We know that NIST disallows TDES (PDF).

So why is PCI still allowing DUKPT TDES? They do use one unique key per transaction.

Is there any supporting logic or official statement for it?

  • 3
    $\begingroup$ AFAIK backwards compatibility / legacy hardware. Payment is very conservative. $\endgroup$
    – Maarten Bodewes
    Commented Apr 19 at 13:44
  • 1
    $\begingroup$ @MaartenBodewes this is a human issue that people do not like changes after some age. $\endgroup$
    – kelalaka
    Commented Apr 19 at 13:57
  • 2
    $\begingroup$ Also true, but at least there were a few people from the banking community at the latest PQC conference I went to. Basically banking only upgrades when really required. TDES is certainly not the only archaic algorithm that the banking industry uses, RSA is also used, often with older schemes and with very low key sizes. $\endgroup$
    – Maarten Bodewes
    Commented Apr 19 at 14:04

1 Answer 1


The payment card industry is somewhat special in that most of the hardware involved in their networks is owned by other people, notably individual merchants, who own the terminals and payment devices that process cards. There are also payment gateways that process these transactions, as well as the card networks themselves, and the actual issuers (the banks that issue the credit or debit cards).

Merchant terminals are intended to have a very long life because they're expensive and many businesses don't want to spend money they don't have to. That's especially true for small businesses and low-margin businesses (like grocery stores), where the cost of terminals really eats into profits. This means that a lot of the hardware processing payment cards is much older. Even several years after the U.S. chip liability shift, there are many merchants, especially restaurants and coffee shops (including, notably, even some locations of large chains), where chip is not available because the cost of fraud is lower than the cost of upgrading.

Similarly, many banks have a lot of older systems, including mainframes and ATMs. White label ATMs, which are owned by non-financial institutions, are also very common, and in many cases upgrading them means replacing them, usually at substantial cost. The availability of an ATM is a strong competitive factor for many banks and merchants, and forcing an immediate upgrade would mean many of those would go away.

It should be noted that some certificate authorities specifically stopped issuing certificates for the public web because they couldn't do so and still issue the certificates using SHA-1 that many of the existing terminals they still supported required. (Of course, changing CAs for no-longer-supported terminals was not possible.) In fact, it was not even until 2021 that it was possible to use an algorithm other than SHA-1 in EMV (which came about with the support for ECC in Bulletin 243), and we've known for some time that SHA-1 was very weak for a long time. It will likely be a very extended period of time before ECC (or SHA-2) can be practically deployed at any scale in EMV.

Also note that this also all applies internationally. I expect I can take my Canadian-issued card and use it anywhere in the world, at any ATM or merchant bearing the appropriate logo, and it just works. That means the amount of coordination required here is very substantial and also applies to a variety of businesses around the world with varying economic systems and levels of income, operating in hundreds or thousands of languages.

Triple DES, when used in a 3-key configuration, is still more secure than SHA-1 and is not practically attackable using our current resources. Due to the nature of getting upgrades deployed, changing algorithms is quite hard, and while of course it would be prudent to adopt the latest security standards as soon as possible, it is practically very difficult to do.

I'm certain that there are lots of parties that would like the transition to move a lot faster (probably the card networks, specifically), and for networks with more limited geographical constraints, upgrades happen more quickly (such as the full transition to chip-only on Interac, the main Canadian debit network). However, it's likely that things will continue to move more slowly absent a more substantial attack on Triple DES.

I of course don't have any official statement, but then again, I doubt you'll find one given the above.

  • $\begingroup$ but still that doesn't justify the PCI body allowing new readers embrace still old technology, hence making the shift even hard and time prone, thus making security a laughing stock. At least for newer devices to market should not have definitely have those weaker algorithms, $\endgroup$
    – buddy
    Commented Apr 22 at 11:20
  • 1
    $\begingroup$ It's not just the new readers, but the issuers as well. For example, a bank might have older hardware that only handles Triple DES in some cases, and the readers still need to be able to handle that gracefully. Certainly the banks and credit unions that issue cards are well suited to handle the expense of upgrades, but they also set the standards and that's expensive, so…. $\endgroup$
    – bk2204
    Commented Apr 23 at 17:25
  • $\begingroup$ In that case, yes they should allow the both technology in the new readers, and mandating the newer technology to be present, so its future compatible. Otherwise, it will go an for ever, making the embrace of newer safer standard a distant dream. And devices signed by PCI, is not safer for the end users, and hence PCI can be made liable. $\endgroup$
    – buddy
    Commented Apr 24 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.