128 bit 3DES Key and AES Key: what's the difference?

Question

Apologies if this is really basic but I couldn't find the answer to this.

I have heard some Info Sec colleagues talking about creating an AES key in preference to a DES or 3DES key but I don't know the difference; I thought a key was just a random string of bits? Is there a difference? Can you use the same key with different algorithms? i.e. a 128 bit key with 3DES and also with AES?

Answer 1

Both an AES-128 key (as defined by FIPS 197), and a TDES Keying Option 2 key (as defined by FIPS SP-800-67) are 128-bit bitstrings. Similarly, both an AES-192 key and a TDES Keying Option 1 key are 192-bit bitstrings. The differences are:

• In AES, all bits of a key matter to the result; in TDES, 1 bit out of 8 (the lower-order bit of each byte in the usual representation) either

  1. is ignored, and can have any value;
  2. is checked, and must be the complement of the exclusive-OR of the 7 others; that is, each byte is adjusted to odd parity; see this answer for details on the oddity (pun intended) of DES key bytes.
• TDES has a complementation property, which removes an extra bit of security for a given key size in many situations (including CPA attack); that further reduces a 128-bit TDES Keying Option 2 key to 111-bit strength, and a 192-bit TDES Keying Option 1 key to 167-bit strength.
• The block size is 128-bit for AES, 64-bit for TDES; this means that AES and TDES are not interchangeable, even though they use the same key (analogy: truck and car are not interchangeable, even though both might run on gasoil). As rightly pointed in that other answer, that block size difference also makes a security difference in some applications.
• AES is unbroken for any practical purpose, but there are attacks on TDES (at least, with Keying Option 2) using conceivable amounts of computing power and not-far-from-conceivable amounts of memory.
• I'm leaving alone the non-issue of DES weak and semi-weak keys, which is immaterial in practice, and much more for TDES.

If one generates a TDES key with knowledge that 1 above will apply when it will be used, one can generate the key at random just as for an AES key (there might be different regulatory requirements). If one generates a TDES key with knowledge that 2 above will apply (or does not have such knowledge but want to err on the compatible side), one must adjust the low-order bit of each byte according to the 7 other bits.

One can use a TDES key for AES (AES-128 or AES-192 depending on TDES keying option); however, if the key was generated with low-order bit adjustment, that weakens AES-128 by $2^{16}$ w.r.t. brute force key search, which is (somewhat) undesirable and (very) unusual (AES-192 would be weakened by $2^{24}$, which likely is still strong enough except perhaps from a certification standpoint).

One can use an AES key for TDES (assuming matching key option) if

• the TDES implementation does not check parity (case 1 above);
• or the AES key is parity-adjusted to transform it into a TDES key.

In any case, it would be a bad idea to use the same key for both AES and TDES, for a successful key recovery attack on either cipher (e.g. by DPA) would then translate into an attack breaking the other.

Answer 2

There are some differences between the keys of AES and 3DES. However I do think that your colleagues are more interested in the security of the primitive itself. The AES block cipher is rather more secure than triple DES.

If a 128 bit triple DES key is created the amount of effective key bits - the bits actually used in the protocol - is 112 bits. This is because there is one bit (the least significant one) in each byte assigned to create odd parity. This way the correctness of the key can be validated with certainty if a bit is flipped by mistake. Some implementations require these parity bits to be set correctly, other implementations simply ignore the parity bits.

A 128 bit triple DES key $K$ actually contains 2 keys, key $A$ and key $B$. Both keys are 64 bit (56 bit effective). These keys are used in single DES mode: $E_K(m) = E_A(D_B(E_A, mesg)))$. However because of a meet-in-the-middle attack on this scheme the security margin of this scheme with two DES keys is only about 83 bits or so. When three keys are used (as in $E_K(m) = E_C(D_B(E_A, mesg)))$ the security margin is about 112 bits.

AES-128 on the other hand uses all 128 bits of the key, and provides a security margin that is almost but not quite the same as the key size (over 127 bits). Furthermore the AES block cipher is faster, has less quirks (such as parity bits, weak keys) and has a larger block size - which is required for some (authenticated) modes of operation.

Two key triple DES has effectively been deprecated by NIST, and should only be used for legacy applications. Three key triple DES is still acceptable according to NIST SP800-131A, although it is still strongly recommended to choose AES instead.

---

As for your last question, yes, usually it is possible to use a "raw" 128 bit key for either 3DES ABA (see above) or AES. However in general it is not advisable to use the same key for different algorithms or purposes. It depends on the implementation if parity is checked for DES keys.

Also note that keys may not just be represented by a raw binary encoding. In a PKCS#11 token for instance (HSM or smart card, etc.) the key contains the algorithm name, a algorithm dependend KCV etc. In those circumstances it is not possible to just mix keys and algorithms.

Answer 3

The key itself is really just a bitstring for (nearly?) all block ciphers. You can use the same key for different algorithms, but the cipher may need keys of different lengths. For example, AES can use keys with 128, 192 and 256 bit. 3DES is slightly more complex. It can use 2 keys or 3 keys with each 56 bit. 1 key would also be possible, but is not really useful. If you have 112 key bits, you can create 2 keys for 3DES or you can pad the key material up to 128, 192 or 256 bits and then use AES.

If you want to use the same key for different algorithms it is advisable to change one of the keys slightly in a predictable way. This would prevent any special attacks against using the same key two times. (You could hash the key once and use the output for the second algorithm.)

This is only true for "normal" block ciphers like DES, AES, Twofish, ..., but not for asymmetric cryptography like RSA. You need special key material for most of them.

I have heard some info sec colleagues talking about creating an AES key in preference to a DES or 3DES key

I would say that's only about prefering AES above 3DES because it is faster and the new standard. Maybe they also didn't want to care about special weak keys. DES has some, while AES has no weak keys (as far as we know).