I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Well, the standard answer is to preserve compatibility with DES; a hardware circuit that implemented 3DES (with EDE) could also be used to do DES as well (by, say, making all three subkeys the same).
Now, there is one slight problem with this straightforward argument; 3DES (EEE, that is, with three encrypt operations) would have this property as well; if we select the first two subkeys to be the same weak key, the second encrypt with the weak key would exactly undo the first, and the plaintext block will be operated on by the third subkey (which is the DES operation we really want).
However, it's not the case that whoever designed 3DES missed this point. Instead, they were also considering a third option as well, 2 key 3DES (which is normal 3DES except that the first and the third subkeys are the same).
Now, if we had a 3DES EEE implementation with three independent subkeys, we could support DES (using the weak key trick), 2 key 3DES (EEE), and 3 key 3DES (EEE). However, that wasn't the only situation they had in mind; they also considered the case where someone implemented 2 key 3DES in hardware (which the first and last subkeys were constrained to be the same). That's one thing EEE mode can't do; we can't use the weak subkey trick with 2 key 3DES (if we make two of the adjacent subkeys the same weak key, then all three subkeys are the same weak key). However, the EDE trick still works.
Hence, the full answer is so that one hardware circuit can support both DES and 2 key 3DES (where the hardware circuitry insists on using the same subkeys for both the first and third subkeys), and also one hardware circuit can support DES, 2 key 3DES, and 3 key 3DES.