Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The key space of DES includes some keys that are weak, which results in a ciphertext that is extra vulnerable to cryptanalysis.

Is TDEA (also known as TripleDES) invulnerable to those weak keys? Or, is it necessary to filter cryptographically-randomly generated TripleDES keys for the list of weak/semiweak keys?

share|improve this question
Note that you really shouldn't be using 3DES for most uses, nowadays... – AviD Sep 26 '11 at 0:17
@AviD I completely agree. – Matthew Rodatus Oct 3 '11 at 15:57

A weak key for a block cipher is a key such that encryption and decryption turn out to be the same function. This means that with such a key, a black box which nominally encrypts things only can also be used to decrypt things. A semi-weak key is a key such that the decryption function with that key is identical to the encryption function with another key.

DES is a permutation with 64-bit blocks; there are 264! such permutations (it is a huge number, close to 10347382171305201285699) and the key selects one such permutation. There are "only" 256 possible keys, so the 256 encryption functions and the 256 decryption functions "should" be all distinct from each other, with an overwhelming probability, if we assume that the key selects permutations "at random" (that's the "ideal cipher" model). The existence of weak and semi-weak keys is thus some extra structure, which is worth mentioning, although calling them "weaknesses" is an overstatement. Weak keys and semi-weak keys are part of a more general class of "weaknesses" called related keys. Related keys can be a concern in some specific scenarios where an attacker can force usage of related keys through some weakness in the key generation process; unless something is done thoroughly wrong (like it was done with WEP) or the block cipher is used in an unusual way (e.g. as a building block for a hash function in a Merkle-Damgård construction), related keys attacks are no real threat to security.

Testing a given key for being "weak" is not useful with DES, because risk of a properly generated key being "weak" is extremely low. Simply "trying" a few thousand potential keys ("bruteforcing") will yield a much higher success rate for much less effort.

3DES being three DES instances in a row, it also has "weak keys": given weak keys K1, K2 and K3 for DES, the key K1 || K2 || K3 is a "weak key" for 3DES. As is the case for DES, this is a noteworthy mathematical curiosity, but it has no practical security implications.

share|improve this answer
This is a great answer. +1 Thank you. – Matthew Rodatus Aug 23 '11 at 15:33
@Matthew you know you can accept an alternative answer if you want. – Rory Alsop Aug 23 '11 at 16:43
up vote 2 down vote accepted

A weak or semiweak DES key used as one of the three keys in TripleDES does not cause a weakness in TripleDES according to RFC 2451. However, there is a separate weakness in TripleDES keys that should be checked.

(TripleDES is also known as DES-EDE3. EDE stands for Encrypt-Decrypt-Encrypt.)

DES has 64 known weak keys, including so-called semi-weak keys and possibly-weak keys [Schneier95, pp 280-282]. The likelihood of picking one at random is negligible.

For DES-EDE3, there is no known need to reject weak or complementation keys. Any weakness is obviated by the use of multiple keys.

However, if the first two or last two independent 64-bit keys are equal (k1 == k2 or k2 == k3), then the 3DES operation is simply the same as DES. Implementers MUST reject keys that exhibit this property.

share|improve this answer
There is no need to explicitly check for this. For a randomly chosen key, this condition occurs with probability 1/2^55, which is negligible. The chances of happening to choose such a key are less than the odds of being struck by lightning -- twice. – D.W. Sep 26 '11 at 1:22

3DES inherits those weak keys, so this "weak key vulnerability" applies to 3DES also.

share|improve this answer
Thanks for your answer. So, the multiple pass method of 3DES doesn't provide any defense against the weak keys. Can you cite a reference? – Matthew Rodatus Aug 23 '11 at 14:36
1 Note in that PDF document, they don't call it 3DES, but they call it TDEA. Both means the same thing. – timoh Aug 23 '11 at 14:45
"There are a few keys that are considered weak for the DEA cryptographic engine. The use of weak keys can reduce the effective security afforded by TDEA and should be avoided." - p. 24 of the PDF – Matthew Rodatus Aug 23 '11 at 14:48
timoh, please consider incorporating the link and quote into your answer, otherwise it's just an unsubstantiated claim. – user185 Aug 23 '11 at 21:48
Right, will do. – timoh Aug 24 '11 at 13:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.