# Decrypting Triple-DES using 2 keys in crypto tools

I'm currently working on crypto tools to encrypt/decrypt 4 blocks of messages using Triple-DES with 2 keys. So, I've reached the final cipher text, but now I have to do the reverse and get the plaintext message. However I'm sort of confused with the decryption process.

For the Encryption, I encrypted using K1, decrypted used K2 and encrypted again using K1, then I XOR-ed the result with the 2nd block of plaintext message and so on, until I reached the last one. Now I want to decrypt and I'm sort of confused on where the XOR-ing comes in.

-

See the Wikipedia article on 3DES: http://en.wikipedia.org/wiki/Triple_DES#Algorithm

First of all, you are only using 2 keys, so you may want to follow a hybrid technique like this:

encrypted = eK1( dK2( plainText ) )
plainText = eK2( dK1( encrypted ) )


However, because I'm not familiar with the DES algorithm, I can't guarentee that this approach is even secure. You may want to follow 3DES more strictly and use 3 different randomly-generated keys. Or use a more secure algorithm.

As for the CBC aspect (the XOR-ing), you need to follow the algorithm: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher-block_chaining_.28CBC.29

For encryption, you use the result ciphertext as the IV for the next encryption. For decryption, you use the pre-ciphertext as the IV for the next decryption.

-
I searched it up and it's basically a triple DES using a CBC mode (Cipher block chaining mode) where the output of the first E-D-E process is considered as the IV for the next round so that is where the XOR-ING comes in. As for the keys, I'm asked to use 2 different keys where E(k1) - D(K2) - E(k1) – Scarl Mar 20 '14 at 17:43
Using just 2 encrypt/decrypt stages with DES is not secure, because a meet in the middle attack will break it down into just breaking DES twice. The triple DES variant with only 2 keys is noted in the wiki article as "keying option 2", where $K_1=K_3$. Worth reading is the wiki section "Security" about this option. – tylo Mar 20 '14 at 17:47
@tylo I agree with you, and i'm currently reading it, but I was asked to use the way I mentioned. – Scarl Mar 20 '14 at 17:49
I updated the answer to reflect CBC mode. – James Watkins Mar 20 '14 at 17:51
Great, but for the first decryption process what is the IV going to be? I mean I will start off by the cipher text I got, then I'll decrypt it with K2 then Encrypt it with K1 then Decrypt it with K2 again then that result I'll XOR it with the IV..am I right? – Scarl Mar 20 '14 at 17:54

Your problem is which part of the algorithm has to be transmitted (and you are missing an actual IV).

Your encryption algorithm of using $TDEA(m)=E_{K_1}(D_{K_2}(E_{K_1}(m)))$ is fine for encrypting a single block, and it can be used in CBC.

However, in CBC with a message of 4 blocks $m=(m_1,m_2,m_3,m_4)$, you calculate this:

• Choose random $iv$.
• $c_1=TDEA(m_1\oplus iv)$
• $c_2=TDEA(m_2\oplus c_1)$
• $c_3=TDEA(m_3\oplus c_2)$
• $c_4=TDEA(m_4\oplus c_3)$

The ciphertext then is $c=(c_1,c_2,c_3,c_4)$, and you have to transmit the $iv$. If you just transmit $c_4$, you can not extract any information. Decryption starts with reversing the $TDEA$ algorithm and then XOR the result with the previous ciphertext block or the $iv$.

-
This is the correct solution. The last IV must be transmitted along with the ciphertext. – James Watkins Mar 20 '14 at 18:30
Your comment might be confusing, due to "last $iv$". The $iv$ does not change. And in fact, if you denote the value inside the encryption function and is XORed on the plaintext as "$iv$", then $c_3$ is in the ciphertext anyway. The original $iv$ has to be transmitted, so that the first block can be decrypted at all; the other 3 blocks can be decrypted with the entire ciphertext already. – tylo Mar 20 '14 at 18:37
This makes sense, so your saying to decrypt i will use c4 and lets say the last message as an IV to begin with? – Scarl Mar 21 '14 at 13:45
To get $m_1$, you decrypt $c_1$ and then XOR it with $iv$. To get $m_2$, you decrypt $c_2$ and XOR the result with $c_1$, to get $m_3$, you decrypt $c_3$ and XOR the result with $c_2$, to get $m_4$, you decrypt $c_4$ and XOR the result with $c_3$. – tylo Mar 24 '14 at 11:47