If we want to make three successive DES encryptions or decryption using 2 secret keys
K2 at least one time, and possibly a public constant
C0 used as key, we are bound to chose among the following six possibilities (listed by alphabetical order, ignoring configurations equivalent by exchange of
K2); all except number 5 are vulnerable to a basic meet-in-the-middle attack, at the meeting point indicated by
. (the condition for a meeting point being that there is only one unknown key on each side):
C0 K1 . K2
K1 C0 . K2
K1 K1 . K2
K1 . K2 C0
K1 K2 K1
K1 . K2 K2
K1 K2 K1 is the only choice to keep 3DES with two keys safe from the basic meet-in-the-middle attack.
That reasoning works regardless of if we use the keys in an Encrypt-Decrypt-Encrypt mode (as we do, making choices 3 and 6 unsuitable), or Encrypt-Encrypt-Encrypt mode (which as pointed by poncho would not allow a fall-back to simple-DES from two-key TDES with
K1 K2 K1 schedule).