NIST Special Publication 800-67

 Version 1.2

Recommendation for the Triple 

Data Encryption Algorithm 

(TDEA) Block Cipher

Revised July 2011

William C. Barker

I N F O R M A T I O N S E C U R I T Y

Computer Security Division

Information Technology Laboratory

National Institute of Standards and Technology

Gaithersburg, MD 20899-8930

July 2011

U.S. DEPARTMENT OF COMMERCE

Gary Locke, Secretary

NATIONAL INSTITUTE OF STANDARDS AND 

TECHNOLOGY

Patrick Gallagher. Director
SP 800-67, version 1.2 July 2011

ii

AUTHORITY

This document has been developed by the National Institute of Standards and Technology 

(NIST) in furtherance of its statutory responsibilities under the Federal Information Security 

Management Act (FISMA) of 2002, Public Law 107-347.

NIST is responsible for developing standards and guidelines, including minimum requirements, 

for providing adequate information security for all agency operations and assets, but such 

standards and guidelines shall not apply to national security systems. 

This Recommendation has been prepared for use by federal agencies. It may be used by 

nongovernmental organizations on a voluntary basis and is not subject to copyright. (Attribution 

would be appreciated by NIST.) 

Nothing in this document should be taken to contradict standards and guidelines made 

mandatory and binding on federal agencies by the Secretary of Commerce under statutory 

authority. Nor should this recommendation be interpreted as altering or superseding the existing 

authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.

Conformance testing for implementations of this Recommendation will be conducted within the 

framework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic 

Algorithm Module Program (CMVP). The requirements of this Recommendation are indicated 

by the word “shall.” Some of these requirements may be out-of-scope for CAVP or CMVP 

validation testing, and thus are the responsibility of entities using, implementing, installing or 

configuring applications that incorporate this Recommendation.
SP 800-67, version 1.2 July 2011

iii

Acknowledgements

The author wishes to thank his colleagues who reviewed drafts of this document and contributed 

to its development. The author also gratefully acknowledges and appreciates the many comments 

from the public and private sectors whose thoughtful and constructive comments improved the 

quality and usefulness of this publication. 
SP 800-67, version 1.2 July 2011

iv

Abstract

This publication specifies the Triple Data Encryption Algorithm (TDEA), including its primary

component cryptographic engine, the Data Encryption Algorithm (DEA). When implemented in 

an SP 800-38 series-compliant mode of operation and in a FIPS 140-2 compliant cryptographic 

module, TDEA may be used by Federal organizations to protect sensitive unclassified data. 

Protection of data during transmission or while in storage may be necessary to maintain the 

confidentiality and integrity of the information represented by the data. This Recommendation 

defines the mathematical steps required to cryptographically protect data using TDEA and to 

subsequently process such protected data. The Triple Data Encryption Algorithm (TDEA) is 

made available for use by Federal agencies within the context of a total security program 

consisting of physical security procedures, good information management practices, and 

computer system/network access controls. 

Key words: block cipher, computer security, cryptography, data encryption algorithm, security, 

triple data encryption algorithm.
SP 800-67, version 1.2 July 2011

v

Foreward

The Triple Data Encryption Algorithm (TDEA) is an approved cryptographic algorithm as 

required by FIPS 140-2, Security Requirements for Cryptographic Modules. TDEA specifies 

both the DEA cryptographic engine employed by TDEA and the TDEA algorithm itself. 

This Recommendation provides a description of a mathematical algorithm for cryptographically 

protecting binary coded information (e.g., using encryption and authentication). The algorithm 

described in this recommendation specifies cryptographic operations that are based on a binary 

number called a key.

Authorized users of computer data cryptographically protected using TDEA must have the key 

that was used to protect the data in order to process the protected data. The cryptographic 

algorithm specified in this Recommendation is assumed to be commonly known among its users. 

The cryptographic security of the data depends on the security provided for the key used to 

protect the data.

Data that is determined by a responsible authority to be sensitive, data that has a high value, or 

data that represents a high value should be cryptographically protected if it is vulnerable to 

unauthorized disclosure or undetected modification during transmission or while in storage. A 

risk analysis should be performed under the direction of a responsible authority to determine 

potential threats. The costs of providing cryptographic protection using this Recommendation, as 

well as of alternative methods for providing this protection, should be projected. A responsible 

authority then should make a decision, based on these analyses, whether or not to use 

cryptographic protection and this recommendation. 

The Data Encryption Standard became effective July 1977. It was reaffirmed in 1983, 1988, 

1993, and 1999. The DES has now been withdrawn. The use of DES is permitted only as a 

component function of TDEA. This Recommendation applies to all Federal agencies, contractors 

of Federal agencies, or other organizations that process information (using a computer or 

telecommunications system) on behalf of the Federal Government to accomplish a Federal 

function. Each Federal agency or department may issue internal directives for the use of this 

recommendation by their operating units based on their data security requirement determinations.

With the withdrawal of the FIPS 46-3 standard, implementations of the DES function are no 

longer authorized for protection of Federal government information.

Note: Through the year 20301, Triple DES (TDEA) and the FIPS 197 Advanced Encryption 

Standard (AES) will coexist as FIPS-approved algorithms – thus, allowing for a gradual 

 

1

 TDEA with Keying Option 2, two mutually independent 64-bit keys and a third 64-bit key that is the same as the 

first of the independent 64-bit keys, is approved for the protection of Federal government information only through 

the period of time specified in SP 800-131A. Recommendations regarding the use of Option 2 are contained in SP 

800-57, Part 1. 
SP 800-67, version 1.2 July 2011

vi

transition to AES. (The AES is another symmetric based encryption standard approved by 

NIST.)

Implementations of the algorithm specified in this Recommendation may be covered by U.S. and 

foreign patents. Certain cryptographic devices and technical data regarding them are subject to 

Federal export controls. Exports of cryptographic modules implementing this algorithm and 

technical data regarding them must comply with these Federal regulations and be licensed by the 

Bureau of Export Administration of the U.S. Department of Commerce. Applicable Federal 

government export controls are specified in Title 15, Code of Federal Regulations (CFR) Part 

740.17; Title 15, CFR Part 742; and Title 15, CFR Part 774, Category 5, Part 2.
SP 800-67, version 1.2 July 2011

vii

Table of Contents

1. INTRODUCTION.........................................................................................................1

1.1 Applications............................................................................................................................ 1

1.2 Modes of Using the TDEA..................................................................................................... 2

1.3 Organization............................................................................................................................ 2

2. DATA ENCRYPTION ALGORITHM CRYPTOGRAPHIC ENGINE............................3

2.1 DEA Forward Transformation............................................................................................. 3

2.2 DEA Inverse Transformation ............................................................................................... 6

2.3 The Function f........................................................................................................................ 7

3. TRIPLE DATA ENCRYPTION ALGORITHM ...........................................................10

3.1 Basic TDEA Forward and Inverse Cipher Operations..................................................... 10

3.2 TDEA Keying Options......................................................................................................... 10

3.3 TDEA Modes of Operation ................................................................................................. 10

3.4 Keys....................................................................................................................................... 10

3.4.1 Key Requirements........................................................................................................... 11

3.4.2 Weak Keys...................................................................................................................... 11

3.5 Usage Guidance .................................................................................................................. 12

APPENDIX A: PRIMITIVE FUNCTIONS FOR THE DATA ENCRYPTION 

ALGORITHM..................................................................................................................13

APPENDIX B: EXAMPLE OF TDEA FORWARD AND INVERSE CIPHER 

OPERATIONS................................................................................................................19

B.1 TDEA Block Cipher Forward Cipher Operations - ECB Mode....................................... 19

B.2 TDEA Block Cipher Inverse Cipher Operation - ECB Mode .......................................... 20
SP 800-67, version 1.2 July 2011

viii

APPENDIX C: GLOSSARY ..........................................................................................22

APPENDIX E: CONFORMANCE TO NON-TESTABLE REQUIREMENTS..................25

APPENDIX F: CHANGES.............................................................................................27
SP 800-67, version 1.2 July 2011

1

National Institute of Standards and Technology

Special Publication 800-67

SPECIFICATIONS FOR THE

TRIPLE DATA ENCRYPTION ALGORITHM (TDEA) BLOCK CIPHER

1. INTRODUCTION

This Recommendation specifies the Triple Data Encryption Algorithm (TDEA) block cipher. 

The TDEA block cipher includes a Data Encryption Algorithm (DEA) cryptographic engine 

implemented as a component of TDEA as specified in Section 3. TDEA functions incorporating 

the DEA cryptographic engine shall be designed in such a way that they may be used in a 

computer system, storage facility, or network to provide cryptographic protection to binary 

coded data. The method of implementation will depend on the application and environment. 

TDEA implementations shall be subject to being tested and validated as accurately performing 

the transformations specified in the TDEA algorithm and in NIST Special Publication (SP) 800-

382.

1.1 Applications 

Cryptography is utilized in various applications and environments. The specific utilization of 

encryption and the implementation of TDEA3 will be based on many factors particular to the 

computer system and its associated components. In general, cryptography is used to protect data 

while it is being communicated between two points or while it is stored in a medium vulnerable 

to physical theft or technical intrusion (e.g., hacker attacks). In the first case, the key must be 

available at the transmitter and receiver simultaneously during communication. In the second 

case, the key must be maintained and accessible for the duration of the storage period. NIST 

Special Publications (SP) 800-133 provides approved methods for generating cryptographic 

keys4, and SP 800-57, Part 15, provides recommendations for managing cryptographic keys, 

including the keys used by the algorithm specified in this Recommendation. 

 

2

 SP 800-38: Recommendation for Block Cipher Modes of Operation - Methods and Techniques.

3

 And the cryptographic engine that forms the basis for TDEA.

4

 SP 800-133: Recommendation for Cryptographic Key Generation.

5

 SP 800-57, Part 1: Recommendation for Key Management: General.
SP 800-67, version 1.2 July 2011

2

1.2 Modes of Using the TDEA 

NIST Special Publication 800-38 describes modes of operation for the TDEA block cipher 

described in this Recommendation. These modes of operation are approved for the 

protection of Federal government information. 

1.3 Organization

Section 2 of this Recommendation describes the DEA cryptographic engine employed by 

TDEA. 

Section 3 of the Recommendation describes the basic TDEA algorithm.

Appendices are provided for DEA primitives, examples of encryption and decryption using the

TDEA block cipher operation, a glossary of terms, a list of references, a list of non-testable shall 

statements and a list of version changes. 
SP 800-67, version 1.2 July 2011

3

2. DATA ENCRYPTION ALGORITHM CRYPTOGRAPHIC ENGINE

The DEA cryptographic engine is used by TDEA to cryptographically protect blocks of data 

consisting of 64 bits under the control of a 64-bit key6. Subsequent processing of the protected 

data is accomplished using the same key as was used to protect the data. Each 64-bit key shall

contain 56 bits that are randomly generated and used directly by the algorithm as key bits. The 

other eight bits, which are not used by the algorithm, may be used for error detection. The eight 

error-detecting bits are set to make the parity of each 8-bit byte of the key odd. That is, there is 

an odd number of "1"s in each 8-bit byte7. 

During each application of the DEA engine, a block is subjected to an initial permutation IP, 

then to a complex key-dependent computation and finally to a permutation that is the inverse of 

the initial permutation, IP-1. The key-dependent computation can be simply defined in terms of a 

function f and a function KS, called the key schedule. The DEA engine can be run in two 

directions - as a forward transformation and as an inverse transformation. The two directions 

differ only by the order in which the bits of the key are used.

Descriptions of the forward and inverse transformations are provided below, followed by a 

definition of the function f in terms of primitive functions called by the selection functions Si, and 

the permutation function P. Values for Si, P and KS of the engine are contained in Appendix A.

The following notation is convenient: Given two blocks L and R of bits, LR denotes the block 

consisting of the bits of L followed by the bits of R. Since concatenation is associative, 

B1B2...B8, for example, denotes the block consisting of the bits of byte B1 followed by the bits of 

byte B2...followed by the bits of byte B8.

2.1 DEA Forward Transformation

A sketch of the forward transformation is given in Figure 1.

 

6 Blocks are composed of bits numbered from left to right, i.e., the left-most bit of a block is bit one.

7 Sometimes keys are generated in an encrypted form. A random 64-bit number is generated and defined to be the 

cipher formed by the encryption of a key using a key encrypting key. In this case the parity bits of the encrypted key 

cannot be set until after the key is decrypted.
SP 800-67, version 1.2 July 2011

4

Figure 1. Forward Transformation of the DEA Cryptographic Engine

The 64 bits of the input block for the forward transformation are first subjected to the following 

permutation, called the initial permutation IP:
SP 800-67, version 1.2 July 2011

5

 IP

58 50 42 34 26 18 10 2

60 52 44 36 28 20 12 4

62 54 46 38 30 22 14 6

64 56 48 40 32 24 16 8

57 49 41 33 25 17 9 1

59 51 43 35 27 19 11 3

61 53 45 37 29 21 13 5

63 55 47 39 31 23 15 7

That is, the permuted input has bit 58 of the input as its first bit, bit 50 as its second bit, and so 

on, with bit 7 as its last bit. The permuted input block is then the input to a complex keydependent computation that is described below. The output of that computation, called the 

preoutput, is then subjected to the following permutation that is the inverse of the initial 

permutation:

 IP-1

40 8 48 16 56 24 64 32

39 7 47 15 55 23 63 31

38 6 46 14 54 22 62 30

37 5 45 13 53 21 61 29

36 4 44 12 52 20 60 28

35 3 43 11 51 19 59 27

34 2 42 10 50 18 58 26

33 1 41 9 49 17 57 25

That is, the output of the algorithm has bit 40 of the preoutput block as its first bit, bit 8 as its 

second bit, and so on, until bit 25 of the preoutput block is the last bit of the output. 

The key-dependent computation that uses the permuted input block as its input to produce the 

preoutput block consists, except for a final interchange of blocks, of 16 iterations of a calculation 

that is described below in terms of the function f. This function operates on two blocks, one of 32 

bits and one of 48 bits, to produce a block of 32 bits.

Let the 64 bits of the input block to an iteration consist of a 32 bit block L, followed by a 32 bit 

block R. Using the notation defined above, the input block is then LR.

Let K be a block of 48 bits chosen from the 64-bit key. Then the output L'R' of an iteration with 

input LR is defined by:
SP 800-67, version 1.2 July 2011

6

(1) L' = R

R' = L ⊕ f(R,K)

where ⊕ denotes bit-by-bit addition modulo 2 (also known as exclusive-or or XOR).

As remarked before, the input of the first iteration of the calculation is the permuted input block. 

If L'R' is the output of the 16th iteration, then R'L' is the preoutput block. At each iteration, a 

different block K of key bits is chosen from the 64-bit key designated by KEY.

With more notation, the iterations of the computation can be described in more detail. Let KS be 

a function that takes an integer n in the range from 1 to 16 and a 64-bit block KEY as input. The 

output of KS is a 48-bit block Kn that is a permuted selection of bits from KEY. That is:

(2) Kn = KS(n,KEY)

with Kn determined by the bits in 48 distinct bit positions of KEY. KS is called the key schedule 

because the block K used in the n'th iteration of (1) is the block Kn determined by (2).

As before, let the permuted input block be LR. Finally, let L() and R() be respectively L and R,

and let Ln and Rn be respectively L' and R' of (1) when L and R are respectively Ln-1 and Rn-1,

and K is Kn; that is, when n is in the range from 1 to 16,

(3) Ln = Rn-1

Rn = Ln-1 ⊕ f(Rn-1,Kn)

The preoutput block is then R16L16.

The key schedule KS of the algorithm is described in detail in Appendix A. The key schedule 

produces the 16 Kn that are required for the algorithm.

2.2 DEA Inverse Transformation

The permutation IP-1 applied to the preoutput block is the inverse of the initial permutation IP 

(4) R = L'

L = R' ⊕ f(L',K)

Consequently, to apply the inverse transformation, it is only necessary to apply the very same 

algorithm to a block of the protected data produced by the forward transformation, taking care 

that at each iteration of the computation, the same block of key bits K is used during the inverse 

transformation as was used during the forward transformation.

Using the notation of the previous section, this can be expressed by the equations:

(5) Rn-1 = Ln

Ln-1 = Rn ⊕ f(Ln,Kn)

where R16L16 is the permuted input block for the inverse transformation, and L0R0 is the 

preoutput block. That is, for the inverse transformation with R16L16 as the permuted input, K16 is 

used in the first iteration, K15 in the second, and so on, with K1 used in the 16th iteration.
SP 800-67, version 1.2 July 2011

7

2.3 The Function f

A sketch of the calculation of f(R,K) is given in Figure 2.

Let E denote a function, which takes a block of 32 bits as input and yields a block of 48 bits as 

output. Let E be such that the 48 bits of its output, written as 8 blocks of 6 bits each, are obtained 

by selecting the bits in its inputs in order according to Table 1: 

Figure 2. Calculation of f(R, K)

Table 1: E BIT-SELECTION TABLE

32 1 2 3 4 5

 4 5 6 7 8 9

 8 9 10 11 12 13

12 13 14 15 16 17
SP 800-67, version 1.2 July 2011

8

16 17 18 19 20 21

20 21 22 23 24 25

24 25 26 27 28 29

28 29 30 31 32 1

Thus, the first three bits of E(R) are the bits in positions 32, 1 and 2 of R, while the last 2 bits of 

E(R) are the bits in positions 32 and 1.

Each of the unique selection functions S1, S2,..., S8, takes a 6-bit block as input and yields a 4-bit 

block as output and is illustrated by using Table 2. Table 2 contains S1:

Table 2: S1

Column Number

Row

 No. 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

 0 14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7

 1 0 15 7 4 14 2 13 1 10 6 12 11 9 5 3 8

 2 4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0

 3 15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13

If S1 is the function defined in this table, and B is a block of 6 bits, then S1(B) is determined as 

follows: The first and last bits of B represent, in base 2, a number in the range 0 to 3. Let that 

number be i. The middle 4 bits of B represent, in base 2, a number in the range 0 to 15. Let that 

number be j. Using the table, look up the number in the i'th row and j'th column. It is a number in 

the range 0 to 15 and is uniquely represented by a 4-bit block. That block is the output S1(B) of 

S1 for the input B. For example, for input 011011 the row is 01 (i.e., row 1), and the column is 

determined by 1101 (i.e., column 13). The number 5 appears in row 1, column 13, so the output 

is 0101.

Selection functions S1,S2,...,S8 of the algorithm appear in Appendix A.

The permutation function P yields a 32-bit output from a 32-bit input by permuting the bits of 

the input block. Such a function is defined by Table 3:

Table 3: P

16 7 20 21

29 12 28 17

 1 15 23 26
SP 800-67, version 1.2 July 2011

9

 5 18 31 10

 2 8 24 14

32 27 3 9

19 13 30 6

22 11 4 25

The output P(L) for the function P defined by this table is obtained from the input L by taking 

the 16th bit of L as the first bit of P(L), the 7th bit as the second bit of P(L), and so on until the 

25th bit of L is taken as the 32nd bit of P(L). The permutation function P of the algorithm is 

repeated in Appendix A.

Now let S1,...,S8 be eight distinct selection functions, let P be the permutation function, and let E 

be the function defined above.

To define f(R,K), let B1,...,B8 be blocks of 6 bits each for which

(6) B1B2...B8 = K ⊕ E(R)

The block f(R,K) is then defined to be

(7) P(S1(B1)S2(B2)...S8(B8))

Thus, K ⊕ E(R) is first divided into the 8 blocks as indicated in (6). Then each Bi is taken as an 

input to Si, and the 8 blocks S1(B1),S2(B2),...,S8(B8) of 4 bits each are consolidated into a single 

block of 32 bits, which forms the input to P. The result (7) is then the output of the function f for 

the inputs R and K.
SP 800-67, version 1.2 July 2011

10

3. TRIPLE DATA ENCRYPTION ALGORITHM

3.1 Basic TDEA Forward and Inverse Cipher Operations

In this recommendation, each TDEA forward and inverse cipher operation is a compound 

operation of DEA forward and inverse transformations as specified in Section 2.

A TDEA key consists of three keys for the cryptographic engine (Key1, Key2 and Key3); the three 

keys are also referred to as a key bundle (KEY). Two options for the selection of the keys in a 

key bundle are approved. Option 1, the preferred option, employs three mutually independent 

keys (i.e. Key1, Key2 and Key3, where Key1 ≠ Key2 ≠ Key3 ≠ Key1). Option 2 employs two 

mutually independent keys and a third key that is the same as the first key (i.e. Key1, Key2 and 

Key3, where Key1 ≠ Key2 and Key3 = Key1). A key bundle shall not consist of three identical 

keys. 

Let FKeyX (d) and IKeyY (d), respectively, represent the DEA forward and inverse transformations 

on data d using key bundle KEY. The following operations are used:

1. TDEA forward cipher operation: the transformation of a 64-bit block d into a 64-bit block 

O that is defined as follows:

O = FKey3(IKey2(FKey1(d))).

2. TDEA inverse cipher operation: the transformation of a 64-bit block d into a 64-bit block 

O that is defined as follows:

O = IKey1(FKey2(IKey3(d))).

3.2 TDEA Keying Options

This Recommendation specifies the following keying options for a TDEA key bundle (Key1, 

Key2, Key3)

1. Keying Option 1: Key1, Key2 and Key3 are independent keys (i.e., Key1 ≠ Key2 ≠ Key3 ≠

Key1);

2. Keying Option 2: K1 and K2 are independent keys (i.e., Key1 ≠ Key2, and Key3 = Key1).

3.3 TDEA Modes of Operation

TDEA shall be implemented using one or more of the modes of operation specified in NIST 

Special Publication 800-38. These modes of operation are approved for the protection of 

Federal government sensitive, but unclassified information. Each of the modes employs the 

TDEA forward or inverse ciphers as defined in Section 3.1. Note that the TDEA block cipher 

shall be used to provide cryptographic security only when used in an approved mode of 

operation. 

3.4 Keys

The TDEA keys shall be managed in accordance with NIST Special Publication (SP) 800-57, 

Part 1. SP 800-57, Part 1 also specifies time frames during which the TDEA keying options may 
SP 800-67, version 1.2 July 2011

11

be used. The following specifications for keys shall be met in implementing the TDEA modes 

of operation. 

3.4.1 Key Requirements

For all TDEA modes of operation, three cryptographic keys (Key1, Key2, Key3) define a TDEA 

key bundle. The bundle and the individual keys shall:

a. be kept secret;

b. be generated using an approved method8 that is based on the output of an approved

random bit generator9;

c. be independent of other key bundles;

d. have integrity whereby each key in the bundle has not been altered in an 

unauthorized manner since the time it was generated, transmitted, or stored by an 

authorized source;

e. be used in the appropriate order as specified by the particular mode; 

f. be considered a fixed quantity in which an individual key cannot be manipulated 

while leaving the other two keys unchanged; and cannot be unbundled except for its 

designated purpose. 

3.4.2 Weak Keys

There are a few keys that are considered weak for the DEA cryptographic engine. The use of 

weak keys can reduce the effective security afforded by TDEA and should be avoided. Keys that 

are considered weak are (in hexadecimal format): 

• 00000000 00000000 

• 00000000 FFFFFFFF 

• E0E0E0E0 F1F1F1F1 

• 1F1F1F1F 0E0E0E0E

Note that the weak keys listed above and the semi-weak keys listed below are expressed without 

regard to the actual value of the parity bits.

Some pairs of keys encrypt plaintext to identical ciphertext. These semi-weak keys are (in 

hexadecimal format): 

• 011F011F010E010E and 1F011F010E010E01

• 01E001E001F101F1 and E001E001F101F101

• 01FE01FE01FE01FE and FE01FE01FE01FE01 

 

8

 See SP 800-133.

9

 See SP 800-90 and FIPS 140-2, Annex C.
SP 800-67, version 1.2 July 2011

12

• 1FE01FE00EF10EF1 and E01FE01FF10EF10E 

• 1FFE1FFE0EFE0EFE and FE1FFE1FFE0EFE0E 

• E0FEE0FEF1FEF1FE and FEE0FEE0FEF1FEF1 

There are also 48 keys that produce only four distinct subkeys (instead of 16) - these are called 

possibly weak keys. These possibly-weak keys are (in hex):

01011F1F01010E0E 1F1F01010E0E0101 E0E01F1FF1F10E0E

0101E0E00101F1F1 1F1FE0E00E0EF1F1 E0E0FEFEF1F1FEFE

0101FEFE0101FEFE 1F1FFEFE0E0EFEFE E0FE011FF1FE010E

011F1F01010E0E01 1FE001FE0EF101FE E0FE1F01F1FE0E01

011FE0FE010EF1FE 1FE0E01F0EF1F10E E0FEFEE0F1FEFEF1

011FFEE0010EFEF1 1FE0FE010EF1FE01 FE0101FEFE0101FE

01E01FFE01F10EFE 1FFE01E00EFE01F1 FE011FE0FE010EF1

01E01FFE01F1F10E 1FFEE0010EFEF001 FE1F01E0FE0E01F1

01E0E00101F1F101 1FFEFE1F0EFEFE0E FE1FE001FE0EF101

01E0FE1F01F1FE0E E00101E0F10101F1 FE1F1FFEFE0E0EFE

01FE1FE001FE0EF1 E0011FFEF1010EFE FEE0011FFEF1010E

01FEE01F01FEF10E E001FE1FF101FE0E FEE01F01FEF10E01

01FEFE0101FEFE01 E01F01FEF10E01FE FEE0E0FEFEF1F1FE

1F01011F0E01010E E01F1FE0F10E0EF1 FEFE0101FEFE0101

1F01E0FE0E01F1FE E01FFE01F10EFE01 FEFE1F1FFEFE0E0E

1F01FEE00E01FEF1 E0E00101F1F10101 FEFEE0E0FEFEF1F1

3.5 Usage Guidance

The security of TDEA is affected by the number of blocks processed with one key bundle. One 

key bundle shall not be used to process more than 232 64-bit data blocks when the keys conform 

to Keying Option 1 (see Section 3.2). When Keying Option 2 is used, the keys shall not be used 

to process more than 220 blocks (see SP 800-131A).
SP 800-67, version 1.2 July 2011

13

APPENDIX A: PRIMITIVE FUNCTIONS FOR THE DATA 

ENCRYPTION ALGORITHM

The choice of the primitive functions KS, S1,...,S8 and P is critical to the strength of the 

transformations resulting from the algorithm. The tables below specify the functions S1,...,S8 and 

P. For the interpretation of the tables describing these functions, see the discussion in Section 2.

The primitive functions S1,...,S8 are:

S1

 14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7

 0 15 7 4 14 2 13 1 10 6 12 11 9 5 3 8

 4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0

 15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13

S2

 15 1 8 14 6 11 3 4 9 7 2 13 12 0 5 10

 3 13 4 7 15 2 8 14 12 0 1 10 6 9 11 5

 0 14 7 11 10 4 13 1 5 8 12 6 9 3 2 15

 13 8 10 1 3 15 4 2 11 6 7 12 0 5 14 9

S3

 10 0 9 14 6 3 15 5 1 13 12 7 11 4 2 8

 13 7 0 9 3 4 6 10 2 8 5 14 12 11 15 1

 13 6 4 9 8 15 3 0 11 1 2 12 5 10 14 7

 1 10 13 0 6 9 8 7 4 15 14 3 11 5 2 12

S4

 7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15

 13 8 11 5 6 15 0 3 4 7 2 12 1 10 14 9

 10 6 9 0 12 11 7 13 15 1 3 14 5 2 8 4

 3 15 0 6 10 1 13 8 9 4 5 11 12 7 2 14

S5

 2 12 4 1 7 10 11 6 8 5 3 15 13 0 14 9

 14 11 2 12 4 7 13 1 5 0 15 10 3 9 8 6
SP 800-67, version 1.2 July 2011

14

 4 2 1 11 10 13 7 8 15 9 12 5 6 3 0 14

 11 8 12 7 1 14 2 13 6 15 0 9 10 4 5 3

S6

 12 1 10 15 9 2 6 8 0 13 3 4 14 7 5 11

 10 15 4 2 7 12 9 5 6 1 13 14 0 11 3 8

 9 14 15 5 2 8 12 3 7 0 4 10 1 13 11 6

 4 3 2 12 9 5 15 10 11 14 1 7 6 0 8 13

S7

 4 11 2 14 15 0 8 13 3 12 9 7 5 10 6 1

 13 0 11 7 4 9 1 10 14 3 5 12 2 15 8 6

 1 4 11 13 12 3 7 14 10 15 6 8 0 5 9 2

 6 11 13 8 1 4 10 7 9 5 0 15 14 2 3 12

S8

 13 2 8 4 6 15 11 1 10 9 3 14 5 0 12 7

 1 15 13 8 10 3 7 4 12 5 6 11 0 14 9 2

 7 11 4 1 9 12 14 2 0 6 10 13 15 3 5 8

 2 1 14 7 4 10 8 13 15 12 9 0 3 5 6 11

The primitive function P is:

16 7 20 21

29 12 28 17

 1 15 23 26

 5 18 31 10

 2 8 24 14

32 27 3 9

19 13 30 6

22 11 4 25

Recall that Kn, for 1≤n≤16, is the block of 48 bits in (2) of the algorithm. Hence, to describe KS, 

it is sufficient to describe the calculation of Kn from a key (Keyi) from the key bundle for n = 1, 

2,..., 16. That calculation is illustrated in Figure 4. To complete the definition of KS, it is 

therefore sufficient to describe the two permuted choices, as well as the schedule of left shifts. 

One bit in each 8-bit byte of Keyi may be utilized for error detection in key generation, 
SP 800-67, version 1.2 July 2011

15

distribution and storage. Bits 8, 16,..., 64 are for use in assuring that each byte is of odd parity. 

[Note that these eight parity bits have no effect on the operation of the algorithm.]
SP 800-67, version 1.2 July 2011

16

Figure 4: Key Schedule Calculation
SP 800-67, version 1.2 July 2011

17

Permuted choice 1 is determined by the following table:

PC-1 

57 49 41 33 25 17 9

 1 58 50 42 34 26 18

10 2 59 51 43 35 27

19 11 3 60 52 44 36

63 55 47 39 31 23 15

 7 62 54 46 38 30 22

14 6 61 53 45 37 29

21 13 5 28 20 12 4

The table has been divided into two parts, with the first part determining how the bits of 

C( ) are chosen, and the second part determining how the bits of D( ) are chosen. The bits 

of Keyi are numbered 1 through 64. The bits of C( ) are respectively bits 57, 49, 41,..., 44 

and 36 of Keyi, with the bits of D( ) being bits 63, 55, 47,..., 12 and 4 of Keyi.

With C( ) and D( ) defined, the blocks Cn and Dn are obtained from the blocks Cn-1 and Dn-1, 

respectively, for n = 1, 2,..., 16, by adhering to the following schedule of left shifts of the 

individual blocks:

Iteration Number of

 Number Left Shifts

 1 1

 2 1

 3 2

 4 2

 5 2

 6 2

 7 2

 8 2

 9 1

 10 2

 11 2

 12 2
SP 800-67, version 1.2 July 2011

18

 13 2

 14 2

 15 2

 16 1

For example, C3 and D3 are obtained from C2 and D2, respectively, by two left shifts, and 

C16 and D16 are obtained from C15 and D15, respectively, by one left shift. In all cases, by a 

single left shift is meant a rotation of the bits one place to the left, so that after one left 

shift the bits in the 28 positions are the bits that were previously in positions 2, 3,..., 28, 

1.

Permuted choice 2 is determined by the following table:

 PC-2

14 17 11 24 1 5

 3 28 15 6 21 10

23 19 12 4 26 8

16 7 27 20 13 2

41 52 31 37 47 55

30 40 51 45 33 48

44 49 39 56 34 53

46 42 50 36 29 32

Therefore, the first bit of Kn is the 14th bit of CnDn, the second bit of Kn is the 17th bit of 

CnDn, and so on, with the 47th bit of Kn as the 29th bit of CnDn, and the 48th bit of Kn as

the 32nd bit of CnDn.
SP 800-67, version 1.2 July 2011

19

APPENDIX B: EXAMPLE OF TDEA FORWARD AND INVERSE 

CIPHER OPERATIONS

This Appendix presents an example that may be used when implementing the TDEA 

forward and inverse cipher operations. Appendices B.1 and B.2 provide an example of 

TDEA forward and inverse cipher operations in the Electronic Codebook (ECB) mode as 

specified in SP 800-38A.

In this example, all keys, plaintext and ciphertext are expressed in hexadecimal. The 

example uses three independent keys (Keying Option 1), which are:

Key1 = 0123456789ABCDEF

Key2 = 23456789ABCDEF01

Key3 = 456789ABCDEF0123

The plaintext for the example is selected from the ASCII encoding of the phrase “The 

quick brown fox jumped over the lazy dog’s back”. The example employs the first 

24 characters of the phrase (i.e., The quick brown fox jump).

The ASCII encoding of the above phrase is segmented as follows:

 “The quic” 5468652071756663

“k brown ” 6B2062726F776E20

“fox jump” 666F78206A756D70

B.1 TDEA Block Cipher Forward Cipher Operations - ECB Mode

In the example below, the input and output of the DEA cryptographic engine are given 

sequentially. At step 1, the input to DEA1 is P1, and the output of DEA1 is 

“A28E91724C4BBA31”. At step 2, the input to DEA2 is the output of DEA1, and the 

output of DEA2 is “5A2EA7F983A2F53F”. At step 3, the input to DEA3 is the output 

of DEA2, and the output of DEA3 is “A826FD8CE53B855F”. The output of DEA3 is 

the ciphertext C1.

P1 = “The quic” = 5468652071756663

Input Output

DEA1 - FKey1 5468652071756663 A28E91724C4BBA31

DEA2 - IKey2 A28E91724C4BBA31 5A2EA7F983A2F53F

DEA3 - FKey3 5A2EA7F983A2F53F A826FD8CE53B855F
SP 800-67, version 1.2 July 2011

20

C1 = A826FD8CE53B855F

During the second TDEA operation, the input is P2, and the output after the three steps is 

ciphertext C2.

P2 = “k brown ” = 6B2062726F776E20

Input Output 

DEA1 - FKey1 6B2062726F776E20 167E47EC24F71D63

DEA2 – IKey2 167E47EC24F71D63 EA141A7DD69701F0

DEA3 – FKey3 EA141A7DD69701F0 CCE21C8112256FE6

C2 = CCE21C8112256FE6

During the third TDEA operation, the input is P3, and the output after the three steps is 

ciphertext C3.

P3 = “ fox jump” = 666F78206A756D70

Input Output

DEA1 – FKey1 666F78206A756D70 2C1A917234425365

DEA2 – IKey2 2C1A917234425365 8059EE8212E22A79

DEA3 – FKey3 8059EE8212E22A79 68D5C05DD9B6B900

C3 = 68D5C05DD9B6B900

The resulting ciphertext is the concatenation of C1, C2 and C3 (i.e., 

A826FD8CE53B855F CCE21C8112256FE6 68D5C05DD9B6B900).

B.2 TDEA Block Cipher Inverse Cipher Operation - ECB Mode

During inverse cipher operations in the ECB mode, the ciphertext C1, C2 and C3 from 

Appendix B.1 are fed into the TDEA to produce the plaintext P1, P2 and P3. The output 

of DEA3 becomes the input to DEA2, and the output of DEA2 becomes the input to 

DEA1.

C1 = A826FD8CE53B855F

Input Output 

DEA3 – IKey3 A826FD8CE53B855F 5A2EA7F983A2F53F

DEA2 – FKey2 5A2EA7F983A2F53F A28E91724C4BBA31

DEA1 – IKey1 A28E91724C4BBA31 5468652071756663
SP 800-67, version 1.2 July 2011

21

P1 = 5468652071756663 = “The quic”.

C2 = CCE21C8112256FE6

Input Output

DEA3 – IKey3 CCE21C8112256FE6 EA141A7DD69701F0

DEA2 – FKey2 EA141A7DD69701F0 167E47EC24F71D63

DEA1 – IKey1 167E47EC24F71D63 6B2062726F776E20

P2 = 6B2062726F776E20 = “k brown ”.

C3 = 68D5C05DD9B6B900

Input Output 

DEA3 – DKey3 68D5C05DD9B6B900 8059EE8212E22A79

DEA2 – EKey2 8059EE8212E22A79 2C1A917234425365

DEA1 – DKey1 2C1A917234425365 666F78206A756D70

P3 = 666F78206A756D70= “fox jump”.

The plaintext is the ASCII encoding of “The quick brown fox jump”.
SP 800-67, version 1.2 July 2011

22

APPENDIX C: GLOSSARY

Approved FIPS-approved or NIST-recommended: an algorithm or 

technique that is either 1) specified in a FIPS or NIST 

Recommendation, or 2) adopted in a FIPS or NIST 

Recommendation.

Authentication Provides assurance of the authenticity and, therefore, the 

integrity of data.

Bit A binary digit having a value of zero or one.

Block In this Recommendation, a binary string, for example, a 

plaintext or a ciphertext, is segmented with a given length. 

Each segment is called a block. Data is processed block by 

block, from left to right. 

Block Cipher Algorithm A family of functions and their inverses that is 

parameterized by a cryptographic key; the function maps

bit strings of a fixed length to bit strings of the same 

length.

Byte A group of eight bits that is treated either as a single entity 

or as an array of eight individual bits.

Ciphertext Encrypted (enciphered) data.

Cryptographic Key A parameter that determines the transformation using DEA 

and TDEA forward and inverse operations. 

Data Encryption Algorithm The DEA cryptographic engine that is used by the Triple 

Data Encryption Algorithm (TDEA). 

Decryption The process of transforming ciphertext into plaintext.

Encryption The process of transforming plaintext into ciphertext.

Exclusive-OR The bit-by-bit modulo 2 addition of binary vectors of equal 

length. 

FIPS Federal Information Processing Standard.

Forward Cipher One of the two functions of the block cipher algorithm that 

is determined by the choice of a cryptographic key.

Inverse Cipher The block cipher algorithm function that is the inverse of 

the forward cipher function. 

Key See cryptographic key.
SP 800-67, version 1.2 July 2011

23

Key Bundle The three cryptographic keys (Key1, Key2, Key3) that are 

used with a TDEA mode.

Plaintext Intelligible data that has meaning and can be read or acted 

upon without the application of decryption. Also known as 

cleartext.
SP 800-67, version 1.2 July 2011

24

Appendix D: References

Federal information Processing Standards (FIPS) and NIST Special Publications (SPs) 

are available at http://csrc.nist.gov/publications/.

FIPS 140-2 Security Requirements for Cryptographic Modules, May 25, 

2001.

FIPS 140-2, Annex C Approved Random Number Generators, June 14, 2011; available 

at http://csrc.nist.gov/groups/STM/cmvp/standards.html.

FIPS 197 Advanced Encryption Standard, November 2001.

SP 800-20 Modes of Operation Validation System for the Triple Data 

Encryption Algorithm (TMOVS): Requirements and Procedures, 

SP 800-20, April 2000 Revision.

SP 800-38A Recommendation for Block Cipher Modes of Operation, Methods 

and Techniques, December 2001.

SP 800-38A 

Addendum

Recommendation for Block Cipher Modes of Operation: Three 

Variants of Ciphertext Stealing for CBC Mode, October 2010.

SP 800-38B Recommendation for Block Cipher Modes of Operation: The 

CMAC Mode for Authentication, May 2005.

SP 800-57, Part 1

 

Recommendation for Key Management, March 2007.

SP 800-90 Recommendation for Random Number Generation Using 

Deterministic Random Bit Generators, March 2007

SP 800-131A Transitions: Recommendation for Transitioning the Use of 

Cryptographic Algorithms and Key Lengths, January 2011.

SP 800-133 Recommendation for Cryptographic Key Generation, Draft.
SP 800-67, version 1.2 July 2011

25

APPENDIX E: CONFORMANCE TO NON-TESTABLE 

REQUIREMENTS

Conformance to many of the requirements in this Recommendation is testable by NIST’s 

CAVP or CMVP. However, some requirements are out-of-scope for such testing. This 

appendix lists those requirements whose conformance is the responsibility of entities using, 

implementing, installing or configuring applications or protocols that incorporate this 

Recommendation.

Section Requirement

1 TDEA functions incorporating the DEA cryptographic engine shall be 

designed in such a way that they may be used in a computer system, storage 

facility, or network to provide cryptographic protection to binary coded data.

2 Each 64-bit key shall contain 56 bits that are randomly generated and used 

directly by the algorithm as key bits.

3.1 A key bundle shall not consist of three identical keys.

3.3 Note that the TDEA block cipher shall be used to provide cryptographic 

security only when used in an approved mode of operation.

3.4 The TDEA keys shall be managed in accordance with NIST Special 

Publication (SP) 800-57, Part 1.

3.4 The following specifications for keys shall be met in implementing the TDEA 

modes of operation.

3.4.1 The bundle and the individual keys shall:

a. be kept secret;

b. be generated using an approved method10 that is based on the output 

of an approved random bit generator11;

c. be independent of other key bundles;

d. have integrity whereby each key in the bundle has not been altered in 

an unauthorized manner since the time it was generated, transmitted, or 

stored by an authorized source;

e. be used in the appropriate order as specified by the particular mode; 

f. be considered a fixed quantity in which an individual key cannot be 

manipulated while leaving the other two keys unchanged; and cannot 

be unbundled except for its designated purpose.

3.5 One key bundle shall not be used to process more than 232 64-bit data blocks 

when the keys conform to Keying Option 1...

3.5 When Keying Option 2 is used, the keys shall not be used to process more 

than 220 blocks (see SP 800-131A).

 

10 See SP 800-133.

11 See SP 800-90 and FIPS 140-2, Annex C.
SP 800-67, version 1.2 July 2011

26
SP 800-67, version 1.2 July 2011

27

APPENDIX F: CHANGES

Version 1.1 modified the list of weak keys in Section 3.4.2, correcting the third and 

fourth weak keys in the list. In addition, a note was inserted that the actual values of the 

parity bits were ignored when listing the weak and semi-weak keys.

In version 1.2, the following non-editorial modifications have been made:

1. The authority section was updated, primarily to include a paragraph about 

validation testing. 

2. References to American National Standard X9.52, Triple Data Encryption 

Algorithm Modes Of Operation, have been removed, since the standard was 

withdrawn. 

3. Various parts of SP 800-38 have been referenced: SP 800-90 and FIPS 140-2, 

Annex C, have been referenced for random bit generators; SP 800-131A has been 

referenced for the transition away from two-key TDEA; and SP 800-133 has been 

referenced for key generation.

4. The previous Section 1.1, Basis, was removed, since the information is provided 

in the Authority section.

5. The previous Section 1.2, Applicability, was removed.

6. In Table 3 of Section 2.3, the third entry in the first row was corrected to be “20.”

7. In Section 3.5, the “should not” in the statement “One key bundle should not be 

used to process more than 232 64-bit data blocks when the keys conform to 

Keying Option 1...” has been changed to “shall not.”

8. In Section 3.4.1, line 2, the “must” was changed to “shall.”

9. In Section 3.5, guidance for the use of Keying Options 1 and 2 was further 

clarified.

10. In Appendix D, additional references were provided for SP 800-131A and SP 

800-133.

11. Appendix E was added to identify non-testable requirements.