# 3DES Modes EED or EDE?

Can we use EED with 2 keys $$(k_1, k_1, k_3)$$ rather than EDE $$(k_1, k_2, k_1)$$? We measure the strength of DES by the effort (in terms of the number of tries) in finding some $$k_1$$ & $$k_2$$ to match a known plaintext and ciphertext pair.

Will EED have the same strength as EDE? Which one is stronger?

• Can you be more specific about what you don't understand? – mikeazo Feb 10 '15 at 18:04
• EDE is only about having the same thing as the normal DES if all three keys are equal. It's for old systems which still rely on the "normal" DES. – Nova Feb 10 '15 at 18:12
• Hint: compare the resistance of EED with (K1,K1,K3) to that of EDE (K1,K2,K1), versus a basic meet in the middle attack. – fgrieu Feb 10 '15 at 20:16
• Of course in general we don't try and use DES at all anymore. Although this question is interesting from a theoretical point of few, please use a newer cipher such as AES for practical needs. – Maarten Bodewes Feb 11 '15 at 2:37

## Concerning $(k_1, k_2, k_1)$ vs. $(k_1, k_1, k_2)$

$(k_1, k_1, k_2)$ can be split into $(k_1, k_1)$ with $2^{56}$ possibilities and $(k_2)$ with $2^{56}$ possibilities, so the meet-in-the-middle attack has cost $2^{56}$.

$(k_1, k_2, k_1)$ can be split into $(k_1, k_2)$ with $2^{112}$ possibilities and $(k_2)$ with $2^{56}$ possibilities or into $(k_1)$ with $2^{56}$ possibilities and $(k_2, k_1)$ with $2^{112}$, so no matter how you split it, the attack costs $2^{112}$.

=> $(k_1, k_2, k_1)$ is much stronger than $(k_1, k_1, k_2)$

Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?

## Concerning EDE vs EED

Choosing encryption vs. decryption for the three steps has no effect on security.

By setting all keys to the same value you can emulate DES using 3DES with EDE and EED but not with EEE. Not sure if EDE offers any advantages over EED, except looking nicer due to being symmetric.

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

Encryption-Decryption-Encryption