5
$\begingroup$

A properly implemented 3DES consists of 3 independent keys.

The brute-force meet-in-the-middle attack with known plaintext/ciphertext is the most effective brute-force method against 3DES, but it still offers 112-bit security.

A known attack is Sweet32, which targets the 64-bit block size and causes collisions, though it requires a large volume of data exchange and capture.

Is there any other attack that breaks 3DES? I assume 112-bit is considered secure?

$\endgroup$
1
  • 3
    $\begingroup$ "A properly implemented 3DES consists of 3 independent keys.". No, a "proper" 3DES key consists of 3 independent DES keys. The lowest level of an implementation usually regards the 3 keys as separate keys, although there are certainly implementations that only offer 2-key implementations of triple DES. This is not worded very well (outside of misspelling "independent", please use a spell checker). $\endgroup$
    – Maarten Bodewes
    Commented 18 hours ago

1 Answer 1

4
$\begingroup$

The Sweet32 attack doesn't necessarily require a large amount of data to be encrypted with the same key to be successful. While the average-case does require $2^{36.6}$ blocks (776 GiB) of ciphertext, researchers have found collisions with as few as $2^{20}$ blocks (8 MiB). NIST recommends not using 3DES for any scenario where more than $2^{20}$ blocks are encrypted with a single key.

DES is also rather difficult to secure in contexts where hardware side-channel attacks are in scope, for example in embedded devices. Certain implementations may be vulnerable to cache timing side-channel attacks against the S-box. Power analysis and EM side-channel analysis are quite effective against DES for a number of reasons, not least of which that leaking a few bits of the key is more impactful when small key sizes are used. It is possible to implement DES, and thus 3DES, in a manner that frustrates these side-channel attacks, but it is a non-trivial undertaking and it isn't that unusual to find that even EMV systems get it wrong. See Heyszl et. al. (2020) for a review of such attacks.

$\endgroup$

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.