I'm studying for CISSP certification & am using Shon Harris Exam Guide. It states that there are 4 modes that Triple-DES can be used in:
I understand these modes. I also understand that EEE2 & EDE2 would be faster than EEE3 & EDE3. My questions:
Thanks in advance!
Triple DES has been standardized by NIST as DES-EDE. So the EEE versions are usually not present in cryptographic libraries. Using them is not advisable for this reasoning alone. Hardware will not have support for EEE and DDD operations. fgrieu already pointed out the answer by Poncho for theoretical reasons why NIST chose DES-EDE but that's ancient history; everybody just uses DES-EDE where DES is still used.
Two key triple DES is not faster than three key triple DES. There are 3 iterations of DES per block. The number of operations is identical.
Two-key 3DES only provides a security of about 80 bits (for a key size of 112 without parity or 128 bits including parity), while three-key triple DES is still at 112 bits (for 168/192 bits key size). For generic legacy applications NIST currently advises three-key 3DES (that is, DES-EDE, see above). Two-key 3DES has been deprecated, it does not offer enough security for most purposes.
Neither of these modes should however still be used. Three-key triple DES is not broken, but it has weak keys, offers too little security for the key size used, has a small block size (problematic with counter mode and modes providing authentication) and provides lackluster performance.
You should use AES or a modern stream cipher instead. AES is a faster, 128 bit block cipher with key sizes of 128, 192 and 256 bits that provide approximately the security provided by the full key size. AES has authenticated modes such as GCM and EAX that also provide integrity and authenticity on top of the confidentiality that may be achieved if the right mode / implementation is used.
TL;DR: Use three-key triple DES (DES-EDE) only for legacy applications. You are better off rewriting the application to use AES, especially if the applications still use two-key triple DES.
The first part of the question is fully addressed there, which explains why we use EDE3 or EDE2 in practice.
For the second part, the key size of EDE2 is only $2\over3$ of that of EDE3. Shorter key is a benefit for the purpose of key management, but makes brute-force and educated-force attacks for EDE2 less difficult/infeasible than that they are for EDE3. An educated-force attack against EDE2 is discussed by Paul C. van Oorschot and Michael J. Wiener in A Known-Plaintext Attack on Two-Key Triple Encryption (in proceedings of Eurocrypt 1990).
