for the keys, I'm asked to use 2 different keys where E(k1) - D(K2) - E(k1) – Scarl Mar 20 '14 at 17:43
Using just 2 encrypt/decrypt stages with DES is not secure, because a meet in the middle attack will break it down into just breaking DES twice. The triple DES variant with only 2 keys is noted in the wiki article as "keying option 2", where $K_1=K_3$. Worth reading is the wiki section "Security" about this option. – tylo Mar 20 '14 at 17:47
@tylo I agree with you, and i'm currently reading it, but I was asked to use the way I mentioned. – Scarl Mar 20 '14 at 17:49
I updated the answer to reflect CBC mode. – James Watkins Mar 20 '14 at 17:51
Great, but for the first decryption process what is the IV going to be? I mean I will start off by the cipher text I got, then I'll decrypt it with K2 then Encrypt it with K1 then Decrypt it with K2 again then that result I'll XOR it with the I right? – Scarl Mar 20 '14 at 17:54

Your problem is which part of the algorithm has to be transmitted (and you are missing an actual IV).

Your encryption algorithm of using $TDEA(m)=E_{K_1}(D_{K_2}(E_{K_1}(m)))$ is fine for encrypting a single block, and it can be used in CBC.

However, in CBC with a message of 4 blocks $m=(m_1,m_2,m_3,m_4)$, you calculate this:

  • Choose random $iv$.
  • $c_1=TDEA(m_1\oplus iv)$
  • $c_2=TDEA(m_2\oplus c_1)$
  • $c_3=TDEA(m_3\oplus c_2)$
  • $c_4=TDEA(m_4\oplus c_3)$

The ciphertext then is $c=(c_1,c_2,c_3,c_4)$, and you have to transmit the $iv$. If you just transmit $c_4$, you can not extract any information. Decryption starts with reversing the $TDEA$ algorithm and then XOR the result with the previous ciphertext block or the $iv$.

share|improve this answer
This is the correct solution. The last IV must be transmitted along with the ciphertext. – James Watkins Mar 20 '14 at 18:30
Your comment might be confusing, due to "last $iv$". The $iv$ does not change. And in fact, if you denote the value inside the encryption function and is XORed on the plaintext as "$iv$", then $c_3$ is in the ciphertext anyway. The original $iv$ has to be transmitted, so that the first block can be decrypted at all; the other 3 blocks can be decrypted with the entire ciphertext already. – tylo Mar 20 '14 at 18:37
This makes sense, so your saying to decrypt i will use c4 and lets say the last message as an IV to begin with? – Scarl Mar 21 '14 at 13:45
To get $m_1$, you decrypt $c_1$ and then XOR it with $iv$. To get $m_2$, you decrypt $c_2$ and XOR the result with $c_1$, to get $m_3$, you decrypt $c_3$ and XOR the result with $c_2$, to get $m_4$, you decrypt $c_4$ and XOR the result with $c_3$. – tylo Mar 24 '14 at 11:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.