# Special case of 3DES

3DES uses EDE as it is backward compatible to single DES, but consider the following case $K_1$=$K_2$=$K_3$ which one is more secure EDE or EEE.

• Compatibility always win. – fgrieu Oct 4 '16 at 8:36
• Actually, 3DES EEE mode is also backwards compatible to DES, because of the DES weak keys... – poncho Oct 5 '16 at 12:15
• Poncho's obseravation is that EEE mode is backwards compatible to DES when we set $K_1=K$ and $K_2=K_3=\mathtt{0x0101010101010101}$. – fgrieu Oct 5 '16 at 15:53

EEE with $K_1$=$K_2$=$K_3$ is measurably less insecure than EDE with $K_1$=$K_2$=$K_3$, because the former has 48 rounds, but the later reduces to just one encryption E, thus 16 rounds. Two consequences:

1. This makes brutes force require 3 times more rounds, thus adds about $\log_2(3)\approx 1.58$ bit of practical security against brute force (security in bits grows as the base-2 log of the computational effort); however that remains way too low, and was so even in 1999. Brute force is the typical attack against single DES, and works fine including for EEE with 3 equal keys.
2. This regains up to like a dozen bits of security that otherwise might be lost to cryptographic weakness of DES, beyond its low key size.

On the second point: assuming $2^{42.5}$ known plaintexts and as many DES, implementations of Mitsuru Matsui's Linear Cryptanalysis Method for DES Cipher (in proceedings of EuroCrypt 1993) break 16-round DES with excellent odds and thousand times less work than brute force, but not 48 rounds (and I do not see that subkeys of rank equal modulo 16 being equal can help much).

Note: Linear Cryptanalysis of 16-round single-DES could be the least computationally costly attack in CTR or OFB mode; but in many other modes, as pointed in comment, $2^{42.5}$ known plaintexts by itself allows recovery of a sizable fraction of other plaintext, thus linear cryptanalysis is impractical.

• sizably more secure, or slightly more secure??? IMHO, making the effective key size 1.5 bits larger against brute force is 'slightly'... – poncho Oct 4 '16 at 14:35
• To my ear (as a native speaker), sizably connotes 'of a significant size', and (again, IMHO) the advantage of EEE in this case is actually quite small (yes, it foils Matsui's attack; that's not much of a practical concern, because you need far beyond the birthday bound of ciphertext/plaintext; brute force is a more valid concern, and EEE makes it only slightly harder...) – poncho Oct 4 '16 at 16:03
• Please just make sure that no one misunderstands this to mean that it is secure at all. DES can be broken very quickly today at not a high cost. So, being more secure in the realm of easy to break is not something that anyone should rely on for anything. – Yehuda Lindell Oct 4 '16 at 19:37
• @fgrieu can you elaborate how come $\log_23$ – Shishir Oct 5 '16 at 11:21