What it says on the tin. Is it still used in things like TLS?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ 3DES is prohibited from usage in applications. See stackoverflow.com/questions/62437171/… $\endgroup$– user21444Commented Jun 17, 2020 at 19:47
-
$\begingroup$ @user21444 It isn't prohibited. $\endgroup$– MelabCommented Jun 18, 2020 at 14:28
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
4
Well, yes and no.
Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack it.
The Triple DES algorithm provides around 112 bits of security against bruteforce attacks (when taking into account the meet-in-the-middle attack).
For reference, the insane computation power used to find the first SHA1 collision is estimated at a bit more than $2^{63}$ operations. So we still have a security margin of $2^{49}$, which is plenty, but still far less than other standards such as AES.
Triple DES with 3 different keys is still recommended by NIST as per their latest recommendation in NIST SP 800-57.
Triple DES is also the de facto fall-back algorithm for PGP: that is the algorithm all OpenPGP compliant software must implement and use if no other commonly supported algorithm is advertised in the public key of the recipient.
However, Triple DES has a really "small" blocksize with only 64 bits, which led to attack such as Sweet32 against TLS session which allows to break the security of the system thanks to "block collision". This attack led to the removal of Triple DES from the DEFAULT cipher list in the 1.1.0 release of OpenSSL. The attack can also be mitigated by rekeying after a given amount of encrypted data.
As a consequence of that, Triple DES was still in the TLS1.2 standard, but has not made it into the TLS1.3 one.
So in the end, Triple DES is still considered secure if you just want to encrypt something with it, but if you are running a protocol based on it, then you should be worrying about its small blocksize leading to the Sweet32 attack.
-
13$\begingroup$ Two key 3DES provides something like $2^{80}$ security, which is way too close to the limits of brute force attacks to be used in modern designs. Note that 3DES is slower than AES while providing less security and, indeed, only half the block size, weak keys, parity bits and more mumbo-jumbo that you can really do without... (excellent answer, by the way) $\endgroup$– Maarten Bodewes ♦Commented Sep 19, 2017 at 16:44
-
8$\begingroup$ @MaartenBodewes Very true, I should have mentioned that 2 keys 3DES has even been deprecated since December 2015 by NIST SP800-131A. Regarding the weak keys and the rest, it can't hurt to mention those, thanks. $\endgroup$– LeryCommented Sep 19, 2017 at 17:34
-
8$\begingroup$ What he said. The major issue with any cipher with a 64-bit block is that block size and birthday-bounds attacks like Sweet32. There are lots of these around like 3DES, Blowfish, IDEA, and so on. AES is faster and more secure than any of them. If you don't like AES, look at Twofish or Serpent. If you have a project using 3DES, updating it should be on your list at priority 2, along with cleaning out the junk drawer in the kitchen. You should do it, it doesn't matter if it's today. If you have a new project, don't. Just don't. $\endgroup$ Commented Sep 19, 2017 at 22:35
-
2$\begingroup$ @Maarten Bodewes: attacks that reduce two-key 3DES to 80-bit security either are well-guarded secrets, or require so ludicrously many accesses to so much fast RAM as to be currently impractical; see this. In today's practice, two-key 3DES remains common. It is more endangered by side channels, other leaks or fault attacks, its small block size, slowness, lack of long term assurance of confidentiality, and non-conformance to security recommendations, than by likelihood of a successful key search compromising its short-term operational security. $\endgroup$– fgrieu ♦Commented Sep 21, 2017 at 7:01
$\begingroup$
$\endgroup$
NIST just recently (11/27/2017) put out a bulletin that Triple-DES will be deprecated in the future, and will be disallowed in protocols like TLS and IPsec, with a future deprecation timeline to be released. NIST is urging vendors to transition TLS implementations to use AES as soon as possible. It will soon be removed from the set of FIPS approved algorithms.
https://csrc.nist.gov/CSRC/media/Publications/Shared/documents/itl-bulletin/itlbul2017-11.pdf
I would say at this point, Triple-DES is on it's way out, and will soon be considered unsafe for use.
$\begingroup$
$\endgroup$
1
The quick answer: No.
It's no longer considered secure.
Here's why:
- It's vulnerable to Sweet32 Birthday attacks.
- NIST disallows usage of 3DES since 2023 (see NIST SP 800-131A Revision 2).
- Federal Office for Information Security (BSI) in Germany does not approve this cipher.
- NSA (National Security Agency) demands blocking it immediately.
- It's disabled by privacy.sexy.
-
1$\begingroup$ AFAIK, the small block size (as exploited by Sweet32) indeed is the only actual operational weakness of 3DES (even with two rather than three independent keys) in circumstances where side-channel attacks are infeasible. In such circumstances, key recovery attacks are still impractical AFAIK, for they require so much memory and accesses. $\endgroup$– fgrieu ♦Commented Apr 23 at 7:38