3DES uses EDE as it is backward compatible to single DES, but consider the following case $K_1$=$K_2$=$K_3$ which one is more secure EDE or EEE.
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Compatibility always win. $\endgroup$– fgrieu ♦Oct 4, 2016 at 8:36
-
1$\begingroup$ Actually, 3DES EEE mode is also backwards compatible to DES, because of the DES weak keys... $\endgroup$– ponchoOct 5, 2016 at 12:15
-
1$\begingroup$ Poncho's obseravation is that EEE mode is backwards compatible to DES when we set $K_1=K$ and $K_2=K_3=\mathtt{0x0101010101010101}$. $\endgroup$– fgrieu ♦Oct 5, 2016 at 15:53
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
EEE with $K_1$=$K_2$=$K_3$ is measurably less insecure than EDE with $K_1$=$K_2$=$K_3$, because the former has 48 rounds, but the later reduces to just one encryption E, thus 16 rounds. Two consequences:
- This makes brutes force require 3 times more rounds, thus adds about $\log_2(3)\approx 1.58$ bit of practical security against brute force (security in bits grows as the base-2 log of the computational effort); however that remains way too low, and was so even in 1999. Brute force is the typical attack against single DES, and works fine including for EEE with 3 equal keys.
- This regains up to like a dozen bits of security that otherwise might be lost to cryptographic weakness of DES, beyond its low key size.
On the second point: assuming $2^{42.5}$ known plaintexts and as many DES, implementations of Mitsuru Matsui's Linear Cryptanalysis Method for DES Cipher (in proceedings of EuroCrypt 1993) break 16-round DES with excellent odds and thousand times less work than brute force, but not 48 rounds (and I do not see that subkeys of rank equal modulo 16 being equal can help much).
Note: Linear Cryptanalysis of 16-round single-DES could be the least computationally costly attack in CTR or OFB mode; but in many other modes, as pointed in comment, $2^{42.5}$ known plaintexts by itself allows recovery of a sizable fraction of other plaintext, thus linear cryptanalysis is impractical.
-
1$\begingroup$ sizably more secure, or slightly more secure??? IMHO, making the effective key size 1.5 bits larger against brute force is 'slightly'... $\endgroup$– ponchoOct 4, 2016 at 14:35
-
2$\begingroup$ To my ear (as a native speaker), sizably connotes 'of a significant size', and (again, IMHO) the advantage of EEE in this case is actually quite small (yes, it foils Matsui's attack; that's not much of a practical concern, because you need far beyond the birthday bound of ciphertext/plaintext; brute force is a more valid concern, and EEE makes it only slightly harder...) $\endgroup$– ponchoOct 4, 2016 at 16:03
-
4$\begingroup$ Please just make sure that no one misunderstands this to mean that it is secure at all. DES can be broken very quickly today at not a high cost. So, being more secure in the realm of easy to break is not something that anyone should rely on for anything. $\endgroup$ Oct 4, 2016 at 19:37
-
$\begingroup$ @fgrieu can you elaborate how come $\log_23$ $\endgroup$– ShishirOct 5, 2016 at 11:21