Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?

share|improve this question
Duplicate on Security SE:… – PulpSpy Mar 9 '12 at 15:59
up vote 24 down vote accepted

Well, the standard answer is to preserve compatibility with DES; a hardware circuit that implemented 3DES (with EDE) could also be used to do DES as well (by, say, making all three subkeys the same).

Now, there is one slight problem with this straightforward argument; 3DES (EEE, that is, with three encrypt operations) would have this property as well; if we select the first two subkeys to be the same weak key, the second encrypt with the weak key would exactly undo the first, and the plaintext block will be operated on by the third subkey (which is the DES operation we really want).

However, it's not the case that whoever designed 3DES missed this point. Instead, they were also considering a third option as well, 2 key 3DES (which is normal 3DES except that the first and the third subkeys are the same).

Now, if we had a 3DES EEE implementation with three independent subkeys, we could support DES (using the weak key trick), 2 key 3DES (EEE), and 3 key 3DES (EEE). However, that wasn't the only situation they had in mind; they also considered the case where someone implemented 2 key 3DES in hardware (which the first and last subkeys were constrained to be the same). That's one thing EEE mode can't do; we can't use the weak subkey trick with 2 key 3DES (if we make two of the adjacent subkeys the same weak key, then all three subkeys are the same weak key). However, the EDE trick still works.

Hence, the full answer is so that one hardware circuit can support both DES and 2 key 3DES (where the hardware circuitry insists on using the same subkeys for both the first and third subkeys), and also one hardware circuit can support DES, 2 key 3DES, and 3 key 3DES.

share|improve this answer
I am pretty sure DES-EEE2 is exactly as feasible to implement as DES-EDE2. – Henrick Hellström Mar 9 '12 at 14:40
@Henrick Hellstrom: Yes, however, DES-EEE2 would not be backwards-compatible with DES; you could not arrange the DES-EEE2 subkeys in a way so that it would be exactly the same as a specific DES key. You can with DES-EDE2. – poncho Mar 9 '12 at 14:44
Another advantage is that you can support 3DES, both encryption and decryption, with just two encryptors and two decryrptors. If it was EEE, you'd need three encryptors to encrypt and three decryptors to decrypt. – David Schwartz Mar 10 '12 at 0:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.