Why is triple DES is calculated in encrypt decrypt encrypt mode? Why a decrypt in the middle? And isn't decrypt = encrypt since DES in a symmetric cipher?


3 Answers 3


It is for backwards compatibility with normal DES. If you use the same key for the first two operations, they cancel out and you are left with a ciphertext encrypted under a single DES key.

Decrypt is not the same as encrypt. Symmetric refers to the fact that both use the same key but the actual steps are effectively reversed.

  • Just one note, the first two operations will only cancel out if it is the same key - but EDE also allows for the 3 keyparts to be different...
    – AviD
    Commented Jan 25, 2011 at 22:26
  • 1
    Backwards compatibility only applies where the same keypart (56 bits) is used for all 3 operations (which anyway has long been unrecommended).
    – AviD
    Commented Jan 26, 2011 at 7:15
  • 2
    I just want to emphasize that PulpSpy's answer is right: the only reason is for backwards compatibility. @AviD's 2nd comment is confused about what is meant by backwards compatibility. Backwards compatibility means that if you have a hardware implementation of 3-key 3DES (which accepts a message M and keys K1,K2,K3), you can use it to implement single-DES as follows: to single-DES-encrypt M under DES key K, set K1=K, K2=K, K3=K, and send M,K1,K2,K3 to your hardware 3DES encryptor. (As PulpSpy correctly points out, K1,K2 can be arbitrary so long as K1=K2 and K3=K.)
    – D.W.
    Commented Jan 27, 2011 at 6:15
  • @D.W. right, thats what I said in my comment (sorry, was that not clear...?) Using the same identical K for all keyparts will allow you to "recreate" DES, thus providing for backwards compatibility... But that doesn't explain either why to use EDE with 2 or 3 different keys. Especially since K1=K2=K3 is not recommended, supported, or secure.
    – AviD
    Commented Jan 27, 2011 at 8:03
  • 1
    @AviD, It doesn't explain those things, because that's not what the original poster asked.
    – D.W.
    Commented Jan 30, 2011 at 5:33

Being a "symmetric" means that both the encryption and decryption KEYS are the same (or easily computable from the other), not the algorithm. It does not mean that encryption = decryption. However in the case of DES which is a Feistel cipher which has 16 rounds - encryption is actually the same process as decryption - this actually helps to implement the cipher on hardware easily, except in DES there is a key schedule which means that a different sub-key is used at each round so running it one way becomes encryption (keys 1 ~ 16) and running it the other way decryption (keys 16 ~ 1).

There are two configurations of 3-DES EDE (encrypt decrypt encrypt) and EEE and 3 choices of key schemes, 1 key 2 key (2TDEA) and 3 key (3TDEA). Also note that the design of DES is also based around thinking about the use of custom hardware for efficiency reasons.

3-DES uses EDE such that you can enter the the same key three times which actually will be then the same as just using DES with that one key - this is the backwards compatability. This follows through to using three separate keys as you may implement the 3-DES algorithm in hardware (or be unable to change the cipher mode) wanting three key triple DES and also backwards compatibility. For example an implementation may be that the user sets the key in a settings store or database if wanting a 3key DES would use the key AAAAAAAAAAAAAABBBBBBBBBBBBBBCCCCCCCCCCCCCC but if wanting to send a message to a resource that only had DES implemented then it would use the key AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA the programmer may have hard coded in the 3-DES EDE. Also for 2 key 3-DES the user may enter AAAAAAAAAAAAAABBBBBBBBBBBBBBAAAAAAAAAAAAAA as the key. The function may simply be encrypt(messsage, key) rather than encrypt(message, key1, key2, key3, configuration). This is the reason why it is standard to use EDE for 3-DES, the key choice 1/2/3 is relatively separate from the actual encryption implementation. From a security standpoint using Encrypt Encrypt or Encrypt Decrypt is the same as we mentioned above that the difference is simply the re-ordering of the sub-keys used, as key 1 and key 2 are different anyway. It should also be noted that DES keys required 8 parity bits, so a key is actually 64 bits long and one bit of the parity is attributed to each byte, but the actual visiblity of this will vary with the implementation. The reason why 2key 3-DES does k1, k2, k1 is that. If using k1,k1,k2 in EDE mode you would effectively only be encrypting via k2 and also if you encrypt using k1,k1,k2 in EEE because of the Feistel cipher design you creating it to be susceptible to some analysis attacks - this goes for any encryption you should not encrypt twice using the same key and expect it to be secure.

Double DES is actually different to 2 key 3-DES, double DES is susceptible to meet in the middle attacks where you pre-compute the DES encryption of a chosen plaintext and store this using 2^56 x 64 bits of space, you then have to get the system to encrypt the chosen plain text for you and you decrypt it until it matches one of the stored values, you then have both candidate keys, using another 1/2 plaintext/cipher text pairs you can then test these keys to see if they are actually correct. This is a space time trade-off and said to effectivly reduce the keysize to 56 bits + database search time. However this is not true of 2 key 3-DES because we encrypt with key 1 and then key 2 and then again with key 1, to meet in the middle you would have to pre-compute both key 1 and key 2's encryption anyway, not decreasing the time required. In this case there is an attack on 2 key 3-DES that requires 2^56 CHOSEN plain-texts/cipher-text pairs and reduces the key to 56bits - however plain-texts/cipher-text pairs may be very difficult depending on the access to the system protocol. As an unauthorized user you may not get to encrypt messages or be relying on randomly generated values. Also another attack reduces the security to 2^(120-n) if you have n KNOWN pairs. So the practicality of these attacks is in question. I believe this is suggested in the reference below. I believe 3 key 3-DES is still susceptible to Meet in the Middle attacks regardless of using EDE or EEE, this effectivly reducing its security to 112 bits. The reason for this is you can calculate the encryption of a chosen plaintext on key 1 and store these using the same amount of space as the double des attack, the remaining 112 bits of the key you still have to exhaustive search, but this does reduce the time required to calculate the key on-line.

Because of these vulnerabilities it is better to use 3TDEA over 2TDEA, so I doubt there would be many new applications using 2TDEA (I believe NIST may be advising against using it). However the only reasons I can think of using 2 key is that the key size is smaller, so this is space efficiency. Originally before the recent attacks on 2-key, 2-key and 3-key were though to be of similar security ~112bits for both - so from the standpoint of an implementer "why waste time with the extra key if it's the same"? Or maybe you were migrating to or from a different algorithm that used 128bits (remember this is the actual size of a 2TDEA key including the parity bits) and did not want to or it was infeasible to change keys - or the key generation algorithm for the previous system was 128bits so you also don't need to change the generator - this is just an idea.

C. van Oorschot and Michael J. Wiener. 1991. A known-plaintext attack on two-key triple encryption. In Proceedings of the Workshop on the Theory and Application of Cryptographic Techniques (Advances in Cryptology - EUROCRYPT '90), Ivan Bjerre Damgård (Ed.). Springer-Verlag New York, Inc., New York, NY, USA, 318-325.

(Reason for writing this - I have an exam on this soon, hope this covers all and any corrections welcome).

  • 1
    Voted down not because the content is in error, but because the answer is simply too fluffy, never mind the exam. Commented Dec 20, 2015 at 13:08

Why in EDE decrypt is in the middle? -

Initialy you have a plaintext so you can only Encrypt it. So you have to start with Encryption. -so first E in EDE

After first Encryption you’ve got a ciphertext - you can only Decrypt it - So we get second D in the middle of EDE

Then with the same logic we having final E

Additional security of triple DES(by using longer key) is achieved by using different keys in all these enc/dec sequence. So the triple DES long key (168-bit) is actually a combination of all these standard DES 56-bit keys.

But for compatibility reasons it is left opportunity to use the same 56 bit key in EDE sequence - this makes triple DES to work as a simple DES

  • 9
    This doesnt really make much sense....
    – AviD
    Commented Jan 27, 2011 at 8:12
  • 1
    FYI: You can encrypt something that has already been encrypted (e.g. doubly encrypt it).
    – Jonathan
    Commented Feb 10, 2015 at 18:30
  • A keyed block cipher set to encryption is a permutation. A keyed block cipher set to decryption - and of course the same key - is just the inversed permutation. As you can always perform any permutation on a block of data, both encryption and decryption can be performed as long as a full block of data is available. Commented Dec 20, 2015 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .