The key space of DES includes some keys that are weak, which results in a ciphertext that is extra vulnerable to cryptanalysis.

Is TDEA (also known as TripleDES) invulnerable to those weak keys? Or, is it necessary to filter cryptographically-randomly generated TripleDES keys for the list of weak/semiweak keys?

  • Note that you really shouldn't be using 3DES for most uses, nowadays...
    – AviD
    Sep 26, 2011 at 0:17
  • @AviD I completely agree. Oct 3, 2011 at 15:57

3 Answers 3


A weak key for a block cipher is a key such that encryption and decryption turn out to be the same function. This means that with such a key, a black box which nominally encrypts things only can also be used to decrypt things. A semi-weak key is a key such that the decryption function with that key is identical to the encryption function with another key.

DES is a permutation with 64-bit blocks; there are 264! such permutations (it is a huge number, close to 10347382171305201285699) and the key selects one such permutation. There are "only" 256 possible keys, so the 256 encryption functions and the 256 decryption functions "should" be all distinct from each other, with an overwhelming probability, if we assume that the key selects permutations "at random" (that's the "ideal cipher" model). The existence of weak and semi-weak keys is thus some extra structure, which is worth mentioning, although calling them "weaknesses" is an overstatement. Weak keys and semi-weak keys are part of a more general class of "weaknesses" called related keys. Related keys can be a concern in some specific scenarios where an attacker can force usage of related keys through some weakness in the key generation process; unless something is done thoroughly wrong (like it was done with WEP) or the block cipher is used in an unusual way (e.g. as a building block for a hash function in a Merkle-Damgård construction), related keys attacks are no real threat to security.

Testing a given key for being "weak" is not useful with DES, because risk of a properly generated key being "weak" is extremely low. Simply "trying" a few thousand potential keys ("bruteforcing") will yield a much higher success rate for much less effort.

3DES being three DES instances in a row, it also has "weak keys": given weak keys K1, K2 and K3 for DES, the key K1 || K2 || K3 is a "weak key" for 3DES. As is the case for DES, this is a noteworthy mathematical curiosity, but it has no practical security implications.


A weak or semiweak DES key used as one of the three keys in TripleDES does not cause a weakness in TripleDES according to RFC 2451. However, there is a separate weakness in TripleDES keys that should be checked.

(TripleDES is also known as DES-EDE3. EDE stands for Encrypt-Decrypt-Encrypt.)

DES has 64 known weak keys, including so-called semi-weak keys and possibly-weak keys [Schneier95, pp 280-282]. The likelihood of picking one at random is negligible.

For DES-EDE3, there is no known need to reject weak or complementation keys. Any weakness is obviated by the use of multiple keys.

However, if the first two or last two independent 64-bit keys are equal (k1 == k2 or k2 == k3), then the 3DES operation is simply the same as DES. Implementers MUST reject keys that exhibit this property.

  • There is no need to explicitly check for this. For a randomly chosen key, this condition occurs with probability 1/2^55, which is negligible. The chances of happening to choose such a key are less than the odds of being struck by lightning -- twice.
    – D.W.
    Sep 26, 2011 at 1:22

3DES inherits those weak keys, so this "weak key vulnerability" applies to 3DES also.

  • 1
    Thanks for your answer. So, the multiple pass method of 3DES doesn't provide any defense against the weak keys. Can you cite a reference? Aug 23, 2011 at 14:36
  • 1
    csrc.nist.gov/publications/nistpubs/800-67/SP800-67.pdf Note in that PDF document, they don't call it 3DES, but they call it TDEA. Both means the same thing.
    – timoh
    Aug 23, 2011 at 14:45
  • 1
    "There are a few keys that are considered weak for the DEA cryptographic engine. The use of weak keys can reduce the effective security afforded by TDEA and should be avoided." - p. 24 of the PDF Aug 23, 2011 at 14:48
  • 1
    timoh, please consider incorporating the link and quote into your answer, otherwise it's just an unsubstantiated claim.
    – user185
    Aug 23, 2011 at 21:48
  • Right, will do.
    – timoh
    Aug 24, 2011 at 13:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .