Mastercard, Visa, and several other organizations use 3DES to encrypt and decrypt credit card data. The sweet32 attack placed 3DES in the spotlight, but how fragile is 3DES for a very small amount of info, like 16 digit string (the card number) + 3 digit string (the CVV) + 4 digit string (month/year of expiration)?

How susceptible is it to brute force, dictionary or collision attacks?

  • 2
    $\begingroup$ Sweet32 only applies if the data is large. The rest is the key strength of 3DES, brute-force. Dictionary attack = bruteforce. The collision has no place. $\endgroup$
    – kelalaka
    May 4 at 19:13
  • $\begingroup$ Possibly worth noting, but 3DES alone doesn't provide any authentication. Unless a MAC of the ciphertext is used by whatever mode it's operating in, it's not IND-CCA secure (though it might be IND-CPA secure with an appropriate mode of operation). $\endgroup$ May 4 at 19:30
  • 1
    $\begingroup$ I'd be more worried about the protocols that they use than about 3DES to be honest. Even 3DES with 2 keys still provides a lot of security, and breaking it - for a specific session - is not economic, even if it would be feasible. $\endgroup$
    – Maarten Bodewes
    May 4 at 20:35

There are three main issues with 3DES that an application needs to be aware of:

  • Small block size – 3DES has a small 64-bit block size. When encrypting non-negligible amounts of data with a single key, a small block size makes the Sweet32 attack possible.

  • Meet-in-the-middle attack – Due to its construction, the effective strength is reduced from 168 bits to 112 bits by virtue of a generic attack called meet-in-the-middle.

  • Inefficiency – DES itself is not very fast, and 3DES is three times slower.

When encrypting a very small amount of data, 3DES is sufficiently secure if one does not need a high performance cipher or a security level above 112 bits. Its use in smart cards is not an issue. Some smart cards use much weaker ciphers, or ciphers with even smaller block sizes (e.g. Simon32/64).

To answer your individual questions:

How susceptible is it to brute force

It provides a 2168 security against naïve brute force, and 2112 against brute force augmented with a meet-in-the-middle attack. This is generally sufficient.


The key is not derived from a human-generated passphrase, so dictionary attacks do not apply.

or collision attacks?

Collision attacks are usually an issue with hash functions, not block ciphers, although the Sweet32 attack can be considered a type of collision attack. The small block size does make collision attacks possible, but only if a large amount of data is encrypted with a given key.

  • $\begingroup$ thank you for your answer! but can you translate that to a number? something that cannot be misinterpreted? something like "A high end machine with a 3090 GPU could break in X days"? $\endgroup$
    – Leonardo
    May 4 at 23:51
  • 2
    $\begingroup$ @Leonardo A high-end machine with a 3090 GPU would not be able to break it before the heat death of the universe. $\endgroup$
    – forest
    May 4 at 23:52
  • 3
    $\begingroup$ @Leonardo All the computers in the world, plus billions of years, maybe? The point is that breaking a 112-bit key is not feasible, no matter how much money is to be made. In fact, many secure RFID applications use 64-bit keys simply because it'd cost more to break one than you'd gain from breaking it. $\endgroup$
    – forest
    May 5 at 0:00
  • 1
    $\begingroup$ @Leonardo Sweet32 is an issue with small block sizes (not small keys sizes). Because block ciphers can only encrypt a tiny amount of data at once, a "mode of operation" is used to expand the amount of data it can encrypt with a single key. If the block size is small (like 64 bits as in 3DES), then the mode of operation will often stop working correctly and can start to leak information about the plaintext if enough data is encrypted with it. The solution is either to not encrypt a lot of data, or to use a larger block size. $\endgroup$
    – forest
    May 5 at 0:08
  • 3
    $\begingroup$ @Leonardo That would be called a known-plaintext attack, and 3DES is not vulnerable to that. $\endgroup$
    – forest
    May 5 at 0:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.