Select a TripleDES key so that it effectively behaves as regular DES

Question

I'm working with a smartcard (DESFire) that supports both TripleDES and DES. In the specs it is stated that both modes of operation use 16 bytes keys. When the first 8 bytes in the key are identical to the trailing 8 bytes, the DES mode is used. Otherwise, the TDEA algorithm is selected.

This is a shock to me since it was my understanding that Triple DES uses a key bundle of 56bits*3 = 168 bits (21 bytes). What kind of Triple DES encryption could it be supporting? Is there some other way to select a key for TDEA so that it behaves as single DES, apart from selecting a key bundle k1k2k3 where k1=k2=k3?

EDIT: Seems that there's a "Keying option 2", where k1 = k3 != k2.

This is the only TDEA option that DESFire supports, I guess. The newer DESFire ev1 supports full keying option 3 TDEA along with AES.

Answer 1

DES is defined to use a 64-bit key. Only 56 of these bits are really used, so the "effective key length" (for resistance against exhaustive search) is that of a 56-bit key. Yet, any implementation will expect a sequence of 64 bits (hence, 8 bytes, not 7).

Triple-DES (aka "3DES") is three DES instances in due sequence. The "middle" DES instance is used in decryption mode, precisely so that an engine which implements 3DES can also execute plain DES. If you name the three successive keys K₁, K₂ and K₃, then, when K₁ = K₂, the two first DES instances cancel each other (the second DES being in decryption mode, it reverses what the first DES did), so this is equivalent to simple DES with key K₃. Similarly, if K₂ = K₃, this is equivalent to simple DES with key K₁.

3DES nominally uses a 192-bit key (three 64-bit DES keys), out of which 168 bits are really used. Yet, there is an "academic" attack against 3DES with cost 2¹¹², so it is often said that the overall security of 3DES is similar to that offered by a theoretically perfect block cipher with a 112-bit key. Hence, there is a widespread usage mode of 3DES in which we use a 128-bit key: 64 bits for K₁ and 64 bits for K₂, and then set K₃ = K₁. In plain words, encrypt the block with K₁, then decrypt with K₂, then encrypt again with K₁. This seems sufficient to achieve the 112-bit level of security (of the 128 key bits, only 112 are really used), and the academic attack shows that you cannot go beyond that level anyway (112 bits are already quite far beyond what is technologically breakable right now, so no worry)(Edit: D.W. points out that there is a better attack, provided that you can harvest quite a few plaintext/ciphertext pairs; still, the attack cost is still too high to be used in practice). This is what your smartcard implements.

Note that there are protocols which use 3DES and really require the full 192-bit key, and cannot work with an implementation which only supports 128-bit keys; a prime example is SSL.