Can we use EED with 2 keys $(k_1, k_1, k_3)$ rather than EDE $(k_1, k_2, k_1)$? We measure the strength of DES by the effort (in terms of the number of tries) in finding some $k_1$ & $k_2$ to match a known plaintext and ciphertext pair.

Will EED have the same strength as EDE? Which one is stronger?

  • $\begingroup$ Can you be more specific about what you don't understand? $\endgroup$
    – mikeazo
    Commented Feb 10, 2015 at 18:04
  • $\begingroup$ EDE is only about having the same thing as the normal DES if all three keys are equal. It's for old systems which still rely on the "normal" DES. $\endgroup$
    – Nova
    Commented Feb 10, 2015 at 18:12
  • $\begingroup$ Hint: compare the resistance of EED with (K1,K1,K3) to that of EDE (K1,K2,K1), versus a basic meet in the middle attack. $\endgroup$
    – fgrieu
    Commented Feb 10, 2015 at 20:16
  • $\begingroup$ Of course in general we don't try and use DES at all anymore. Although this question is interesting from a theoretical point of few, please use a newer cipher such as AES for practical needs. $\endgroup$
    – Maarten Bodewes
    Commented Feb 11, 2015 at 2:37

1 Answer 1


Concerning $(k_1, k_2, k_1)$ vs. $(k_1, k_1, k_2)$

$(k_1, k_1, k_2)$ can be split into $(k_1, k_1)$ with $2^{56}$ possibilities and $(k_2)$ with $2^{56}$ possibilities, so the meet-in-the-middle attack has cost $2^{56}$.

$(k_1, k_2, k_1)$ can be split into $(k_1, k_2)$ with $2^{112}$ possibilities and $(k_2)$ with $2^{56}$ possibilities or into $(k_1)$ with $2^{56}$ possibilities and $(k_2, k_1)$ with $2^{112}$, so no matter how you split it, the attack costs $2^{112}$.

=> $(k_1, k_2, k_1)$ is much stronger than $(k_1, k_1, k_2)$

Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?

Concerning EDE vs EED

Choosing encryption vs. decryption for the three steps has no effect on security.

By setting all keys to the same value you can emulate DES using 3DES with EDE and EED but not with EEE. Not sure if EDE offers any advantages over EED, except looking nicer due to being symmetric.

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.