5
$\begingroup$

Why are credit cards using 3DES instead of AES? As far I understood, even DES3 is less secure than AES. Why it is still used?

I searched already in the internet and forum to check out if it is meanwhile AES (and the information from my lecture may be just old) but I didn't find any clue for that.

$\endgroup$
2
  • 4
    $\begingroup$ My experience, Finance companies & banks are the slowest to change their legacy systems. I have seen Java 4 being used years & years after it was deprecated. They are loath to change stuff unless something breaks. $\endgroup$
    – user93353
    Dec 14, 2022 at 12:46
  • 4
    $\begingroup$ That, and the fact that the amount of money a credit card company is potentially out from a single broken key is quite limited; they already have to deal with much more common risks (credit cards being stolen, credit card users declaring bankruptcy); the risk that 3DES adds is miniscule in comparison. $\endgroup$
    – poncho
    Dec 14, 2022 at 13:21

1 Answer 1

5
$\begingroup$

The main reason is history. Credit cards with chips have been around for longer than AES. However, it is not true that 3DES is strictly less secure than AES.

DES has two weaknesses compared with AES: its small key size, and its small block size. 3DES practically compensates for the small key size: with 112 bits, it's well out of reach of brute force attacks (and there are no better cryptanalytic attacks on DES or 3DES with independent keys). The small block size remains a concern, and that makes it inappropriate for large amounts of data exchanged by the same key. Sweet32 drove out 3DES for applications such as TLS and VPN. In banking, the volume of data is relatively small and block collision attacks would be inefficient.

AES has a major drawback: it's very prone to side channel attacks. A naive software implementation uses tables, which is vulnerable to timing attacks if the adversary can observe patterns of memory accesses, which is a concern both on any multi-application system with cache, and on a system where physical attacks are a concern. A hardware implementation can easily avoid timing-based leaks, but tends to leak similar information through power analysis. DES, in contrast, is more naturally resistant to power analysis. Physical attacks such as power analysis and fault injections are very much a concern on smartcards.

A historical note: when DES was designed in 1974, it's now publicly known that NSA got involved and pushed to make DES less resistant against brute force attacks (by reducing the key size from 64 bits to 56 bits), but more resistant against side channel attacks (it was tweaked to resist differential power analysis (DPA), which was not a publicly known attack technique at the time). When AES was designed in 1999 and selected by NIST in 2001, evidently, resistance against side channel attacks were not a priority.

$\endgroup$
4
  • $\begingroup$ Do you have a cite for the NSA's suggestions making it more resistant to DPA? I haven't heard that before and a quick search doesn't turn up anything obvious. $\endgroup$
    – bmm6o
    Dec 15, 2022 at 0:52
  • 2
    $\begingroup$ @bmm6o Wikipedia cites several references: Thomas R. Johnson, “American Cryptology during the Cold War”; Konheim, “Computer Security and Cryptography“; Steven Levy, “Crypto”. I haven't checked these revisions myself. Depending on the accounts, resistance against DPA might have come from IBM (and been approved by NSA) or might have come from NSA. $\endgroup$ Dec 15, 2022 at 11:13
  • $\begingroup$ "DES, in contrast, is more naturally resistant to power analysis." - I wonder how you got to this conclusion? At least for SW-implementations on smart cards my experience is that it's a bit easier to get the AES resistant against 2nd order DPA than the DES. $\endgroup$
    – j.p.
    Mar 21 at 7:14
  • $\begingroup$ The DES was tweaked to resist differential cryptanalysis, not differential power analysis. As the NSA was also involved in the selection of the AES, it would be strange that they insist on resistance against DPA for an encryption standard in the 70s, but not for its successor two decades later. $\endgroup$
    – j.p.
    Mar 21 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.