# Do 2DES and 3DES2 have the same effective key length?

I am following the notes "Introduction to Modern Cryptography" by Bellare and Rogaway, and on the chapter about blockciphers there is the following claim (page 11 of https://cseweb.ucsd.edu/~mihir/cse207/w-bc.pdf):

2DES, although having the same effective key length as 3DES2 and offering what appears to be the same or at least adequate security, is not popular in practice.

However, from what I understood, the effective length of 2DES is 57 bits, since it can be attacked by the meet-in-the-middle attack (this is stated on the end of page 10). On the other hand, the text says that 3DES2 does not appear to be target of meet-in-the-middle attacks, so its (effective) key length is 112 bits.

So I was wondering if I am missing something about these statements or if there might have been a mistake in the text (I did not find any errata).

• It's always refreshing to see that the great cryptographers of our time can make the same stupid mistakes as I sometimes do :) – Maarten - reinstate Monica Feb 23 '16 at 15:54

Definitely a mistake. The text clearly contradicts itself.

... 2DES has an effective key length of 57.

And later...

There does not appear to be a meet-in-the-middle attack on 3DES2 however, so that its key length of 112 is also its effective key length.

As a bit of an aside, 3DES2 is considered by NIST to have an effective key length of at least 80 bits, but definitely not the full 112 bits, due to its vulnerability to known-plaintext attacks with $2^{40}$ blocks.