Withdrawn NIST Technical Series Publication
Warning Notice
The attached publication has been withdrawn (archived), and is provided solely for historical purposes.
It may have been superseded by another publication (indicated below).

Withdrawn Publication
Series/Number
Title
Publication Date(s)Withdrawal Date
Withdrawal Note

NIST SP 800-67r2 (Revision 2)
Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher
November 2017
January 1, 2024
NIST SP 800-67r2 is withdrawn in its entirety. This signifies that TDEA is nolonger an approved block cipher. Per the withdrawal announcement, TDEA willcontinue to be allowed for the decryption, key unwrapping, and verification of
Message Authentication Codes (MACs) of already-protected data. Also, see theannouncement for information on TDEA validations.

Superseding Publication(s) (if applicable)

N/A

The attached publication has been superseded by the following publication(s):Series/Number
Title
Author(s)Publication Date(s)URL/DOI

Additional Information (if applicable)
Contact
Latest revision of theattached publication
Related Information
Withdrawal
Announcement Link

Computer Security Division (Information Technology Laboratory)
N/A
https://csrc.nist.gov/pubs/sp/800/67/r2/final
https://csrc.nist.gov/news/2023/nist-to-withdraw-sp-800-67-rev-2

Date updated: January 1, 2024

NIST Special Publication 800-67
Revision 2

Recommendation for the Triple Data
Encryption Algorithm (TDEA)
Block Cipher
Elaine Barker
Nicky Mouha

This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-67r2

C O M P U T E R

S E C U R I T Y

NIST Special Publication 800-67
Revision 2

Recommendation for the Triple Data
Encryption Standard (TDEA)
Block Cipher
Elaine Barker
Nicky Mouha
Computer Security Division
Information Technology Laboratory

This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-67r2

November 2017

U.S. Department of Commerce
Wilbur L. Ross, Jr., Secretary
National Institute of Standards and Technology
Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Authority
This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal
Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113283. NIST is responsible for developing information security standards and guidelines, including minimum
requirements for federal information systems, but such standards and guidelines shall not apply to national
security systems without the express approval of appropriate federal officials exercising policy authority oversuch systems. This guideline is consistent with the requirements of the Office of Management and Budget(OMB) Circular A-130.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory andbinding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines
be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the
OMB, or any other federal official. This publication may be used by nongovernmental organizations on a
voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciatedby NIST.

National Institute of Standards and Technology Special Publication 800-67 Revision 2
Natl. Inst. Stand. Technol. Spec. Publ. 800-67 Rev. 2, 32 pages (November 2017)
CODEN: NSPUE2This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-67r2
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best
available for the purpose.
There may be references in this publication to other publications currently under development by NIST in accordancewith its assigned statutory responsibilities. The information in this publication, including concepts and methodologies,
may be used by federal agencies even before the completion of such companion publications. Thus, until eachpublication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For
planning and transition purposes, federal agencies may wish to closely follow the development of these new
publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to
NIST. Many NIST cybersecurity publications, other than the ones noted above, are available athttps://csrc.nist.gov/publications.

Comments on this publication may be submitted to:
National Institute of Standards and Technology
Attn: Computer Security Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930
Email: SP800-67comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Reports on Computer Systems Technology

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST)
promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement
and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations,and technical analyses to advance the development and productive use of information technology. ITL’s
responsibilities include the development of management, administrative, technical, and physical standards andguidelines for the cost-effective security and privacy of other than national security-related information in federal
information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreachefforts in information system security, and its collaborative activities with industry, government, and academicorganizations.

Abstract
This publication specifies the Triple Data Encryption Algorithm (TDEA), including its primary
component cryptographic engine, the Data Encryption Algorithm (DEA). TDEA is intended to be
used with a Special Publication (SP) 800-38-series-compliant mode of operation in a Federal
Information Processing Standard (FIPS) 140-2-compliant cryptographic module, TDEA may be
used by federal organizations to protect sensitive unclassified data. Protection of data duringtransmission or while in storage may be necessary to maintain the confidentiality and integrity of
the information represented by the data. This Recommendation defines the mathematical steps
required to cryptographically protect data using TDEA and to subsequently process such protected
data. TDEA is made available for use by federal agencies within the context of a total security
program consisting of physical security procedures, good information management practices, andcomputer system/network access controls.

Keywords
block cipher; computer security; cryptography; data encryption algorithm; security; triple dataencryption algorithm.

ii

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Acknowledgements
The authors wish to thank their colleagues, who reviewed drafts of this document and contributed
to its development. The authors also gratefully acknowledge and appreciate the many commentsfrom the public and private sectors whose thoughtful and constructive comments improved thequality and usefulness of this publication.
Conformance TestingThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Conformance testing for implementations of this Recommendation will be conducted within theframework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic
Module Validation Program (CMVP). The requirements of this Recommendation are indicated by
the word “shall.” Some of these requirements may be out-of-scope for CAVP or CMVP validation
testing, and thus are the responsibility of entities using, implementing, installing or configuring
applications that incorporate this Recommendation.

iii

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Foreword
This Recommendation provides a description of a mathematical algorithm for cryptographicallyprotecting binary coded information (e.g., using encryption and authentication). The algorithm
described in this Recommendation specifies cryptographic operations that are based on a binary
number called a key.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Authorized users of computer data cryptographically protected using TDEA must have the key
that was used to protect the data in order to process the protected data. The cryptographic algorithm
specified in this Recommendation is assumed to be commonly known among its users. The
cryptographic security of the data depends on the security provided for the keys used to protect thedata and the amount of data protected by a single TDEA key.
Data that is determined by a responsible authority to be sensitive, data that has a high value, ordata that represents a high value should be cryptographically protected if it is vulnerable tounauthorized disclosure or undetected modification during transmission or while in storage. A risk
analysis should be performed under the direction of a responsible authority to determine potential
threats. The costs of providing cryptographic protection using this Recommendation, as well as ofalternative methods for providing this protection, should be projected. A responsible authority thenshould make a decision, based on these analyses, whether or not to use cryptographic protection
and this recommendation.
DEA was originally specified in FIPS 46, The Data Encryption Standard, which became effective
July 1977. It was reaffirmed in 1983, 1988, 1993, and 1999. The DEA has now been withdrawn.
The use of DEA is permitted only as a component function of TDEA. This Recommendation
applies to all federal agencies, contractors of federal agencies, or other organizations that process
information (using a computer or telecommunications system) on behalf of the Federal
Government to accomplish a federal function. Each federal agency or department may issue
internal directives for the use of this Recommendation by their operating units, based on their data
security requirement determinations.
With the withdrawal of the FIPS 46-3 standard (i.e., the final revision of FIPS 46), implementationsof the DEA function are no longer authorized for the protection of Federal Government
information. This publication specifies an alternative to DEA, based on the DEA "cryptographic
engine" that was originally specified in FIPS 46 and is included herein.
Implementations of the TDEA algorithm specified in this Recommendation may be covered by
U.S. and foreign patents. Certain cryptographic devices and technical data regarding them aresubject to federal export controls. Exports of cryptographic modules implementing this algorithm
and technical data regarding them must comply with these federal regulations and, if required, belicensed by the Bureau of Export Administration of the U.S. Department of Commerce.
Information about export regulations is available: https://www.bis.doc.gov/.

iv

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Table of Contents
1. Introduction........................................................................................................................ 1
1.1 Applications .............................................................................................................................. 1
1.2 Using the TDEA .......................................................................................................................... 1
1.3 Organization ............................................................................................................................. 2

2. DATA ENCRYPTION ALGORITHM CRYPTOGRAPHIC ENGINE ................................................ 3
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

2.1 DEA Forward Transformation .................................................................................................... 3
2.2 DEA Inverse Transformation ...................................................................................................... 6
2.3 The Function f ........................................................................................................................... 7

3. TRIPLE DATA ENCRYPTION ALGORITHM............................................................................ 10

3.1 Basic TDEA Forward and Inverse Cipher Operations ................................................................ 10
3.2 TDEA Usage ............................................................................................................................. 10
3.3 Keys ........................................................................................................................................ 10
3.3.1 Key Requirements .................................................................................................................... 10
3.3.2 Weak Keys ............................................................................................................................... 11
3.4 Usage Guidance....................................................................................................................... 12

APPENDIX A: PRIMITIVE FUNCTIONS FOR THE DATA ENCRYPTION ALGORITHM ................... 13
APpendix B: ExampleS of TDEA OPERATIONS ....................................................................... 19
Appendix C: Glossary ............................................................................................................ 20
C.1
C.2

Terms ................................................................................................................................ 20
Acronyms .......................................................................................................................... 21

Appendix D: References........................................................................................................ 22
Appendix E: REVISIONS.......................................................................................................... 24v

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

1. INTRODUCTION

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

This Recommendation specifies the Triple Data Encryption Algorithm (TDEA) block cipher. The
TDEA block cipher includes a Data Encryption Algorithm (DEA) cryptographic engine (specified
in Section 2) that is implemented as a component of TDEA (specified in Section 3). TDEA
functions incorporating the DEA cryptographic engine shall be designed in such a way that they
may be used in a computer system, storage facility, or network to provide cryptographic protection
to binary coded data. The method of implementation will depend on the application andenvironment. TDEA implementations shall be subject to being tested and validated as accurately
performing the transformations specified in the TDEA algorithm and in NIST Special Publications(SPs) 800-38 1 and 800-90A. 2
1.1 Applications
Cryptography is utilized in various applications and environments. The specific utilization of
encryption and the implementation of TDEA 3 will be based on many factors particular to thecomputer system and its associated components. In general, cryptography is used to protect data
while it is being communicated between two points or while it is stored in a medium vulnerable tophysical theft or technical intrusion (e.g., hacker attacks). In the first case, the TDEA key must be
available by the sender and receiver simultaneously during communication. In the second case, the
TDEA key must be maintained and accessible for the duration of the storage period. NIST Special
Publications (SP) 800-133 4 provides approved methods for generating cryptographic keys, 5 andSP 800-57, Part 1, 6 provides recommendations for managing cryptographic keys, including the
TDEA keys used by the algorithm specified in this Recommendation.
1.2 Using the TDEA
SP 800-38 describes modes of operation for using block cipher algorithms. Modes of operation
for using TDEA are specified in SP 800-38A, 7 SP 800-38B 8 and SP 800-38F. 9

1

SP 800-38: Recommendation for Block Cipher Modes of Operation, a series of publications.

2

SP 800-90A: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.

3

And the cryptographic engine that forms the basis for TDEA.

4

SP 800-133, Recommendation for Cryptographic Key Generation.

5

Ibid.

6

SP 800-57, Part 1: Recommendation for Key Management: General.

7

SP 800-38A: Recommendation for Block Cipher Modes of Operation: Methods and Techniques.

8

SP 800-38B: Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication.

9

SP 800-38F: Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping.

1

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERTDEA may also be used for the generation of random numbers, as specified in SP 800-90A for the
CTR_DRBG.

1.3 Organization
Section 2 of this Recommendation describes the DEA cryptographic engine employed by TDEA.
Section 3 of this Recommendation describes the basic TDEA algorithm.
Appendices are included that define the DEA primitives, indicate where examples of using TDEA
can be found, and provide a glossary of terms, a list of references, and a list of version changes.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

2

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

2. DATA ENCRYPTION ALGORITHM CRYPTOGRAPHIC ENGINEThe DEA cryptographic engine is used by TDEA to cryptographically protect (e.g., encrypt)
blocks of data consisting of 64 bits under the control of a 64-bit key. 10 Subsequent processing of
the protected data (e.g., decryption) is accomplished using the same key as was used to protect thedata. Each 64-bit key shall contain 56 bits that are randomly generated and used directly by thealgorithm as key bits. The other eight bits, which are not used by the algorithm, may be used forerror detection. The eight error-detecting bits are set to make the parity of each 8-bit byte of the
key odd. That is, there is an odd number of "1"s in each 8-bit byte. 11

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

During each application of the DEA engine, a block is subjected to an initial permutation IP, thento a complex key-dependent computation and finally to a permutation that is the inverse of theinitial permutation, IP-1. The key-dependent computation can be simply defined in terms of afunction f and a function KS, called the key schedule. The DEA engine can be run in two directions- as a forward transformation 12 and as an inverse transformation. 13 The two directions differ onlyby the order in which the bits of the key are used.
Descriptions of the forward and inverse transformations are provided below, followed by adefinition of the function f in terms of primitive functions called by the selection functions Si, andthe permutation function P. Values for Si, P and KS of the engine are contained in Appendix A.
The following notation is convenient: Given two blocks L and R of bits, LR denotes the block
consisting of the bits of L followed by the bits of R. Since concatenation is associative, B1B2...B8,
for example, denotes the block consisting of the bits of byte B1 followed by the bits of byte
B2...followed by the bits of byte B8.

2.1 DEA Forward Transformation
A sketch of the forward transformation is given in Figure 1.

10

Blocks are composed of bits numbered from left to right, i.e., the left-most bit of a block is bit one.

11

Sometimes keys are generated in an encrypted form. A random 64-bit number is generated and defined to be thecipher formed by the encryption of a key using a key-encrypting key. In this case, the parity bits of the encrypted key
cannot be set until after the key is decrypted.
12Often called “encryption.”

13

Often called “decryption.”

3

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Figure 1. Forward Transformation of the DEA Cryptographic Engine
The 64 bits of the input block for the forward transformation are first subjected to the following
permutation, called the initial permutation IP:
4

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERIPThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

58

50

42

34

26

18

10

2

60

52

44

36

28

20

12

4

62

54

46

38

30

22

14

6

64

56

48

40

32

24

16

8

57

49

41

33

25

17

9

1

59

51

43

35

27

19

11

3

61

53

45

37

29

21

13

5

63

55

47

39

31

23

15

7

That is, the permuted input has bit 58 of the input as its first bit, bit 50 as its second bit, and so on,with bit 7 as its last bit. The permuted input block is then input to a complex key-dependent
computation that is described below. The output of that computation, called the pre-output, is thensubjected to the following permutation that is the inverse of the initial permutation:
IP-1
40

8

48

16

56

24

64

32

39

7

47

15

55

23

63

31

38

6

46

14

54

22

62

30

37

5

45

13

53

21

61

29

36

4

44

12

52

20

60

28

35

3

43

11

51

19

59

27

34

2

42

10

50

18

58

26

33

1

41

9

49

17

57

25

That is, the output of the algorithm has bit 40 of the pre-output block as its first bit, bit 8 as its
second bit, and so on, until bit 25 of the pre-output block is the last bit of the output.
The key-dependent computation that uses the permuted input block as its input to produce the preoutput block consists, except for a final interchange of blocks, of 16 iterations of a calculation thatis described below in terms of the function f. This function operates on two blocks, one of 32 bits
and one of 48 bits, to produce a block of 32 bits.
Let the 64 bits of the input block to an iteration consist of a 32-bit block L, followed by a 32-bit
block R. Using the notation defined above, the input block is then LR.
Let K be a block of 48 bits chosen from the 64-bit key. Then the output L'R' of an iteration with
input LR is defined by:(1)

L' = R
5

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

R' = L ⊕ f(R,K)
where ⊕ denotes bit-by-bit addition modulo 2 (also known as exclusive-or or XOR).
As remarked before, the input of the first iteration of the calculation is the permuted input block.
If L'R' is the output of the 16th iteration, then R'L' is the pre-output block. At each iteration, adifferent block K of key bits is chosen from the 64-bit key designated by KEY.
With more notation, the iterations of the computation can be described in more detail. Let KS be afunction that takes an integer n in the range from 1 to 16 and a 64-bit block KEY as input. The
output of KS is a 48-bit block Kn that is a permuted selection of bits from KEY. That is:
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2(2)

Kn = KS(n, KEY)

with Kn determined by the bits in 48 distinct bit positions of KEY. KS is called the key schedule
because the block K used in the n'th iteration of (1) is the block Kn determined by (2).
As before, let the permuted input block be LR. Finally, let L() and R() be respectively L and R, andlet Ln and Rn be respectively L' and R' of (1) when L and R are Ln-1 and Rn-1, respectively, and K
is Kn; that is, when n is in the range from 1 to 16,(3)

Ln = Rn-1
Rn = Ln-1 ⊕ f(Rn-1, Kn)

The pre-output block is then R16L16.
The key schedule KS of the algorithm is described in detail in Appendix A. The key schedule
produces the 16 Kn values that are required for the algorithm.

2.2 DEA Inverse Transformation
The permutation IP-1 applied to the pre-output block is the inverse of the initial permutation IP(4)

R = L'
L = R' ⊕ f(L', K)

Consequently, to apply the inverse transformation, it is only necessary to apply the very samealgorithm to a block of the protected data produced by the forward transformation, taking carethat at each iteration of the computation, the same block of key bits K is used during the inverse
transformation as was used during the forward transformation.
Using the notation of the previous section, this can be expressed by the equations:(5)

Rn-1 = Ln
Ln-1 = Rn ⊕ f(Ln, Kn),

where R16L16 is the permuted input block for the inverse transformation, and L0R0 is the pre-output
block. That is, for the inverse transformation with R16L16 as the permuted input, K16 is used in thefirst iteration, K15 in the second, and so on, with K1 used in the 16th iteration.

6

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

2.3 The Function f
A sketch of the calculation of f(R, K) is given in Figure 2.
Let E be the function that maps 32 bits to 48 bits as specified in Table 1:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Figure 2. Calculation of f(R, K)
Table 1: E BIT-SELECTION TABLE
32

1

2

3

4

5

4

5

6

7

8

9

8

9

10

11

12

13

12

13

14

15

16

17

16

17

18

19

20

21

20

21

22

23

24

25

24

25

26

27

28

29

28

29

30

31

32

1

7

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Thus, the first three bits of E(R) are the bits in positions 32, 1 and 2 of R, while the last two bitsof E(R) are the bits in positions 32 and 1.
Each of the unique selection functions S1, S2, , ..., S8, takes a 6-bit block as input and yields a 4bit block as output and is illustrated by using Table 2. Table 2 contains S1.
Table 2: S1
Row

Column NumberThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

No.

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

0

14

4

13

1

2

15

11

8

3

10

6

12

5

9

0

7

1

0

15

7

4

14

2

13

1

10

6

12

11

9

5

3

8

2

4

1

14

8

13

6

2

11

15

12

9

7

3

10

5

0

3

15

12

8

2

4

9

1

7

5

11

3

14

10

0

6

13

If S1 is the function defined in this table, and B is a block of 6 bits, then S1(B) is determined asfollows: The first and last bits of B represent, in base 2, a number in the range 0 to 3. Let that
number be i. The middle 4 bits of B represent, in base 2, a number in the range 0 to 15. Let that
number be j. Using the table, look up the number in the ith row and jth column. It is a number in therange 0 to 15 and is uniquely represented by a 4-bit block. That block is the output S1(B) of S1 forthe input B. For example, for input 011011, the row is 01 (i.e., row 1), and the column is determinedby 1101 (i.e., column 13). The number 5 appears in row 1, column 13, so the output is 0101.
Selection functions S1, S2, ..., S8 of the algorithm appear in Appendix A.
The permutation function P yields a 32-bit output from a 32-bit input by permuting the bits of
the input block. Such a function is defined by Table 3:
Table 3: P
16

7

20

21

29

12

28

17

1

15

23

26

5

18

31

10

2

8

24

14

32

27

3

9

19

13

30

6

22

11

4

25

The output P(L) for the function P defined by this table is obtained from the input L by taking the
16th bit of L as the first bit of P(L), the 7th bit as the second bit of P(L), and so on until the 25th
bit of L is taken as the 32nd bit of P(L). The permutation function P of the algorithm is repeatedin Appendix A.
8

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERNow let S1, ..., S8 be eight distinct selection functions, let P be the permutation function, and let E
be the function defined above.
To define f(R, K), let B1, ..., B8 be blocks of six bits each for which(6)

B1B2...B8 = K ⊕ E(R).

The block f(R, K) is then defined to be(7)

P(S1(B1)S2(B2)...S8(B8)).

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Thus, K ⊕ E(R) is first divided into the eight blocks as indicated in (6). Then each Bi is taken as
an input to Si, and the eight blocks S1(B1), S2(B2), ..., S8(B8) of four bits each are consolidated intoa single block of 32 bits, which forms the input to P. The result (7) is then the output of the function
f for the inputs R and K.

9NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

3. TRIPLE DATA ENCRYPTION ALGORITHM
3.1 Basic TDEA Forward and Inverse Cipher Operations
In this Recommendation, each TDEA forward and inverse cipher operation is a compound
operation of the DEA forward and inverse transformations specified in Section 2.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

A TDEA key consists of three DEA keys for the cryptographic engine (Key1, Key2 and Key3); thethree keys are also called a key bundle (KEY). The use of three unique keys is defined for the
TDEA forward and inverse cipher operations (e.g., encryption and decryption) such that Key1 ≠Key2, Key2 ≠ Key3, and Key3 ≠ Key1; this version of TDEA is commonly known as three-key TDEA
(3TDEA). A second option for the selection of the keys (commonly known as two-key TDEA, or
2TDEA) is allowed for legacy use only, as defined in SP 800-131A, 14 where Key1 and Key2 areunique, and Key3 is the same as Key1 (i.e., Key1 ≠ Key2, Key2 ≠ Key3, and Key3 = Key1). A key
bundle shall not consist of three identical keys.
Let FKeyX (d) and IKeyY (d), respectively, represent the DEA forward and inverse transformations
on data d using key bundle KEY. The following operations are used:
1. TDEA forward cipher operation: the transformation of a 64-bit block d into a 64-bit blockO that is defined as follows:
O = FKey3(IKey2(FKey1(d))).
2. TDEA inverse cipher operation: the transformation of a 64-bit block d into a 64-bit blockO that is defined as follows:
O = IKey1(FKey2(IKey3(d))).

3.2 TDEA Usage
TDEA shall be implemented using one or more of the modes of operation specified in SP 80038A, SP 800-38B and SP 800-38F, or as specified in SP 800-90A.
3.3 Keys
The TDEA keys shall be managed in accordance with SP 800-57, Part 1. SP 800-57, Part 1 andSP 800-131A specify time frames during which TDEA may be used.

3.3.1 Key Requirements
For all TDEA modes of operation, three cryptographic keys (Key1, Key2, Key3) define a TDEA key
bundle. The bundle and the individual keys shall:a. Be kept secret;14

SP 800-131A, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key
Lengths.

10

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

b. Be generated using an approved method 15 that is based on the output of an approved
random bit generator; 16
c. Be independent of other key bundles;
d. Have integrity whereby each key in the bundle has not been altered in an unauthorizedmanner since the time it was generated, transmitted, or stored by an authorized entity;e. Be used in the appropriate order as specified by the particular mode;f.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Be considered a fixed quantity in which an individual key cannot be manipulated whileleaving the other two keys unchanged; and cannot be unbundled except for its
designated purpose.

3.3.2 Weak Keys
There are a few keys that are considered weak for the DEA cryptographic engine. The use of weakkeys can reduce the effective security afforded by TDEA and should be avoided. Keys that areconsidered weak are (in hexadecimal format):•

01010101 01010101•

FEFEFEFE FEFEFEFE•

E0E0E0E0 F1F1F1F1•

1F1F1F1F 0E0E0E0E

Note that the weak keys listed above and the semi-weak keys and the possibly weak keys listed
below are expressed with odd parity, which is indicated in the rightmost bit of each byte.
Some pairs of keys encrypt plaintext to identical ciphertext and also should be avoided. Thesesemi-weak keys are (in hexadecimal format):•

011F011F010E010E and 1F011F010E010E01•

01E001E001F101F1 and E001E001F101F101•

01FE01FE01FE01FE and FE01FE01FE01FE01•

1FE01FE00EF10EF1 and E01FE01FF10EF10E•

1FFE1FFE0EFE0EFE and FE1FFE1FFE0EFE0E•

E0FEE0FEF1FEF1FE and FEE0FEE0FEF1FEF1There are also 48 keys that produce only four distinct subkeys (instead of 16) - these are called
possibly weak keys and should be avoided. These possibly weak keys are (in hex):
01011F1F01010E0E

1F1F01010E0E0101

15

See SP 800-133.

16

See SP 800-90A and FIPS 140-2, Annex C.

11

E0E01F1FF1F10E0E

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

0101E0E00101F1F1

1F1FE0E00E0EF1F1

E0E0FEFEF1F1FEFE

0101FEFE0101FEFE

1F1FFEFE0E0EFEFE

E0FE011FF1FE010E

011F1F01010E0E01

1FE001FE0EF101FE

E0FE1F01F1FE0E01

011FE0FE010EF1FE

1FE0E01F0EF1F10E

E0FEFEE0F1FEFEF1

011FFEE0010EFEF1

1FE0FE010EF1FE01

FE0101FEFE0101FE

01E01FFE01F10EFE

1FFE01E00EFE01F1

FE011FE0FE010EF1

FE01E01FFE01F10E

1FFEE0010EFEF101

FE1F01E0FE0E01F1

01E0E00101F1F101

1FFEFE1F0EFEFE0E

FE1FE001FE0EF101

01E0FE1F01F1FE0E

E00101E0F10101F1

FE1F1FFEFE0E0EFE

01FE1FE001FE0EF1

E0011FFEF1010EFE

FEE0011FFEF1010E

01FEE01F01FEF10E

E001FE1FF101FE0E

FEE01F01FEF10E01

01FEFE0101FEFE01

E01F01FEF10E01FE

FEE0E0FEFEF1F1FE

1F01011F0E01010E

E01F1FE0F10E0EF1

FEFE0101FEFE0101

1F01E0FE0E01F1FE

E01FFE01F10EFE01

FEFE1F1FFEFE0E0E

1F01FEE00E01FEF1

E0E00101F1F10101

FEFEE0E0FEFEF1F1

3.4 Usage Guidance
The security of TDEA is affected by the number of blocks processed with one key bundle. One
key bundle shall not be used to apply cryptographic protection (e.g., encrypt) more than 220 64bit data blocks.
Note that this limitation applies to a key bundle with three unique keys (i.e., 3TDEA); the use of
TDEA with only two unique keys (i.e., 2TDEA) shall not be used to apply cryptographic
protection (see Section 3.1).
Also, note that in the previous version of SP 800-67 (dated January 2012), 3TDEA was limited toprocessing 232 64-bit blocks, and 2TDEA was limited to 220 blocks. These prior limitations should
be considered when processing information protected using the 2012 or the original version of SP
800-67 (e.g., determining the risk of accepting the decrypted information when the limit provided
in this revision for 3TDEA is exceeded or the information was encrypted using 2TDEA).

12NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERAPPENDIX A: PRIMITIVE FUNCTIONS FOR THE DATAENCRYPTION ALGORITHM
The choice of the primitive functions KS, S1, ...,S8 and P is critical to the strength of thetransformations resulting from the algorithm. The tables below specify the functions S1 , .., S8 and
P. For the interpretation of the tables describing these functions, see the discussion in Section 2.
The primitive functions S1, ..., S8 are:
S1
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

14

4 13

0 15
4

1

2 15 11

8

3 10

5

9

0

7

6 12 11

9

5

3

8

3 10

5

0

7

4 14

2 13

1 14

8 13

6

2 11 15 12

9

2

9

1

3 14 10

0

6 13

5 10

15 12

8

4

1 10

6 12

7

5 11

7

S2
15

1

8 14

6 11

3 13

4

0 14

7 11 10

13

8 10

7 15

1

2

3

9

7

2 13 120

8 14 12

0

1 10

6

9 11

6

9

3

7 12

0

5 14

9

4

2

8

4 13

3 15

4

4

1

5

8 12

2 11

6

5

2 15

S3
10

0

9 14

6

3 15

13

7

0

9

3

4

13

6

4

9

8 15

1 10 13

0

6

9

5

6 10

1 13 12

7 11

2

8

5 14 12 11 15

1

3

0 11

1

2 12

7

8

7

4 15 145 10 14

3 11

5

2 12

5 11 124 15

S4
7 13 14

3

0

6

13

8 11

5

6 15

10

6

9

0 12 11

3 15

0

6 10

9 10

1

2

8

0

4

7

2 12

1 10 149

7 13 15

1

3 14

5

2

8

4

4

5 11 127

2 14

3 15 13

0 14

9

9

6

1 13

3

8

9
S5

2 12

4

14

2 12

11

1

7 10 11

6

8

5

4

1

5

0 15 10

7 13

13

3

8

NIST SP 800-67 REV. 2

4

2

11

8 12

RECOMMENDATION FOR TDEA BLOCK CIPHER

1 11 10 13
7

1 14

7

8 15

2 13

9 12

6

3

0 14

0

9 10

4

5

3

4 14

7

5 11

6 15

5

3

S6
12

1 10 15

10 15

9

6

8

0 13

9

5

6

1 13 14

0 11

3

8

3

7

0

4 10

1 13 11

6

1

7

6

9

7

5 10

6

1

5 12

2 15

8

6

6

0

5

9

2

5

0 15 14

2

3 12

1 10

9

3 14

5

0 12

4 12

5

6 11

0 14

2

6 10 13 15

4

2

7 12

9 14 15

5

2

8 12

2 12

9

5 15 10 11 14

4This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

2

3

0

8 13

S7
4 11

2 14 15

8 13

3 12

13

0 11

4

9

1 10 141

4 11 13 123

7 14 10 15

6 11 13

7

0

8

1

4 10

7

3

9

8

S8
13

2

8

4

6 15 11

1 15 13

8 10

7 11

4

1

9 12 14

1 14

7

4 10

2

3

7

0

8 13 15 12

9

0

3

7

9

2

3

5

8

5

6 11

The primitive function P is:
16

7

20

21

29

12

28

17

1

15

23

26

5

18

31

10

2

8

24

14

32

27

3

9

19

13

30

6

22

11

4

25

Recall that Kn, for 1 ≤ n ≤ 16, is the block of 48 bits of the algorithm in (2). Hence, to describe KS,
it is sufficient to describe the calculation of Kn from a key (Keyi) of the key bundle for n = 1, 2, ...,
16. That calculation is illustrated in Figure 3. To complete the definition of KS, it is therefore
sufficient to describe the two permuted choices, as well as the schedule of left shifts. One bit ineach 8-bit byte of Keyi may be utilized for error detection in key generation, distribution and
14

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

storage. Bits 8, 16, ..., 64 are used for assuring that each byte is of odd parity. (Note that theseeight parity bits have no effect on the operation of the algorithm.)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

15

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Figure 3: Key Schedule Calculation

16

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

Permuted choice 1 is determined by the following table:
PC-1

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

57

49

41

33

25

17

9

1

58

50

42

34

26

18

10

2

59

51

43

35

27

19

11

3

60

52

44

36

63

55

47

39

31

23

15

7

62

54

46

38

30

22

14

6

61

53

45

37

29

21

13

5

28

20

12

4

The table has been divided into two parts, with the first part determining how the bits of C() are chosen, and the second part determining how the bits of D( ) are chosen. The bits ofKeyi are numbered 1 through 64. The bits of C( ) are respectively bits 57, 49, 41, ..., 44 and
36 of Keyi, with the bits of D( ) being bits 63, 55, 47, ..., 12 and 4 of Keyi.
With C( ) and D( ) defined, the blocks Cn and Dn are obtained from the blocks Cn-1 and Dn-1,
respectively, for n = 1, 2, ..., 16, by adhering to the following schedule of left shifts of theindividual blocks:
Iteration
Number
1

Number ofLeft Shifts
1

2

1

3

2

4

2

5

2

6

2

7

2

8

2

9

1

10

2

11

2

12

2

13

2
17

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

14

2

15

2

16

1

For example, C3 and D3 are obtained from C2 and D2, respectively, by two left shifts, andC16 and D16 are obtained from C15 and D15, respectively, by one left shift. In all cases, by asingle left shift is meant a rotation of the bits one place to the left, so that after one left shift
the bits in the 28 positions are the bits that were previously in positions 2, 3, ..., 28, 1.
Permuted choice 2 is determined by the following table:
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

PC-2
14

17

11

24

1

5

3

28

15

6

21

10

23

19

12

4

26

8

16

7

27

20

13

2

41

52

31

37

47

55

30

40

51

45

33

48

44

49

39

56

34

53

46

42

50

36

29

32

Therefore, the first bit of Kn is the 14th bit of CnDn, the second bit of Kn is the 17th bit ofCnDn, and so on, with the 47th bit of Kn as the 29th bit of CnDn, and the 48th bit of Kn as the
32nd bit of CnDn.

18

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERAPPENDIX B: EXAMPLES OF TDEA OPERATIONS
Examples of the TDEA modes of operation specified in SP 800-38A, SP 800-38B and SP
800-38F are available at https://csrc.nist.gov/projects/cryptographic-standards-andguidelines/example-values.
Examples for the use of TDEA in the CTR_DRBG specified in SP 800-90A are alsoavailableathttps://csrc.nist.gov/projects/cryptographic-standards-andguidelines/example-values.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

19

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERAPPENDIX C: GLOSSARY
C.1

Terms

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Approved

FIPS-approved or NIST-recommended: an algorithm ortechnique that is either 1) specified in a FIPS or NIST
Recommendation, or 2) adopted in a FIPS or NIST
Recommendation.

Authentication

Provides assurance of the authenticity and, therefore, theintegrity of data.

Bit

A binary digit having a value of zero or one.

Block

In this Recommendation, a binary string, for example, aplaintext or a ciphertext, is segmented with a given length.
Each segment is called a block. Data is processed block byblock, from left to right.

Block Cipher Algorithm

A family of functions and their inverses that isparameterized by a cryptographic key; the function maps bit
strings of a fixed length to bit strings of the same length.

Byte

A group of eight bits that is treated either as a single entity
or as an array of eight individual bits.

Ciphertext

Encrypted (enciphered) data.

Cryptographic Key

A parameter that determines the transformation using DEA
and TDEA forward and inverse operations.

Data Encryption Algorithm

The DEA cryptographic engine that is used by the Triple
Data Encryption Algorithm (TDEA).

Decryption

The process of transforming ciphertext into plaintext.

Encryption

The process of transforming plaintext into ciphertext.

Exclusive-OR

The bit-by-bit modulo 2 addition of binary vectors of equal
length.

Forward Cipher
Operation/Forward
Transformation

One of the two functions of the block cipher algorithm thatis determined by the choice of a cryptographic key. The term
“forward cipher operation” is used for TDEA, while theterm “forward transformation” is used for DEA.

Inverse Cipher
Operation/Inverse
Transformation

The block cipher algorithm function that is the inverse of theforward cipher function. The term “inverse cipher
operation” is used for TDEA, while the term “inverse
transformation” is used for DEA.

Key

See cryptographic key.

20

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERKey Bundle

The three DEA cryptographic keys (Key1, Key2, Key3) thatare used with a TDEA mode.

Plaintext

Intelligible data that has meaning and can be read or acted
upon without the application of decryption. Also known ascleartext.

C.2

Acronyms

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

2TDEA

Two-key TDEA.

3TDEA

Three-key TDEA.

CAVP

Cryptographic Algorithm Validation Program.

CMVP

Cryptographic Module Validation Program.

DEA

Data Encryption Algorithm, previously specified in FIPS 46 (nowwithdrawn).

FIPS

Federal Information Processing Standard.

NIST

National Institute of Standards and Technology.

SP(NIST) Special Publication.

TDEA

Triple Data Encryption Algorithm.

21

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERAPPENDIX D: REFERENCES
Federal information Processing Standards (FIPS) and NIST Special Publications (SPs) areavailable at https://csrc.nist.gov/publications.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

FIPS 140-2

Federal Information Processing Standard (FIPS) 140-2, Security
Requirements for Cryptographic Modules, May 25, 2001 (withupdates through Change Notice 2, December 3, 2002).
https://doi.org/10.6028/NIST.FIPS.140-2.

FIPS 140-2, Annex C

Federal Information Processing Standard 140-2, Annex C,
Approved Random Number Generators, January 4, 2016.
https://csrc.nist.gov/CSRC/media/Publications/fips/140/2/final/documents/fips1402annexc.pdf.

SP 800-20

NIST Special Publication 800-20, Modes of Operation Validation
System for the Triple Data Encryption Algorithm (TMOVS):
Requirements
andProcedures,
March
2012.
https://doi.org/10.6028/NIST.SP.800-20.

SP 800-38A

NIST Special Publication 800-38A, Recommendation for Block
Cipher Modes of Operation, Methods and Techniques, December
2001. https://doi.org/10.6028/NIST.SP.800-38A.

SP 800-38A
Addendum

NIST Special Publication 800-38A Addendum, Recommendationfor Block Cipher Modes of Operation: Three Variants of
Ciphertext Stealing for CBC Mode, October 2010.
https://doi.org/10.6028/NIST.SP.800-38A-Add.

SP 800-38B

NIST Special Publication 800-38B, Recommendation for Block
Cipher Modes of Operation: The CMAC Mode for Authentication,
May 2005. https://doi.org/10.6028/NIST.SP.800-38B.

SP 800-38F

NIST Special Publication 800-38F, Recommendation for Block
Cipher Modes of Operation: Methods for Key Wrapping,
December 2012. https://doi.org/10.6028/NIST.SP.800-38F.

SP 800-57, Part 1

NIST Special Publication 800-57 Part 1, Revision 4,
Recommendation for Key Management, Part 1: General, January
2016. https://doi.org/10.6028/NIST.SP.800-57pt1r4.

SP 800-90A

NIST Special Publication 800-90A Revision 1, Recommendation
for Random Number Generation Using Deterministic Random Bit
Generators, June 2015. https://doi.org/10.6028/NIST.SP.80090Ar1.

SP 800-131A

NIST Special Publication 800-131A Revision 1, Transitions:
Recommendation for Transitioning the Use of Cryptographic
Algorithms
andKey
Lengths,
November
2015.
https://doi.org/10.6028/NIST.SP.800-131Ar1.

22

NIST SP 800-67 REV. 2

SP 800-133

RECOMMENDATION FOR TDEA BLOCK CIPHERNIST Special Publication 800-133, Recommendation for
Cryptographic Key Generation, December 2012.
https://doi.org/10.6028/NIST.SP.800-133.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

23

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHERAPPENDIX E: REVISIONS
Version 1.1 modified the list of weak keys, correcting the third and fourth weak keys in thelist. In addition, a note was inserted that the actual values of the parity bits were ignored
when listing the weak and semi-weak keys.

In version 1.2, the following non-editorial modifications were made:This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

1. The authority section was updated, primarily to include a paragraph about
validation testing.
2. References to American National Standard X9.52, Triple Data Encryption
Algorithm Modes Of Operation, were removed, since the standard was withdrawn.
3. Various parts of SP 800-38 were referenced: SP 800-90 and FIPS 140-2, Annex C,
were referenced for random bit generators; SP 800-131A was referenced for thetransition away from two-key TDEA; and SP 800-133 was referenced for key
generation.
4. The previous Section 1.1, Basis, was removed, since the information is provided in
the Authority section.
5. The previous Section 1.2, Applicability, was removed.
6. In Table 3 of Section 2.3, the third entry in the first row was corrected to be “20.”
7. In Section 3.1, the relationship of the acceptable keys used for TDEA was further
clarified.
8. In Section 3.5, the “should not” in the statement “One key bundle should not be
used to process more than 232 64-bit data blocks when the keys conform to Keying
Option 1…” was changed to “shall not.”9. In Section 3.4.1, line 2, the “must” was changed to “shall.”
10. In Section 3.5, guidance for the use of Keying Options 1 and 2 was further clarified.
In addition, the “should not” in the statement “One key bundle should not be used
to process more than 232 64-bit data blocks when the keys conform to Keying
Option 1…” was changed to “shall not.”11. In Appendix D, additional references were provided for SP 800-131A and SP 800133.
12. Appendix E was added to identify requirements that are the responsibility of entities
that install, configure or use applications or protocols that incorporate TDEA.
SP 800-67 Revision 2 (November 2017) includes the following revisions:
1. Any text indicating that TDEA is approved for use by the Federal Government wasremoved. Approval for TDEA use will be indicated in SP 800-131A.
24

NIST SP 800-67 REV. 2

RECOMMENDATION FOR TDEA BLOCK CIPHER

2. Forward, paragraph 2: Text was added to say that security also depends on theamount of data protected by the key. Also, a paragraph was removed that indicatedthat TDEA could be used through 2030. This issue will be addressed in SP 800-57,
Part 1 and SP 800-131A.
3. Section 1, last line: SP 800-90A was included as a use for TDEA.
4. Section 1.2: The title was changed to allow a statement about using TDEA in the
CTR_DRBG specified in SP 800-90A.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-67r2

Para. 1: The SP 800-38 series of modes of operation that may use TDEA were
explicitly listed. A statement about the approval of TDEA and its associated modes
was removed. Approval for the use of TDEA and its modes will be addressed in SP
800-131A.
Para. 2: A statement about using TDEA in the CTR_DRBG was added.
5. Section 1.3, paragraph 3 was modified to reflect changes to the appendices (e.g.,
pointing to examples on NIST's web site). Changes to appendix numbers werereflected later in the document.
6. Section 3.1, paragraph 2: The wording was modified to allow the use of threeunique keys for both applying cryptographic protection (e.g., encryption and thegeneration of message authentication codes) and reversing or verifying that
protection (e.g., decryption and verifying a message authentication code). Also, theuse of two-key TDEA was allowed for legacy use only.
7. Old Section 3.2 (TDEA Keying Options) was removed, since the information isprovided in Section 3.1.
8. New Section 3.2 (Old Section 3.3, TDEA Modes of Operation): The title waschanged to "TDEA Usage." The documents that use TDEA were explicitly
identified.
9. New Section 3.4 (Old Section 3.5): Rewritten to further limit the number of blocks
that may be used to apply cryptographic protection using TDEA. Warnings aboutprocessing (e.g., decrypting) information protected using the limits of previous
versions of SP 800-67 were included.
10. Appendix B was modified to point to examples on the NIST web site, rather thanincluding the examples in this version of SP 800-67.
11. Appendix C: A list of acronyms was added in Appendix C.2.
12. Appendix D: The references were updated, including adding a reference to SP 80038F.
13. Old Appendix E was removed. This information is specific to the Cryptographic
Algorithm Validation Program.

25