I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?
$\begingroup$
$\endgroup$
1
-
5$\begingroup$ Duplicate on Security SE: security.stackexchange.com/questions/1886/… $\endgroup$– PulpSpyMar 9, 2012 at 15:59
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
6
Well, the standard answer is to preserve compatibility with DES; a hardware circuit that implemented 3DES (with EDE) could also be used to do DES as well (by, say, making all three subkeys the same).
Now, there is one slight problem with this straightforward argument; 3DES (EEE, that is, with three encrypt operations) would have this property as well; if we select the first two subkeys to be the same weak key, the second encrypt with the weak key would exactly undo the first, and the plaintext block will be operated on by the third subkey (which is the DES operation we really want).
However, it's not the case that whoever designed 3DES missed this point. Instead, they were also considering a third option as well, 2 key 3DES (which is normal 3DES except that the first and the third subkeys are the same).
Now, if we had a 3DES EEE implementation with three independent subkeys, we could support DES (using the weak key trick), 2 key 3DES (EEE), and 3 key 3DES (EEE). However, that wasn't the only situation they had in mind; they also considered the case where someone implemented 2 key 3DES in hardware (which the first and last subkeys were constrained to be the same). That's one thing EEE mode can't do; we can't use the weak subkey trick with 2 key 3DES (if we make two of the adjacent subkeys the same weak key, then all three subkeys are the same weak key). However, the EDE trick still works.
Hence, the full answer is so that one hardware circuit can support both DES and 2 key 3DES (where the hardware circuitry insists on using the same subkeys for both the first and third subkeys), and also one hardware circuit can support DES, 2 key 3DES, and 3 key 3DES.
-
$\begingroup$ I am pretty sure DES-EEE2 is exactly as feasible to implement as DES-EDE2. $\endgroup$ Mar 9, 2012 at 14:40
-
1$\begingroup$ @Henrick Hellstrom: Yes, however, DES-EEE2 would not be backwards-compatible with DES; you could not arrange the DES-EEE2 subkeys in a way so that it would be exactly the same as a specific DES key. You can with DES-EDE2. $\endgroup$– ponchoMar 9, 2012 at 14:44
-
9$\begingroup$ Another advantage is that you can support 3DES, both encryption and decryption, with just two encryptors and two decryrptors. If it was EEE, you'd need three encryptors to encrypt and three decryptors to decrypt. $\endgroup$ Mar 10, 2012 at 0:49
-
1$\begingroup$ Are there any security related motives as well documented? Like maximizing the structural differences of the operations while sticking to the same algorithm? $\endgroup$– eckesApr 28, 2017 at 1:47
-
3$\begingroup$ @eckes: not really; DES encryption and DES decryption are actually essentially the same operation (except you process the subkeys in the opposite order) $\endgroup$– ponchoApr 28, 2017 at 12:34
$\begingroup$
$\endgroup$
Another reason is that EEE results in slightly reduced brute-force attack time. First step of DES is an initial permutation which is key independent and last step of DES is the inverse of this permutation. With EEE the inverse permutation at the end of the first encryption would be cancelled out by the initial permutation of the second encryption (same for inverse of second and initial of third encryption). This is not the case for EDE.
