I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is.

Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode. EDE is probably Encrypt-Decrypt-Encrypt and maybe the 3 means that 3 distinct keys are used?

It's somewhat mentioned in this question but it's not explained there and in the linked NIST standard the name does not exist. Then there is this OID but it doesn't define it. And the OpenSSL docs which again, list it but aren't clear about what it is.


3 Answers 3


At least in the context of PKCS#5 (which is commonly seen through the encryption of PEM files), DES-EDE3-CBC is Triple DES with three keys, used in CBC mode, with unspecified padding.

Yes, “EDE” means encrypt-decrypt-encrypt for encryption (and decrypt-encrypt-decrypt for decryption). It's implicit in “triple DES” anyway: choosing which direction is encryption and which one is decryption is arbitrary, but the de facto standard choice for triple DES is that 3DES encryption does more 1DES encryption than decryption and 3DES decryption does more 1DES decryption than encryption.

NIST SP 800-67 calls Triple-DES “TDEA”. “Triple-DES”, “3DES”, “DES3”, “TDEA”, “3DES-EDE”, “DES3-EDE”, “DES-EDE3” are synonyms, with one possible nuance, which is the number of different keys.

Triple-DES uses three keys: encrypt with $K_1$, decrypt with $K_2$, encrypt with $K_3$ (for the encryption direction). Obviously if $K_1 = K_2$ then the first two steps cancel out, and if $K_2 = K_3$ the last two steps cancel out, so $K_2$ must be distinct from both $K_1$ and $K_3$. It is possible to choose $K_1 = K_3$, however. This is called “two-key Triple-DES” (and variant names), while Triple-DES with $K_1 \ne K_3$ is “three-key Triple-DES”. More precisely, “three-key Triple-DES” means that $K_1$ and $K_3$ (and of course $K_2$) are generated independently (so there's a $2^{-56}$ chance of them being equal, but the probability of the easier attack is commensurably small with the amount by which it's easier, so that's no worse than “there's a $2^{-56}$ chance that the key is one specific value for which the attacker has precomputed tables”).

Due to the possibility of meet-in-the-middle attacks, three-key Triple-DES is almost as easy to break as two-key Triple-DES. (And the same attack makes double-DES almost as easy to break as single-DES, which is why double-DES isn't used.) Nonetheless, two-key Triple-DES has been deprecated for longer than three-key Triple-DES.

“Triple-DES” or “3DES-EDE” is ambiguous in whether using only two keys (i.e. $K_3 = K_1$) is permitted. Spelling it “DES-EDE3” is likely an indication that three distinct keys must be used. However, you need to check the specification of each protocol, since the subtle spelling distinctions are not always universally recognized. For example, PKCS#5 specifies that it is “three-key triple-DES”; writing out “three-key” does mean that the keys must be independent.


My guess is the same as that in the question: DES-EDE3-CBC most likely stands for

  • The block cipher TDEA (aka 3DES) with keying option 1 as defined by FIPS 46-3. This essentially is the DEA (aka DES) with three independent keys (24 bytes, of which 168 bits have an effect¹ on the output), with block encryption and decryption per $$C:=E_{(K_1,K_2,K_3)}(P)=E_{K_3}(D_{K_2}(E_{K_1}(P)))\\ P:=D_{(K_1,K_2,K_3)}(P)=D_{K_1}(E_{K_2}(D_{K_3}(C)))$$
  • Operation in CBC mode as defined by FIPS 81, which would be with ciphertext starting with a presumably random 8-byte Initialisation Vector $C_0$, and the rest of encryption and decryption of padded plaintext $P_i$ per (for $i>0$) $$C_i:=E_{(K_1,K_2,K_3)}(P_i\oplus C_{i-1})\\ P_i:=D_{(K_1,K_2,K_3)}(C_i)\oplus C_{i-1}$$

That leaves the plaintext padding untold. it could be appending the bytes '80' then as many '00' (possibly none) as necessary to reach a multiple of 8 bytes. Or no padding, if the payload is inherently multiple of 8 bytes. Or something else, like PKCS#5 padding. Unless the OP tells where they "came across DES-EDE3-CBC", I don't see how we can tell.

The only good reason to use this mode of operation nowadays is compatibility. AES-GCM is a functional upgrade: it provides authentication, better security, does not require a padding convention, and uses marginally more space.

¹ The cryptanalytic security is lower, see Stefan Lucks's attacking triple encryption, in proceedings of FSE 1998.

  • $\begingroup$ Isn't option-1 3DES 112 effective bits because you can perform a meet-in-the-middle attack? $\endgroup$
    – Mark
    Commented Jul 29, 2022 at 2:33
  • $\begingroup$ @Mark: I had used "effective" in the literal sense of having an effect on the output. Expanded on that. $\endgroup$
    – fgrieu
    Commented Jul 29, 2022 at 4:29

DES-EDE3 is variant of Triple DES (3DES) - https://en.wikipedia.org/wiki/Triple_DES

  • 7
    $\begingroup$ Please post complete answers, rather than a positive indication and a link. That page doesn't literally contain EDE3, so more explanation would be needed. Furthermore, you say that it is a "variant" of triple DES, in which case you should indicate how it differs. $\endgroup$
    – Maarten Bodewes
    Commented Jul 28, 2022 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.