Fact-checked by Grok 2 weeks ago

Triple DES

Triple Data Encryption Algorithm (TDEA), commonly referred to as Triple DES or 3DES, is a symmetric-key block cipher that enhances the security of the original Data Encryption Standard (DES) by applying the DES encryption algorithm three times sequentially to each 64-bit block of plaintext using a bundle of up to three 56-bit keys.^[1] This triple application—typically encrypt with the first key, decrypt with the second, and encrypt with the third—provides a structure known as Encrypt-Decrypt-Encrypt (EDE) to ensure compatibility with single DES while increasing resistance to brute-force attacks.^[1] The concept of multiple encryption using DES was first proposed in 1978 by Walter Tuchman at IBM, suggesting a two-key triple scheme, followed by a more secure three-key variant proposed by Ralph Merkle and Martin Hellman in 1981 to address potential weaknesses in double encryption.^[2] Triple DES was formalized as a U.S. federal standard in 1999 under FIPS PUB 46-3, which specified it alongside single DES for protecting sensitive but unclassified data, while designating single DES for legacy use only.^[3] It operates in various modes such as Electronic Codebook (ECB), Cipher Block Chaining (CBC), and Cipher Feedback (CFB), with restrictions on data volume per key bundle to mitigate security risks, limited to no more than 2²⁰ blocks (approximately 8 MB) for 3-Key TDEA.^[1] Triple DES offers effective security strengths of 80 bits for 2-Key TDEA (using two distinct 56-bit keys where the first and third are the same) and 112 bits for 3-Key TDEA (three independent keys), far surpassing the 56-bit key of single DES, which became vulnerable to exhaustive search by the late 1990s.^[1] However, its 64-bit block size exposes it to collision-based attacks like birthday attacks when encrypting large datasets, and the meet-in-the-middle attack reduces the effective key search space to roughly 2¹¹² operations for 3-Key TDEA, making it computationally intensive but feasible with modern hardware.^[1] Despite these limitations, Triple DES saw widespread adoption in sectors like banking (e.g., EMV payment cards), VPNs, and IPsec protocols due to its backward compatibility with DES hardware and software.^[4] In response to advancing threats and the development of stronger alternatives like the Advanced Encryption Standard (AES), NIST deprecated Triple DES for new applications in 2018 and fully withdrew its approval on January 1, 2024, via the retirement of Special Publication 800-67 Revision 2, though it permits continued use for decryption of legacy data.^[5] This deprecation aligns with broader efforts to phase out short-key and small-block ciphers, urging migration to AES-128 or higher for equivalent or superior security with better performance.^[5]

Introduction

Definition and Purpose

The Triple Data Encryption Algorithm (TDEA), commonly known as Triple DES or 3DES, is a symmetric-key block cipher that processes each 64-bit block of plaintext by applying the Data Encryption Algorithm (DES) three times in an Encrypt-Decrypt-Encrypt (EDE) configuration in sequence using either two or three independent keys.^[1] This design maintains the fixed 64-bit block size of the original DES while enhancing security through iterated encryption.^[3] TDEA was developed primarily to address the vulnerability of DES's 56-bit effective key length to brute-force attacks, which had become feasible with advancing computational power by the late 1990s. By employing up to three DES keys—each 64 bits long (56 effective bits plus 8 parity bits), for a total key bundle of up to 192 bits—TDEA provides an effective security strength of 112 bits in its strongest 3-Key configuration, providing significantly greater resistance to exhaustive key searches without necessitating a complete overhaul of existing cryptographic systems.^[3] This approach allows for backward compatibility with legacy DES hardware and software, particularly through keying options where keys are shared, enabling gradual migration while preserving interoperability in environments reliant on DES infrastructure.^[3] The purpose of TDEA is thus to serve as a transitional strengthening mechanism for protecting sensitive unclassified data in federal and commercial applications, balancing improved security against the practical constraints of DES's widespread adoption.^[1]

Relation to DES

The Data Encryption Standard (DES) is a symmetric-key block cipher that operates on 64-bit blocks using a 64-bit key, of which 56 bits are effective for encryption while the remaining 8 serve as parity bits for error detection.^[3] It employs a Feistel network structure, featuring an initial permutation followed by 16 rounds of a key-dependent computation involving expansion, substitution via eight S-boxes, permutation, and XOR operations, and concluding with a final permutation inverse to the initial one.^[3] Triple DES, formally known as the Triple Data Encryption Algorithm (TDEA), directly inherits and reuses the core components of DES without alteration, applying the DES algorithm in an Encrypt-Decrypt-Encrypt (EDE) manner—including its initial and final permutations, key schedule for generating subkeys, S-box substitution tables, and round function—three times in sequence to process each 64-bit block.^[1] This design preserves the structural integrity of DES while extending its effective security through multiple iterations.^[1] The development of Triple DES was primarily motivated by the limitations of DES's 56-bit key length, which rendered it vulnerable to brute-force attacks feasible with 1990s-era hardware; for instance, the Electronic Frontier Foundation's DES Cracker machine demonstrated the ability to exhaustively search the entire key space and recover a key in just 56 hours of operation.^[6]^[3] However, the DES algorithm itself was regarded as secure in terms of its internal design, with no identified structural flaws beyond the inadequate key size that compromised resistance to exhaustive search.^[3] A key benefit of this inheritance is backward compatibility, as Triple DES can emulate single DES by setting all three keys to the same value, allowing systems to treat legacy DES operations as a special case of the Triple DES mode without requiring separate implementations.^[3]

History

Early Proposals

In the late 1970s, concerns over the adequacy of the Data Encryption Standard (DES)'s 56-bit key length prompted early explorations into multiple encryption schemes to extend its effective security without requiring entirely new algorithms or hardware. With computing power advancing rapidly, exhaustive key searches against single DES were deemed increasingly feasible, motivating proposals for layered encryptions that could achieve higher security levels while maintaining compatibility with existing DES implementations.^[7] A pivotal early proposal came in 1978 from Walter Tuchman, who advocated for a two-key variant of triple encryption using the DES algorithm in an encrypt-decrypt-encrypt (E-D-E) structure, where the first and third keys are identical, effectively doubling the key strength to 112 bits. This approach, conceived around April 1977 by Stephen Matyas and Carl Meyer at IBM, aimed to provide robust protection against brute-force attacks while leveraging DES's established infrastructure. Tuchman's idea was presented at the National Computer Conference in Anaheim, California, highlighting its practicality for immediate deployment.^[7]^[8] In 1981, Ralph Merkle and Martin Hellman built on this foundation, critiquing the two-key triple DES for vulnerability to meet-in-the-middle attacks that could reduce its security to roughly that of double encryption, requiring only about 2^{56} encryptions and storage. They proposed a three-key E-D-E triple encryption scheme to mitigate this weakness, ensuring an effective key length of 168 bits and restoring confidence in multiple DES as a secure extension. Their analysis emphasized the need for independent keys to prevent such reductions in security margins.^[8]^[7] By the mid-1980s, these concepts saw informal adoption in banking and government systems, particularly through standards like ANSI X9.17 (1985), which incorporated two-key triple DES for pseudorandom number generation in financial message authentication, enabling secure transactions without awaiting full federal standardization. This early integration in sectors reliant on DES, such as automated teller machines and electronic funds transfer, demonstrated the proposals' viability despite the absence of a formal U.S. government endorsement at the time.^[7]

Standardization Efforts

The formal standardization of Triple DES, also known as the Triple Data Encryption Algorithm (TDEA), began in the late 1990s as a response to the need for enhanced security beyond single DES. The American National Standards Institute (ANSI) published ANSI X9.52-1998, "Triple Data Encryption Algorithm Modes of Operation," which provided the first comprehensive specification of TDEA, including keying options 1 through 3 for financial applications.^[9] This standard defined TDEA as applying the DES algorithm three times in encrypt-decrypt-encrypt (EDE) mode to a 64-bit block, supporting modes such as electronic codebook (ECB), cipher block chaining (CBC), and cipher feedback (CFB).^[10] The National Institute of Standards and Technology (NIST) played a central role in federal standardization efforts. In 1999, NIST incorporated TDEA into FIPS 46-3, "Data Encryption Standard (DES)," reaffirming DES while designating TDEA as the preferred method for new applications, with single DES limited to legacy systems.^[3] FIPS 46-3 was withdrawn on May 19, 2005, as part of the transition to stronger algorithms.^[11] NIST further detailed TDEA in Special Publication (SP) 800-67, with the initial version released in May 2004 recommending its use in government systems, Revision 1 in January 2012, and Revision 2 in November 2017 updating implementation guidelines, including block limits to mitigate attacks.^[4] SP 800-67 Revision 2 was withdrawn on January 1, 2024, reflecting the broader deprecation of TDEA.^[5] International and protocol-specific standards also adopted TDEA. The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) addressed modes of operation relevant to TDEA in ISO 8372:1987, "Information technology — Modes of operation of an n-bit block cipher algorithm," which was updated in subsequent editions to support 64-bit ciphers like DES and TDEA. For network security, the Internet Engineering Task Force (IETF) specified TDEA in RFC 1851 (September 1995), "The ESP Triple DES Transform," defining its use in the IPsec Encapsulating Security Payload (ESP) protocol with CBC mode.^[12] Additionally, ANSI X9.24, "Retail Financial Services — Symmetric Key Management," first published in 2004 and revised in 2009 and 2017, outlined secure key generation, distribution, and management practices for TDEA in payment systems. Over time, standardization evolved to address security limitations. Initially, ANSI X9.52-1998 and FIPS 46-3 permitted all three keying options, but NIST restricted approval to options 1 (three distinct keys) and 2 (two distinct keys, with Key1 = Key3) effective May 19, 2007, disallowing option 3 (all keys identical) due to its equivalence to single DES.^[13] This change was integrated into SP 800-67 Revision 1 and later updates, emphasizing stronger configurations for remaining approved uses.^[4]

Technical Specifications

Algorithm Description

Triple DES, officially known as the Triple Data Encryption Algorithm (TDEA), is a symmetric-key block cipher that enhances the security of the original Data Encryption Standard (DES) by applying the DES algorithm three times in sequence to each data block. It employs an Encrypt-Decrypt-Encrypt (EDE) configuration, which allows compatibility with single DES systems while providing greater resistance to brute-force attacks through the use of three distinct keys. This structure processes data in 64-bit blocks, maintaining the block size of DES.^[14] The core encryption process for a 64-bit plaintext block P produces the ciphertext C via the formula

C = \mathrm{DES}_{K_3} \left( \mathrm{DES}^{-1}_{K_2} \left( \mathrm{DES}_{K_1}(P) \right) \right),

where \mathrm{DES}_K denotes DES encryption using key K, and \mathrm{DES}^{-1}_K denotes DES decryption using key K. The three keys K_1, K_2, and K_3 form a key bundle, each being a 64-bit DES key (with 56 effective bits after parity). Decryption reverses the process:

P = \mathrm{DES}^{-1}_{K_1} \left( \mathrm{DES}_{K_2} \left( \mathrm{DES}^{-1}_{K_3}(C) \right) \right).

Notably, DES decryption with a key is equivalent to DES encryption using the same key but with the subkey schedule inverted (i.e., subkeys applied in reverse order). This EDE sequence ensures that if all three keys are identical, Triple DES reduces to single DES, preserving backward compatibility.^[14]^[15] At its foundation, each invocation of DES in Triple DES uses a Feistel network to process the 64-bit block. The input undergoes an initial permutation (IP), which rearranges the 64 bits according to a fixed table. The permuted block is then divided into two 32-bit halves, left (L_0) and right (R_0), and subjected to 16 iterative rounds. In round i, the halves are updated as L_i = R_{i-1} and R_i = L_{i-1} \oplus f(R_{i-1}, K_i), where f is the round function and K_i is the 48-bit subkey derived from the 64-bit key via a key schedule. The function f first expands the 32-bit right half to 48 bits using an expansion permutation (E), XORs the result with the subkey, applies eight nonlinear 6-to-4 bit substitution boxes (S-boxes) to produce 32 bits, and finally permutes those bits with a fixed permutation box (P). After the 16th round, the halves are swapped, and the final permutation (the inverse of IP) is applied to yield the output block. Triple DES applies this full DES procedure sequentially in the EDE manner, operating solely on individual 64-bit blocks without built-in padding for variable-length data.^[15]^[14]

Key Management and Options

Triple DES, also known as TDEA, employs a key bundle consisting of three 64-bit keys, denoted as K1, K2, and K3, where each key comprises 56 effective bits for encryption plus 8 parity bits for error detection, resulting in a total key length of 192 bits.^[1] These keys are applied in an Encrypt-Decrypt-Encrypt (EDE) manner to enhance security over single DES. Three keying options are defined for TDEA, varying in the independence of the keys to balance security and compatibility. Keying Option 1, or 3TDEA, requires all three keys to be distinct (K1 ≠ K2 ≠ K3), providing the highest level of security with a security strength of 112 bits and is the recommended configuration for new implementations where maximum protection is needed.^[1]^[16] Keying Option 2, or 2TDEA, uses two distinct keys where K1 = K3 but K1 ≠ K2, yielding a total key length of 128 bits and a security strength of 80 bits; this option is permitted primarily for backward compatibility with legacy systems but is considered legacy and restricted in modern use.^[1]^[16] Keying Option 3, or 1TDEA, sets all three keys identical (K1 = K2 = K3), which effectively reduces to single DES with only 56 bits of strength and has been prohibited to avoid its inherent vulnerabilities.^[1] Key generation for TDEA follows approved cryptographic practices, starting with random bits generated using deterministic random bit generators as specified in NIST SP 800-90A, typically 168 bits for 3TDEA or 112 bits for 2TDEA.^[1] These bits are then expanded to 192 or 128 bits by adding 8 parity bits per key, ensuring odd parity in each 64-bit key for integrity checking.^[1] Additionally, generated keys must avoid weak and semi-weak keys, as defined for single DES, including patterns like all zeros or alternating bits that could compromise the cipher's diffusion properties.^[1] Key management overall adheres to NIST SP 800-57 guidelines, emphasizing secure storage, distribution, and periodic rotation to maintain confidentiality.^[16]

Operating Modes and Multi-Block Handling

Triple DES, as a block cipher with a 64-bit block size, employs the standard modes of operation defined for symmetric block ciphers to process messages longer than a single block. These include Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR) modes, as specified in NIST Special Publication 800-38A.^[17] In each mode, the Encrypt-Decrypt-Encrypt (EDE) operation is applied to individual blocks or feedback values derived from previous blocks, ensuring compatibility with the underlying TDEA structure while providing confidentiality for multi-block data.^[17] For multi-block messages, Triple DES chains blocks according to the selected mode to handle data exceeding 64 bits. In CBC mode, for instance, each plaintext block P_i is XORed with the previous ciphertext block C_{i-1} (or an initialization vector IV for the first block) before applying the EDE encryption, yielding C_i = \text{EDE}_{\text{keys}} (P_i \oplus C_{i-1}).^[17] The IV, which must be unpredictable and typically 64 bits long, is used in modes like CBC, CFB, and CTR to ensure semantic security and prevent identical plaintexts from producing identical ciphertexts when starting from the same key.^[17] Decryption reverses this chaining process, applying the inverse EDE (decrypt-encrypt-decrypt) to recover the plaintext blocks. NIST imposes a limit on the total amount of data encryptable under a single Triple DES key bundle to reduce risks from block collisions and related attacks. Specifically, the maximum plaintext length is restricted to $2^{20} (approximately 1 million) 64-bit blocks for a 3-key bundle, a reduction from the earlier $2^{32}-block limit established in prior guidelines.^[18] This constraint applies across all approved modes and requires key rotation after reaching the limit to maintain security.^[18] When the input data length is not a multiple of 64 bits, padding is added to form complete blocks before encryption. A common scheme is PKCS#7 padding, where the number of padding bytes n (1 to 8) is appended as the value of each padding byte, ensuring straightforward removal during decryption.^[19] This approach is compatible with all Triple DES modes that require full-block inputs, such as ECB and CBC, though the specific padding method may vary by implementation while adhering to standard practices for reversibility.^[17]

Security Considerations

Cryptographic Attacks

Triple DES, particularly in its three-key variant (3TDEA), is susceptible to the meet-in-the-middle (MITM) attack, which exploits the encrypt-decrypt-encrypt (EDE) structure by computing and storing intermediate values after the first and second DES operations to find matching keys efficiently.^[20] For 3TDEA, this attack achieves a time complexity of $2^{112} DES operations while requiring $2^{56} space to store approximately $2^{56} intermediate values, effectively reducing the security level from the nominal 168 bits to 112 bits.^[20] In the two-key variant (2TDEA), the MITM attack has a time complexity of $2^{80} and became practically feasible with high-end hardware available in the 2020s, such as GPU clusters capable of performing billions of DES operations per second.^[21] The 64-bit block size of DES, retained in Triple DES, exposes it to birthday attacks like Sweet32 when used in cipher block chaining (CBC) mode or similar constructive modes, where block collisions enable recovery of plaintext XOR differences after roughly $2^{32} blocks (about 32 GB of data). Demonstrated in 2016, the Sweet32 attack requires an attacker to induce approximately $2^{36.6} encrypted blocks (around 785 GB) over a long-lived TLS session, such as by repeatedly sending JavaScript-generated requests containing secret data like HTTP cookies, and can recover partial plaintext in about 38 hours using standard cloud resources. This vulnerability particularly impacts protocols like TLS and OpenVPN that permit long messages with Triple DES, limiting its suitability for high-volume data transfers. Related-key attacks on Triple DES adapt differential cryptanalysis techniques to scenarios where the attacker can query the cipher under keys that bear specific relations across the three DES invocations, such as XOR differences.^[22] These attacks, which require known plaintext and ciphertext under chosen related-key conditions, achieve practical complexities like $2^{118} time for 3TDEA in some setups but do not benefit from reduced-round analysis since each DES component uses the full 16 rounds.^[22] While theoretically significant, such attacks assume unrealistic access to related-key oracles and have limited practical impact on properly implemented, single-key-use scenarios.^[22] The DROWN attack targets SSL/TLS implementations that reuse RSA keys across legacy SSLv2 (with weak export ciphers) and modern TLS sessions using Triple DES, employing SSLv2 as a padding oracle to decrypt TLS ciphertexts.^[23] By exploiting vulnerabilities like CVE-2016-0703 and CVE-2016-0704 in OpenSSL, the "special DROWN" variant recovers a 24-byte TLS key block in under a minute with about 27,000 SSLv2 connections and minimal offline computation, while the general variant requires around $2^{40} operations for key recovery in non-export cases.^[23] This cross-protocol flaw affected over 11 million HTTPS servers in 2016, enabling man-in-the-middle decryption of Triple DES-encrypted TLS traffic.^[23] Exhaustive brute-force key search against 3TDEA demands $2^{112} trials in the worst case, far beyond current computational capabilities and rendering it theoretically secure against direct attacks despite other vulnerabilities. For 2TDEA, brute force requires $2^{80} operations, which remains challenging but more approachable than for 3TDEA due to the reduced key space.

Deprecation and Current Status

In 2017, the National Institute of Standards and Technology (NIST) announced the deprecation of Triple DES (TDEA) through Special Publication (SP) 800-67 Revision 2, which limited its use and signaled the transition away from the algorithm for federal systems.^[18] This was followed by SP 800-131A Revision 2 in 2019, which specified that three-key TDEA could no longer be used for encryption in new cryptographic applications or services after the publication date in March 2019, with general encryption deprecated through December 31, 2023, and fully disallowed thereafter unless permitted by other NIST guidance.^[24] NIST withdrew SP 800-67 Revision 2 effective January 1, 2024, removing official approval for TDEA as a block cipher standard.^[5] The deprecation stems from TDEA's effective security strength of 112 bits, which falls short of modern requirements due to vulnerabilities like meet-in-the-middle attacks, alongside its 64-bit block size that exposes it to birthday attacks (e.g., Sweet32) after processing around 2^32 blocks, and its computational inefficiency compared to AES.^[14]^[24] As of 2025, TDEA is no longer approved for federal use in applying cryptographic protection and is classified as obsolete by NIST, with its 112-bit security deemed inadequate against contemporary threats including large-scale computing resources.^[24] NIST recommends transitioning to AES-128 or stronger algorithms for symmetric encryption, noting that post-quantum considerations do not apply as TDEA was deprecated prior to widespread quantum risk assessments.^[24] Decryption of legacy TDEA-protected data remains permitted indefinitely for backward compatibility.^[24]

Applications

Historical Usage

Triple DES saw extensive adoption in the financial sector during the 1990s and 2000s, serving as a key component in securing electronic transactions and payment infrastructures. It was widely implemented in EMV chip cards for authenticating cardholder data and generating cryptograms during payment processing, with EMV specifications mandating at least one card-unique 3DES key for encryption. In ATM networks, Triple DES became a standard for encrypting PINs and transaction data, with major networks like MasterCard's Cirrus and Maestro requiring its use by 2001 to replace single DES and enhance security against brute-force attacks. Similarly, payment protocols such as ISO 8583 relied on Triple DES for encrypting sensitive elements like PIN blocks in financial messaging, supporting secure interchange between acquirers, issuers, and processors throughout the 1990s to 2010s.^[25]^[26]^[27] In networking applications, Triple DES played a pivotal role in early secure communications protocols. It was specified in IPsec's Encapsulating Security Payload (ESP) via RFC 1851 in 1995, enabling Triple DES-CBC mode for confidentiality in VPNs and IP packet protection, which facilitated secure remote access and site-to-site connections in enterprise environments. For web security, Triple DES was integrated into SSL and TLS up to version 1.2 through ciphersuites like TLS_RSA_WITH_3DES_EDE_CBC_SHA, supporting encrypted sessions in early e-commerce platforms and online banking from the late 1990s onward. This made it a cornerstone for protecting data in transit during the rise of internet-based financial services.^[12] Government and military sectors utilized Triple DES for secure communications and data storage, leveraging its NIST approval under FIPS 46-3 and SP 800-67 (withdrawn January 1, 2024).^[14]^[5] It was employed in federal systems for encrypting classified information and in protocols for protected transmissions, authorized by agencies like the U.S. Department of Veterans Affairs for compliance with government standards.^[28] During its peak in the 2000s, Triple DES emerged as the primary successor to single DES, widely adopted across industries to safeguard legacy systems and enabling the secure processing of billions of financial transactions annually in payment networks. The introduction of AES as a federal standard in 2001 via FIPS 197 marked the beginning of migration efforts from Triple DES, with protocols gradually shifting to stronger algorithms. In the financial domain, PCI DSS requirements accelerated this transition, mandating AES for new implementations and phasing out reliance on Triple DES as strong cryptography by December 31, 2023.^[29]^[30]

Modern Implementations and Migration

In 2025, major cryptographic software libraries support Triple DES primarily for compatibility with legacy systems, but with deprecation measures to discourage new implementations. OpenSSL deprecated low-level DES and Triple DES APIs in version 3.0 (released in 2021), marking them as legacy and planning their removal in version 4.0, anticipated in April 2026; as of October 2025, OpenSSL 3.6.0 maintains deprecated support.^[31]^[32]^[33] The Crypto++ library continues to provide Triple DES functionality without formal deprecation, while Bouncy Castle issues warnings and restricts access in FIPS-certified modes to align with deprecation policies.^[34] Python's cryptography library has deprecated Triple DES, relocating it to a "decrepit" module with runtime warnings to signal its obsolescence and impending removal.^[35] Hardware support for Triple DES remains confined to legacy decryption in FIPS 140-2 certified modules and limited legacy use in FIPS 140-3 certified modules, where encryption is not approved, such as smart cards and hardware security modules (HSMs) from vendors like Thales. For instance, Thales Luna HSMs include Triple DES capabilities for decrypting existing data but have removed usage counters in firmware versions compliant with FIPS 140-3 to limit ongoing encryption.^[36]^[37] Dedicated ASIC or FPGA implementations are rare, as most modern deployments rely on CPU-accelerated software libraries due to the algorithm's declining relevance. On contemporary CPUs lacking native Triple DES acceleration, performance typically ranges from 10-50 MB/s, far slower than AES implementations that benefit from hardware instructions like AES-NI, owing to the need for three sequential DES passes.^[38] Migration strategies emphasize transitioning to AES, with NIST guidelines in SP 800-131A recommending AES-128 or stronger for all new and existing applications, while permitting three-key Triple DES solely for decryption of legacy data post-2023.^[18]^[24] Key wrapping mechanisms, such as AES-based KW or KWP modes, facilitate hybrid systems by securely encapsulating Triple DES keys for transport to AES environments during phased migrations.^[39] Industry standards like PCI DSS 4.0 enforce this shift by prohibiting new Triple DES key usage starting in 2024, accelerating deprecation in payment processing. By 2025, Triple DES is restricted to legacy decryption in finance and telecommunications, with no new FIPS certifications approving it for encryption to ensure compliance with modern security requirements.^[40]^[41]^[42]

References

[1]
https://doi.org/10.6028/NIST.SP.800-67r2
[2]
On the security of multiple encryption - ACM Digital Library
Double encryption has been suggested to strengthen the Federal Data Encryption Standard (DES). A recent proposal suggests that using two 56-bit keys but ...
[3]
FIPS 46-3, Data Encryption Standard (DES) | CSRC
This publication specifies two cryptographic algorithms, the Data Encryption Standard (DES) and the Triple Data Encryption Algorithm (TDEA)
[4]
SP 800-67 Rev. 1, Recommendation for the Triple Data Encryption ...
This publication specifies the Triple Data Encryption Algorithm (TDEA), including its primary component cryptographic engine, the Data Encryption Algorithm ...Missing: DES | Show results with:DES
[5]
NIST to Withdraw Special Publication 800-67 Revision 2 | CSRC
The specification of the Triple Data Encryption Algorithm (TDEA), NIST SP 800-67 Rev. 2, will be withdrawn January 1, 2024. The algorithm will be disallowed ...
[6]
SP 800-67 Rev. 2, Recommendation for the Triple Data Encryption ...
This publication specifies the Triple Data Encryption Algorithm (TDEA), including its primary component cryptographic engine, the Data Encryption Algorithm (DEA) ...
[7]
None
### Encyclopedia Introduction: Triple Data Encryption Algorithm (TDEA)
[8]
EFF DES CRACKER MACHINE BRINGS HONESTY TO CRYPTO ...
Aug 9, 2016 · The existence of the EFF DES Cracker proves that the threat of "brute force" DES key search is a reality. Although the cryptographic ...
[9]
[PDF] pdf
Handbook of Applied Cryptography by A. Menezes, P. van Oorschot and S ... plementations, often resulting in poor performance; this makes triple-DES less ...
[10]
On the security of multiple encryption
The use of double encryption provides an increase in security because the algorithm for cryptanalysis requires. 256 words of memory, as well as 256 operations.
[11]
ANSI - X9.52 - Triple Data Encryption Algorithm Modes of Operation
Defines triple-DES algorithm for use in both wholesale and retail financial applications. As part of this definition, related standards that should be modified.
[12]
Modes of Operation Validation System for the Triple Data Encryption ...
This publication provides a brief overview of the Triple DES algorithm and introduces the basic design and configuration of the TMOVS. Included in this overview ...
[13]
Announcing Approval of the Withdrawal of Federal Information ...
May 19, 2005 · The Secretary of Commerce has approved the withdrawal of FIPS 46-3, Data Encryption Standard (DES); FIPS 74, Guidelines for Implementing and ...
[14]
RFC 1851: The ESP Triple DES Transform
This document describes the Triple DES-CBC security transform for the IP Encapsulating Security Payload (ESP).
[15]
Cryptographic Algorithm Validation Program CAVP
As of May 19, 2007, in accordance with the DES Transition Plan, Triple DES keying option 3 (Key 1 = Key 2 = Key 3) is no longer approved. As of January 1, 2016, ...
[16]
[PDF] FIPS 46-3, Data Encryption Standard (DES) (withdrawn May 19, 2005)
Oct 25, 1999 · Triple DES will be the FIPS approved symmetric encryption algorithm of choice. 3. Single DES (i.e., DES) will be permitted for legacy systems ...
[17]
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-38a.pdf
[18]
[PDF] NIST SP 800-38A, Recommendation for Block Cipher Modes of ...
The TDEA is often called Triple DES. FIPS Pub 46-3 also approves the seven modes of operation of Triple DES that are specified in. ANSI X9.52. Four of those ...
[19]
Update to Current Use and Deprecation of TDEA | CSRC
Jul 11, 2017 · The Triple Data Encryption Algorithm (TDEA), also called Triple Data Encryption Standard (or 3DES), is specified in SP 800-67 Revision 1, ...Missing: definition | Show results with:definition
[20]
Using padding in encryption - di-mgt.com.au
Sep 9, 2025 · This article describes the mechanics of padding with examples using common block encryption algorithms like AES, Triple DES and Blowfish. It ...
[21]
A Known-Plaintext Attack on Two-Key Triple Encryption - SpringerLink
The new attack is a significant improvement over a known-plaintext brute-force attack, but is still not seen as a serious threat to two-key triple encryption.
[22]
[PDF] On the security of 2-key triple DES - arXiv
Jul 17, 2016 · This paper reconsiders the security offered by 2-key triple DES, an en- cryption technique that remains widely used despite recently being ...
[23]
Related-Key Attacks on Triple-DES and DESX Variants | SpringerLink
In this paper, we present related-key slide attacks on 2-key and 3-key triple DES, and related-key differential and slide attacks on two variants of DESX.
[24]
[PDF] Breaking TLS using SSLv2 - DROWN Attack
Abstract. We present DROWN, a novel cross-protocol attack on. TLS that uses a server supporting SSLv2 as an oracle to decrypt modern TLS connections.
[25]
[PDF] Transitioning the Use of Cryptographic Algorithms and Key Lengths
Mar 2, 2019 · This Recommendation (SP 800-131A) provides more specific guidance for transitions to the use of stronger cryptographic keys and more robust ...Missing: timeline | Show results with:timeline
[26]
[PDF] Transitioning the Use of Cryptographic Algorithms and Key Lengths
Oct 21, 2024 · The Triple Data Encryption Algorithm (TDEA) (often referred to as “Triple DES”) is specified in SP 800-67r2, Recommendation for the Triple ...
[27]
The End of 3DES: A Milestone in Encryption Standards - Cryptomathic
The guidelines propose that, after a period of public consultation, 3DES is deprecated for all new applications and usage is disallowed after 2023.<|control11|><|separator|>
[28]
How EMVCo is Supporting Card Data Encryption Advancements for ...
Aug 19, 2021 · 2-key Triple DES is a 1990's strengthening of a 1970's algorithm (DES), which by that time was no longer secure. 2-key Triple DES still provides ...
[29]
[PDF] EMV® Key Management – Explained - Cryptomathic
All EMV® cards have a mandated minimum requirement for using one card unique 3DES key and have a choice between three increas- ingly secure usages of RSA ...
[30]
[PDF] Triple DES: Options for Compliance
Shorthand for “triple data encryption standard,” Triple DES is a new code that requires that EFT transactions be encrypted three times (instead of once, the ...
[31]
PPP Triple-DES Encryption Protocol (3DESE)
Several block cipher algorithms have been authorized for use by the Federal government including Triple DES Encryption Protocol. This is a mature standard ...Missing: military | Show results with:military<|separator|>
[32]
PCI SSC Cryptography Expert on Triple DEA
Nov 9, 2017 · TDEA ciphersuites are commonly used by older operating systems (for example, Windows XP) and older protocols (for example, SSL and early TLS).Missing: historical | Show results with:historical<|separator|>
[33]
migration_guide - OpenSSL Documentation
Deprecated APIs may be removed from future versions of OpenSSL so you are strongly encouraged to update your code to use the high level APIs instead. This is ...
[34]
API Deprecation Announcement for OpenSSL4.0
Jun 3, 2025 · Tomas Mraz · Thu 5 Jun 2025 3:31PM. As for possibilities for removals - basically anything that is deprecated in 3.5 can be removed in 4.0.
[35]
Bouncy Castle Crypto API Attains FIPS 140-3 Certification
Jul 31, 2024 · In line with the transition for PKCS1.5 encryption and Triple-DES ending this year, the 2.0.0 release blocks access to this functionality in ...
[36]
Symmetric encryption — Cryptography 47.0.0.dev1 documentation
TripleDES(key)[source] . Warning. This algorithm has been deprecated and moved to the Decrepit cryptography module. If you need to continue using it then ...
[37]
Luna HSM Firmware 7.9.0 - Thales Docs
The 3DES usage counter attribute (CKA_BYTES_REMAINING) has been removed in Luna HSM Firmware 7.8.4 and newer, to comply with FIPS 140-3 requirements. This ...
[38]
3DES vs AES for IPSEC : r/networking - Reddit
Oct 27, 2016 · On a single modern core, 3DES tops out around 30 MB/sec. AES topped out at like 2.5 GB/sec. From my own experience with SSH though, picking ...
[39]
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf
[40]
Disable use of TripleDES/3DES encryption algorithm - ServiceNow
3DES is now banned for encryption in federal systems. Going forward, TDES can only be used for historical purposes, such as decrypting old messages, key ...
[41]
The Risks of 3DES in FIPS Certificates - wolfSSL
Feb 6, 2025 · 3DES (Triple Data Encryption Standard) was once a FIPS (Federal Information Processing Standards) algorithm but is no longer supported by ...