3-DES

3DES is an encryption cipher that was derived from the original Data Encryption Standard (DES). It became prominent in the late nineties but has since fallen out of favour due to the rise of more secure algorithms, such as AES-256 and XChaCha20.

Although it will be deprecated in 2023, it’s still implemented in some situations. Since it’s based on one of the first widely published and studied algorithms, DES, it is still important to learn about what 3DES is and how it works.

This guide will take you through:

• Each step of the DES process in detail
• How DES is modified in 3DES to make it more secure
• The various security issues and whether or not you should use the algorithm

What is 3DES?

Although it’s officially known as the Triple Data Encryption Algorithm (3DEA), it is most commonly referred to as 3DES. This is because the 3DES algorithm uses the Data Encryption Standard (DES) cipher three times to encrypt its data.

DES is a symmetric-key algorithm based on a Feistel network. As a symmetric key cipher, it uses the same key for both the encryption and decryption processes. The Feistel network makes both of these processes almost exactly the same, which results in an algorithm that is more efficient to implement.

DES has both a 64-bit block and key size, but in practice, the key only grants 56-bits of security. 3DES was developed as a more secure alternative because of DES’s small key length. In 3DES, the DES algorithm is run through three times with three keys; however, it is only considered secure if three separate keys are used.

The uses of 3DES

Once the weaknesses of normal DES became more apparent, 3DES was adopted in a wide range of applications. It was one of the more commonly used encryption schemes before the rise of AES.

Some examples of its implementations included:

• Microsoft Office
• Firefox
• EMV payment systems

Many of these platforms no longer use 3DES because there are better alternatives.

The National Institute of Standards and Technology (NIST) has released adraft proposal saying that all forms of 3DES will be deprecated through 2023 and disallowed from 2024 onward. Although it’s just a draft, the proposal signifies the end of an era, and it is well past the time to move onto other, more secure algorithms.