Talk:Triple DES

message: Hum..; Effective keysize is 112 bits not 168. There's an attack... JidGom 09:03, 16 Dec 2003 (UTC)
replies: text: Yep, it would be good to have some patent information in the DES article (US patent 3,962,539); I think we have enough context on Tuchman here, though. — Matt 14:47, 28 Apr 2004 (UTC)
replies: text: Matt, Agreed, then. You want to put it in there? ww 14:52, 28 Apr 2004 (UTC)
thread_title: Untitled

message: Rasmus, I'm not sure why your edit re-added the sentence "The use of three steps is essential to prevent meet-in-the-middle attacks; double DES would have serious vulnerabilities." This contradicts your statement in the changelog that 2 key 3DES is not vulnerable to meet-in-the-middle attacks. This statement should either be removed if your statement about meet-in-the-middle attacks is true, or moved up to the prior paragraph if it is not. I am not going to make the edit because truthfully I don't know much about these attacks. — RamanGupta -- 30 June 2005 20:12 (UTC)
: I googled the meet-in-the-middle attack, and several sites do seem state that two-key triple DES is vulnerable to that type of attack -- in fact, it seems that even the security of triple DES is reduced from the same attack, but not to the same extent as two-key:
: http://www.rsasecurity.com/rsalabs/node.asp?id=2231
: http://searchsecurity.techtarget.com/tip/1,289483,sid14_gci968714,00.html?track=NL-102&ad=486202
: http://www.everything2.com/index.pl?node_id=927656
: RamanGupta 1 July 2005 06:07 (UTC)
:: Note the difference between double DES and 2 key triple DES. Double DES is the operation DES2(P):=DESk2(DESk1(P)), ie. two DES encryptions with two different keys. 2-key 3DES is the operation 2KEY-DES3(P):=DESk1(DES-1k2(DESk1(P))), ie. 3DES where k1=k3.
:: As meet-in-the-middle attack explains, double DES is only one bit more secure than single DES. This should explain the first sentence. 2KEY-3DES, however, is not vulnerable to meet-in-the-middle attacks. There are other attacks on it, but these require large amounts of known pairs of plaintext and ciphertext, so they aren't really practical.
:: I read your three links, and I can't see where they contradict this. The rsasecurity mentions the chosen-plaintext attack and the known-plaintext attack. Both 3KEY-3DES and 2KEY-3DES has 112-bits security, even though 3KEY-3DES has a 168 bit key. This is due to the meet-in-the-middle attack (I have clarified this in the article). But except for that, neither should be vulnerable to meet-in-the-middle attacks.
:: Rasmus (talk) 1 July 2005 07:36 (UTC)
::: Right, now I understand, sorry for the confusion. I was stupidly thinking that when people said "double DES" they were just using imprecise wording for 2-key Triple DES. That being said, in order ot make this clearer and flow better in the article I moved the discussion of the number of steps (both single and double) a paragraph up. I think it now flows better as it comes right after the discussion of the number and type of operations required for 3DES, and it smoothly flows from a discussion of 3DES, to 2DES, to single-DES compatibility.
::: One other thing, most articles on the subject seem to either disagree on the strength (in bits) of DESede, or they state that it is not known with certainty. Therefore, why is the article so certain that 3DES provides 112 bits of security? Should this be softened to reflect the uncertainty in the literature, or at least a source attributed to defend the factual nature of the statement?
::: RamanGupta 1 July 2005 20:59 (UTC)
:::: Yes, that flows better. As for the security of 3DES, I can't really see why we should be uncertain of it. Of course we could discover an attack, but that is also true for DES, AES and lots of other algorithms that are not provable secure. In your second link ("expert advice") he claims that the security of 3KEY-3DES could be anywhere between 113 and 167 bits. But it is easy to see, that 3KEY-3DES is vulnerable to a meet-in-the-middle attack: By using 256+2112 operations and 256 storage, we can break 3KEY-3DES, so the security is at most 112+ε bits.
::::Rasmus (talk) 1 July 2005 23:18 (UTC)
::::: OK, sounds good. RamanGupta 2 July 2005 23:35 (UTC)
Matt does not discusssing modes, but without it, it is very incomplete, and borderline pedantic.  Without operating modes, the cipher has no purpose. --CISSP Researcher 2005-10-29T19:59:11
Interesting paper on this subject:
http://www.jtc1sc27.din.de/sixcms_upload/media/3031/SC27N6706_SD12_20080421.pdf
206.47.249.252 (talk) 16:48, 28 October 2008 (UTC)
thread_title:  Attacks on 2DES, 2KEY-3DES & 3KEY-3DES 

message: On the other hand, since there are variations of TDES which use two different keys (2TDES) and three different keys (3TDES) the non-standard abbreviation 3DES is confusing and should be avoided.
Huh? I've worked extensively with various firewalls from numerous manufacturers, and I've never seen Triple DES abbreviated any other way. Anybody else have a different experience?--Roland 19:15, 29 June 2006 (UTC)
replies: text: I've seen 3DES, DES3, and occasionally TDES.  I've never seen 2TDES or 3TDES.  Phr (talk) 05:16, 11 July 2006 (UTC)
replies: text: In 5 years of working in IT, I've only seen it abbreviated '3DES', and I once heard it verbalized as Triple DES.  I thought it was strange that the article said it is confusing, non-standard, and to be avoided, since it's literally the only abbreviation I've ever seen, and makes perfect sense to me.  67.53.145.42 22:44, 12 November 2007 (UTC)
replies: text: The fact that a lot of people do a mistake does not mean we should not describe it as a common mistake. The official way to abbreviate `triple' is `T': the definitive source about the algorithm is `NIST Special Publication 800-67' and its full name is `Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher'. The two-key variant is officially (see, e.g., SP 800-78-1) abbreviated as `2TDEA'. GBL (talk) 12:04, 20 November 2007 (UTC)
replies: text: Official or not, it's going to cause more confusion referring to it by the "official" standard. You might call it de-evolution or bastardization of the language used to describe DES, but it happens every day. Heck, Washington Mutual just officially changed their name to WaMu not because it's more descriptive or accurate, but because that's what the majority of people call it anyway. In the end it's just a word and I doubt that 99.9% of people care about what the official document says.  —Preceding unsigned comment added by 67.115.118.5 (talk) 23:18, 10 April 2008 (UTC)

text: Surely the "official" way to describe the "two key variant" is the way that it is defined in the standard itself - ie "Keying Option 2".  This is the term used in all of: ANS X9.52-1998 Triple Data Encryption Algorithm Modes of Operation, FIPS PUB 46-3, ISO/IEC 18033-3:2005 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers, as well as NIST SP 800-67. None of these use the term "2TDEA". I suggest that anyone interested in the topic should actually read the (freely available) standard FIPS PUB 46-3 and the Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher. Mitch Ames (talk) 06:47, 27 June 2008 (UTC)
replies: text:  See also my #Proposed rewrite to match the standards.  Mitch Ames (talk) 12:26, 17 March 2009 (UTC)

text: I suspect that a table might be more readable than the current indented bullet list, especially if more terms are added, but I’ll leave that for another day or another editor. Mitch Ames (talk) 14:59, 28 May 2009 (UTC)
thread_title:  Non-Standard Abbreviation? 

message: Has 2-key TDES with the third key derived as a mixing function of the other two (other than the trivial k3 = k1) been studied? --Damian Yerrick (talk | stalk) 03:14, 4 October 2007 (UTC)
thread_title:  2-key TDES with k2 derived by mixing k1 and k3? 

message: Following up on the above, I found this reference (http://cs.jhu.edu/~sdoshi/crypto/papers/p465-merkle.pdf): "At the 1978 National Computer Conference, Tuchman [12] proposed a triple encryption method which
uses only two keys, K1 and K2." This is in a section heading titled "Triple Encryption" that follows additional discussion of Double Encryption and the introduction to this section begins with "Diffie and Hellman [2] have argued that the 56-bit key used in the Federal Data Encryption Standard (DES) [9] is too small and that current technology allows an exhaustive search of the 256 keys." This may serve as a better reference to clarify the origin. Currently the summary box saying 1995 as the "first published" date is misleading I think.
:The above note was made in this diff.  Indeed, I have added a reference to Merkle/Hillman 1981 and note the 1978/1981 origins of 3DES. Samboy (talk) 14:56, 31 December 2021 (UTC)
thread_title:  More on origin 

message: I propose to rewrite a significant proportion of this article to bring it in line with the following standards, which define the Triple Data Encryption Algorithm commonly known as Triple DES:
* FIPS PUB 46-3 Data Encryption Standard (DES)
* ANS X9.52-1998 Triple Data Encryption Algorithm Modes of Operation
* ISO/IEC 18033-3:2005 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers
and this related standard:
* NIST Special Publication 800-67 Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher
In particular the changes will include:
* Removal of references to "EEE", because the standards don't mention it.
* Replacement of "2-key" and "3-key" with Keying Options 1, 2, 3 (as defined in the standards).
My work in progress can be found in my sandbox. I would appreciate any feedback as I go, but (aside from pointing out or correcting minor errors) please refer to the freely available FIPS PUB 46-3 first.  Mitch Ames (talk) 12:26, 17 March 2009 (UTC)
replies: text: Rewrite completed. Mitch Ames (talk) 08:46, 21 March 2009 (UTC)
thread_title:  Proposed rewrite to match the standards 

message: I've deleted IBM's terminology for DES keys (triple-length, double-length, single-length) keys (again), because the cited reference does not mention Triple DES at all, only DES. This article is about the Triple DES algorithm (as defined in the referenced standards), not IBM's use of DES. Mitch Ames (talk) 12:29, 13 June 2010 (UTC)
replies: text: Perhaps you should read the other reference I gave which describes "double length key" and its use in Triple DES, but which was also deleted.  The second reference  you object to shows the term in common use.  Here's another reference to the term, including the words "Triple DES".  The term "double-length key" is confusingly used in plenty of documents (including the keys.htm link above) - which is why I came to make it clear in Wikipedia in the first place.  The terms triple-length, double-length and single length key is used by manufacturers of HSMs including IBM, Thales, Safenet and Sun to describe the keying options used in Triple DES. Wasn't your curiosity piqued when you saw the inventor of DES (IBM) use a term to describe keys which isn't referenced in the wikipedia DES page? Dkam (talk) 11:09, 10 July 2010 (UTC)
replies: text:  I think I missed your IBM Triple DES reference because you added it with a comment "Undid revision ... by Mitch Ames", but my edit that you appeared to be undoing was removing your edit that did not include the IBM Triple DES reference - only the Types of Keys reference, which does not mention Triple DES at all.  In short: I didn't notice the reference because you used a misleading comment when you added it. However, since we do now definitely have a couple of references that mention double/triple length keys and Triple DES (not just DES), I've restored (with some rewording) the "Other terms used to refer to the keying options" subsection, with references. Mitch Ames (talk) 10:55, 12 July 2010 (UTC)
replies: text:  I agree that my comment when reverting your revert wasn't sufficiently clear - I'll keep that in mind. As to missing the reference - it was another user who deleted it. An unfortunate sequence of events. Dkam (talk) 09:37, 26 July 2010 (UTC)
thread_title:  IBM's use of DES keys 

message: Should there be an explicit mention of calling the TDEA algorithm DES EDE? It is even in the comments here, but it isn't mentioned in the article. Note that I would have added something in the line "None of the standards that define the algorithm use the term "3DES" or appending that sentence to include "DES EDE", but I'm not sure the term isn't used in *any* of the standards. In the same line, sometimes the keys are called DES ABC keys for scheme 1 and DES ABA keys for scheme two (although that does not seem to comply with the order of the keys used by NIST, which starts encryption with Key 3).
: "EDE" is not (to my knowledge) a common abbreviation for Triple DES, so it doesn't get a mention in the article. ("3DES" is quite common, so redirects to Triple DES, which is why it is mentioned in the article.) Likewise "ABC keys" and "ABA keys" are not mentioned or common in "other standards and related recommendations, and general usage". It's not feasible or appropriate to mention every variation in the terminology that has ever been used by anybody - that will simply cause more confusion for the readers.
: "" - All four of the standards listed in Triple_DES#Definitive_standards - of which both NIST publications are freely available for you to check, just click on the link - state that TDEA encryption encrypts with K1 first. Feel free to quote the exact clause of any standard that you think says otherwise, and I'll try to clarify it. Mitch Ames (talk) 13:41, 26 June 2012 (UTC)
thread_title:  DES EDE 

message: With https://sweet32.info/ affecting 3DES, I think this should be mentioned somewhere in the security section, shouldn't it?
129.104.247.2 (talk) 08:35, 4 November 2016 (UTC)
replies: text: Not necessarily. Sweet32 applies to all 64-bit block ciphers not just (triple-)DES, and applies only in conjunction with block cipher mode of operation rather than the block cipher alone. Mitch Ames (talk) 03:47, 5 November 2016 (UTC)
thread_title:  Sweet32