3DES uses EDE as it is backward compatible to single DES, but consider the following case $K_1$=$K_2$=$K_3$ which one is more secure EDE or EEE.

  • $\begingroup$ Compatibility always win. $\endgroup$ – fgrieu Oct 4 '16 at 8:36
  • 1
    $\begingroup$ Actually, 3DES EEE mode is also backwards compatible to DES, because of the DES weak keys... $\endgroup$ – poncho Oct 5 '16 at 12:15
  • 1
    $\begingroup$ Poncho's obseravation is that EEE mode is backwards compatible to DES when we set $K_1=K$ and $K_2=K_3=\mathtt{0x0101010101010101}$. $\endgroup$ – fgrieu Oct 5 '16 at 15:53

EEE with $K_1$=$K_2$=$K_3$ is measurably less insecure than EDE with $K_1$=$K_2$=$K_3$, because the former has 48 rounds, but the later reduces to just one encryption E, thus 16 rounds. Two consequences:

  1. This makes brutes force require 3 times more rounds, thus adds about $\log_2(3)\approx 1.58$ bit of practical security against brute force (security in bits grows as the base-2 log of the computational effort); however that remains way too low, and was so even in 1999. Brute force is the typical attack against single DES, and works fine including for EEE with 3 equal keys.
  2. This regains up to like a dozen bits of security that otherwise might be lost to cryptographic weakness of DES, beyond its low key size.

On the second point: assuming $2^{42.5}$ known plaintexts and as many DES, implementations of Mitsuru Matsui's Linear Cryptanalysis Method for DES Cipher (in proceedings of EuroCrypt 1993) break 16-round DES with excellent odds and thousand times less work than brute force, but not 48 rounds (and I do not see that subkeys of rank equal modulo 16 being equal can help much).

Note: Linear Cryptanalysis of 16-round single-DES could be the least computationally costly attack in CTR or OFB mode; but in many other modes, as pointed in comment, $2^{42.5}$ known plaintexts by itself allows recovery of a sizable fraction of other plaintext, thus linear cryptanalysis is impractical.

| improve this answer | |
  • 1
    $\begingroup$ sizably more secure, or slightly more secure??? IMHO, making the effective key size 1.5 bits larger against brute force is 'slightly'... $\endgroup$ – poncho Oct 4 '16 at 14:35
  • 2
    $\begingroup$ To my ear (as a native speaker), sizably connotes 'of a significant size', and (again, IMHO) the advantage of EEE in this case is actually quite small (yes, it foils Matsui's attack; that's not much of a practical concern, because you need far beyond the birthday bound of ciphertext/plaintext; brute force is a more valid concern, and EEE makes it only slightly harder...) $\endgroup$ – poncho Oct 4 '16 at 16:03
  • 4
    $\begingroup$ Please just make sure that no one misunderstands this to mean that it is secure at all. DES can be broken very quickly today at not a high cost. So, being more secure in the realm of easy to break is not something that anyone should rely on for anything. $\endgroup$ – Yehuda Lindell Oct 4 '16 at 19:37
  • $\begingroup$ @fgrieu can you elaborate how come $\log_23$ $\endgroup$ – Shishir Oct 5 '16 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.