I'm working with a smartcard (DESFire) that supports both TripleDES and DES. In the specs it is stated that both modes of operation use 16 bytes keys. When the first 8 bytes in the key are identical to the trailing 8 bytes, the DES mode is used. Otherwise, the TDEA algorithm is selected.

This is a shock to me since it was my understanding that Triple DES uses a key bundle of 56bits*3 = 168 bits (21 bytes). What kind of Triple DES encryption could it be supporting? Is there some other way to select a key for TDEA so that it behaves as single DES, apart from selecting a key bundle k1k2k3 where k1=k2=k3?

EDIT: Seems that there's a "Keying option 2", where k1 = k3 != k2.

This is the only TDEA option that DESFire supports, I guess. The newer DESFire ev1 supports full keying option 3 TDEA along with AES.

  • As it happens, this is already covered by the answers to Why triple DES used in EDE mode?, though you wouldn't guess it from the question title, and there's no way you could be expected to know that. – D.W. Nov 15 '11 at 19:17

DES is defined to use a 64-bit key. Only 56 of these bits are really used, so the "effective key length" (for resistance against exhaustive search) is that of a 56-bit key. Yet, any implementation will expect a sequence of 64 bits (hence, 8 bytes, not 7).

Triple-DES (aka "3DES") is three DES instances in due sequence. The "middle" DES instance is used in decryption mode, precisely so that an engine which implements 3DES can also execute plain DES. If you name the three successive keys K1, K2 and K3, then, when K1 = K2, the two first DES instances cancel each other (the second DES being in decryption mode, it reverses what the first DES did), so this is equivalent to simple DES with key K3. Similarly, if K2 = K3, this is equivalent to simple DES with key K1.

3DES nominally uses a 192-bit key (three 64-bit DES keys), out of which 168 bits are really used. Yet, there is an "academic" attack against 3DES with cost 2112, so it is often said that the overall security of 3DES is similar to that offered by a theoretically perfect block cipher with a 112-bit key. Hence, there is a widespread usage mode of 3DES in which we use a 128-bit key: 64 bits for K1 and 64 bits for K2, and then set K3 = K1. In plain words, encrypt the block with K1, then decrypt with K2, then encrypt again with K1. This seems sufficient to achieve the 112-bit level of security (of the 128 key bits, only 112 are really used), and the academic attack shows that you cannot go beyond that level anyway (112 bits are already quite far beyond what is technologically breakable right now, so no worry)(Edit: D.W. points out that there is a better attack, provided that you can harvest quite a few plaintext/ciphertext pairs; still, the attack cost is still too high to be used in practice). This is what your smartcard implements.

Note that there are protocols which use 3DES and really require the full 192-bit key, and cannot work with an implementation which only supports 128-bit keys; a prime example is SSL.

| improve this answer | |
  • 3
    A quibble: 2-key 3DES does not attain 112-bit security (it does not achieve the level of security we'd expect from a perfect block cipher with a 112-bit key). See, e.g., van Oorschot and Wiener; for instance, with 2^32 known plaintexts, you can break 2-key 3DES in about 2^88 time. However, in practice, this doesn't matter; this is unlikely to be the weakest link in the security of the system. – D.W. Nov 15 '11 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.