I'm studying for CISSP certification & am using Shon Harris Exam Guide. It states that there are 4 modes that Triple-DES can be used in:

  1. DES-EEE3
  2. DES-EDE3
  3. DES-EEE2
  4. DES-EDE2

I understand these modes. I also understand that EEE2 & EDE2 would be faster than EEE3 & EDE3. My questions:

  1. What is the use-case for EEE vs EDE? Does this have something to do with the hardware that is used?
  2. Does it matter which DES mode is used?

Thanks in advance!

  • $\begingroup$ Part 1 is an exact duplicate of Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?. $\endgroup$
    – fgrieu
    Commented Mar 3, 2017 at 8:16
  • 3
    $\begingroup$ The short answer is to use AES instead of the obsolete 3DES. AES is stronger, faster and can encrypt more than a few GB of data without leaking information. The only reason to use 3DES is compatibility with legacy applications, but in that case you don't get to choose the construction anyways. $\endgroup$ Commented Mar 3, 2017 at 9:18

2 Answers 2


Triple DES has been standardized by NIST as DES-EDE. So the EEE versions are usually not present in cryptographic libraries. Using them is not advisable for this reasoning alone. Hardware will not have support for EEE and DDD operations. fgrieu already pointed out the answer by Poncho for theoretical reasons why NIST chose DES-EDE but that's ancient history; everybody just uses DES-EDE where DES is still used.

Two key triple DES is not faster than three key triple DES. There are 3 iterations of DES per block. The number of operations is identical.

Two-key 3DES only provides a security of about 80 bits (for a key size of 112 without parity or 128 bits including parity), while three-key triple DES is still at 112 bits (for 168/192 bits key size). For generic legacy applications NIST currently advises three-key 3DES (that is, DES-EDE, see above). Two-key 3DES has been deprecated, it does not offer enough security for most purposes.

Neither of these modes should however still be used. Three-key triple DES is not broken, but it has weak keys, offers too little security for the key size used, has a small block size (problematic with counter mode and modes providing authentication) and provides lackluster performance.

You should use AES or a modern stream cipher instead. AES is a faster, 128 bit block cipher with key sizes of 128, 192 and 256 bits that provide approximately the security provided by the full key size. AES has authenticated modes such as GCM and EAX that also provide integrity and authenticity on top of the confidentiality that may be achieved if the right mode / implementation is used.

TL;DR: Use three-key triple DES (DES-EDE) only for legacy applications. You are better off rewriting the application to use AES, especially if the applications still use two-key triple DES.

  • $\begingroup$ Wrote this answer to indicate practical reasons to choose between the modes of operation. fgrieu's and Poncho's answers combined already show the theoretical reasons to choose one over the other. $\endgroup$
    – Maarten Bodewes
    Commented Mar 3, 2017 at 9:35
  • 1
    $\begingroup$ Small point: 2-key and 3-key do the same E/D operations, but if these are done sequentially with pre-expanded key schedule (both common) which you can share (varies), doing 2 instead of 3 key schedules could save a little time. (But as you say is only strength 80.) $\endgroup$ Commented Mar 4, 2017 at 10:38

The first part of the question is fully addressed there, which explains why we use EDE3 or EDE2 in practice.

For the second part, the key size of EDE2 is only $2\over3$ of that of EDE3. Shorter key is a benefit for the purpose of key management, but makes brute-force and educated-force attacks for EDE2 less difficult/infeasible than that they are for EDE3. An educated-force attack against EDE2 is discussed by Paul C. van Oorschot and Michael J. Wiener in A Known-Plaintext Attack on Two-Key Triple Encryption (in proceedings of Eurocrypt 1990).

  • $\begingroup$ The above answer is somewhat obsolete. See this update on the status of EDE2. $\endgroup$
    – fgrieu
    Commented Mar 5 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.