I have the following code in C#

using System.Web.Security;

TripleDESCryptoServiceProvider tdes = new TripleDESCryptoServiceProvider();
tdes.Key = keyArray;
ICryptoTransform cTransform = tdes.CreateEncryptor();
byte[] resultArray =
            cTransform.TransformFinalBlock(plainTextArray, 0,

Does the code use the Key1 Key2 Key1 method of encryption or the Key1 Key2 Key3 method of encryption? I have heard that depending on the method it uses I will either need a 128 bit key for the first method or a 192 bit key for the second method.


The documentation states

This algorithm supports key lengths from 128 bits to 192 bits in increments of 64 bits.

Which is a somewhat strange, but comprehensible, way of stating that you can pass either a 128-bit key or a 192-bit key.

To see what to use, check the documentation of whatever legacy system you're implementing. Current security standards tend to forbid two-key DES (which would mean a 128-bit key) and to recommend against three-key DES (which would mean a 192-bit key). If you aren't forced to use two-key DES, use three-key DES. If you aren't forced to use DES, use AES (for AES a 128-bit key is fine).


Not the answer you're looking for? Browse other questions tagged or ask your own question.