Applied Cryptography for Developers Module 8 – Inside DES, 3DES and AES

Multiple encryption, 3DES and 64-bit block limits

Why encrypting twice adds about one bit of security, how Triple DES orders its three keys, and the birthday arithmetic that retired 64-bit block ciphers.

Intermediate
30 minutes
Examples run with Node.js 24.21.0, Python 3.14.8, Pyodide 314.0.7 and quickjs 0.32.0
By MySmartCoPilot

Free: Encrypting twice with two keys adds about one bit · Triple DES encrypts, decrypts, then encrypts again · A 64-bit block limits the data under one key, whatever the key length. With a pass: 3 in-depth parts and 3 interview answers, about 20 minutes.

What you will learn

Explain why double encryption with two independent keys adds about one bit of security instead of doubling the key length
Describe the encrypt-decrypt-encrypt order of Triple DES and what each of its keying options computes
Calculate when a repeated ciphertext block becomes likely for 64-bit and 128-bit block ciphers
Check key bundles and cipher names in code you own for single DES, Triple DES and other retired algorithms
Plan the retirement of a store of Triple DES records and decide which key bundle to re-encrypt first

Before you start

What you’ll learn · Before you start

What you will learn

Explain why double encryption with two independent keys adds about one bit of security instead of doubling the key length
Describe the encrypt-decrypt-encrypt order of Triple DES and what each of its keying options computes
Calculate when a repeated ciphertext block becomes likely for 64-bit and 128-bit block ciphers
Check key bundles and cipher names in code you own for single DES, Triple DES and other retired algorithms
Plan the retirement of a store of Triple DES records and decide which key bundle to re-encrypt first

Before you start

On this page

A machine built for under $250,000 searched 88 billion DES keys a second and found the right one in 56 hours. The obvious repair, encrypting twice under two keys, looks like 112 bits and is worth about 57: given one known plaintext and its ciphertext, a search that meets in the middle needs about twice 2⁵⁶ cipher calls, not 2¹¹².

Triple DES stacks three steps instead and lasted longer, but its 64-bit block raised a second problem that no key length fixes. This lesson attacks a toy double cipher, lays out Triple DES’s keying options, works out how much data a 64-bit cipher can encrypt under one key, and ends with checks for retired ciphers in code you own.

Encrypting twice with two keys adds about one bit

Multiple encryption runs a cipher more than once, each time under a key of its own, and the simplest case is double encryption, C = E(K2, E(K1, P)). The lab cipher of this module, a toy with 32-bit blocks and 16-bit keys, has 32 bits of key when used twice, so trying every pair takes up to 4,294,967,296 attempts. An attacker who knows one plaintext P and its ciphertext C can do far better, because the middle value M = E(K1, P) is also D(K2, C). Each half of the cipher can be searched alone and the two lists compared:

Interactive · step by step Meeting in the middle on the lab cipher Step through the search for the two keys of a double cipher from one known plaintext and its ciphertext.

The drawing shows the whole scene; its 6 steps are listed below.

Every step as text

Two known values. An observer holds one pair: P and C = E(K2, E(K1, P)). The middle value M = E(K1, P) is hidden, but it is also D(K2, C), which is what makes the search possible.
Encrypt forwards. Encrypt P under all 65,536 values of K1 and store each result with its key. That is 65,536 cipher calls and a table of 65,536 middle values.
Decrypt backwards. Decrypt C under all 65,536 values of K2. Each result is a candidate for the same middle value, so another 65,536 calls give 65,536 candidates.
Look each one up. Look every decrypted value up in the table. A match means that some K1 takes P to M and some K2 takes M back to C, so the pair (K1, K2) fits.
Two key pairs fit. In the lab run two key pairs fit the first known pair, the true one and one that fits by chance. A second known pair removes the false one.
The cost. In all, 131,072 cipher calls, where trying every pair of keys takes up to 8,589,934,592. The second key doubled the attacker's work compared with one key: about one bit.

This is a meet-in-the-middle attack: An attack on double or triple encryption that encrypts forwards from a known plaintext and decrypts backwards from its ciphertext, then matches the middle values. Two independent k-bit keys cost about 2^k work and storage, not 2^(2k). attack on a known-plaintext attack: An attack in which the adversary has some plaintexts together with their ciphertexts, such as a fixed file header or a greeting that every message starts with. More in “The symmetric cipher model and the Caesar cipher”. The Handbook of Applied Cryptography counts about 2ᵏ operations and 2ᵏ stored values for a k-bit key. The lab cipher’s code comes first, then the search, which uses known pairs and never the keys:

The lab cipher: 32-bit blocks, 8 rounds, a 16-bit key Python · toy/toy_cipher.py

# The lab cipher of this module, repeated from the previous lesson so that the programs below run on their own: a toy
# Feistel cipher on 32-bit blocks (two 16-bit halves), 8 rounds and a 16-bit key. Far too small to protect anything.
MASK = 0xFFFF
ROUNDS = 8


def f(right, round_key):
    """The middle 16 bits of (R XOR K) squared."""
    x = right ^ round_key
    return (x * x >> 8) & MASK


def rotl(x, n):
    """Rotate a 16-bit value left by n bits."""
    n %= 16
    return ((x << n) | (x >> (16 - n))) & MASK


def round_keys(key):
    """Round i uses the key rotated left by 3i bits, XOR a constant, so no two rounds share a key."""
    return [rotl(key, 3 * i) ^ ((0x9E37 * (i + 1)) & MASK) for i in range(ROUNDS)]


def feistel(block, keys):
    """L, R = R, L XOR f(R, K) for every round key, then the halves swapped back."""
    left, right = block >> 16, block & MASK
    for k in keys:
        left, right = right, left ^ f(right, k)
    return (right << 16) | left


def encrypt(key, block):
    return feistel(block, round_keys(key))


def decrypt(key, block):
    """The same rounds, the round keys in reverse order."""
    return feistel(block, round_keys(key)[::-1])

Breaking double encryption by meeting in the middle Python · toy/mitm.py

# Double encryption with two independent 16-bit keys, C = E(K2, E(K1, P)), against a meet-in-the-middle search. The
# searching program is ours and the cipher is our toy: it needs known plaintext-ciphertext pairs and never the keys.
from toy_cipher import decrypt, encrypt

SECRET = (0x2C1F, 0x7B3D)  # (K1, K2): known only to the line that makes the pairs below
PLAINTEXTS = [int.from_bytes(word) for word in (b"Nama", b"ste!", b"Hell")]


def double_encrypt(k1, k2, block):
    return encrypt(k2, encrypt(k1, block))


pairs = [(p, double_encrypt(*SECRET, p)) for p in PLAINTEXTS]
keys = 1 << 16

print("Double encryption with two independent 16-bit keys: 32 bits of key")
print(f"Trying every key pair takes up to {keys * keys:,} pairs, two cipher calls each")

p1, c1 = pairs[0]
print(f"\nMeet in the middle, from one known pair: P = {p1:08x}, C = {c1:08x}")
table = {}
for k1 in range(keys):  # step 1: encrypt P under every K1 and remember the middle value
    table.setdefault(encrypt(k1, p1), []).append(k1)
candidates = []
for k2 in range(keys):  # step 2: decrypt C under every K2 and look the middle value up
    for k1 in table.get(decrypt(k2, c1), ()):
        candidates.append((k1, k2))
calls = 2 * keys
print(f"  {calls:,} cipher calls ({keys:,} + {keys:,}), a table of {len(table):,} middle values")
print(f"  key pairs that fit the first pair: {len(candidates)}")

for number, (p, c) in enumerate(pairs[1:], start=2):
    candidates = [(a, b) for a, b in candidates if double_encrypt(a, b, p) == c]
    print(f"  after pair {number}: {len(candidates)} left")

found = candidates[0]
print(f"\nRecovered (K1, K2) = ({found[0]:04x}, {found[1]:04x}); the secret was ({SECRET[0]:04x}, {SECRET[1]:04x})")
print(f"Work: {calls:,} cipher calls instead of {2 * keys * keys:,}, about {2 * keys * keys // calls:,} times fewer")
print(f"Expected false key pairs per known pair: 2^(2 * 16 - 32) = {2 ** (2 * 16 - 32)}")

Output

Double encryption with two independent 16-bit keys: 32 bits of key
Trying every key pair takes up to 4,294,967,296 pairs, two cipher calls each

Meet in the middle, from one known pair: P = 4e616d61, C = 42c0d838
  131,072 cipher calls (65,536 + 65,536), a table of 65,536 middle values
  key pairs that fit the first pair: 2
  after pair 2: 1 left
  after pair 3: 1 left

Recovered (K1, K2) = (2c1f, 7b3d); the secret was (2c1f, 7b3d)
Work: 131,072 cipher calls instead of 8,589,934,592, about 65,536 times fewer
Expected false key pairs per known pair: 2^(2 * 16 - 32) = 1

Recorded with Python 3.14.8 on macOS 26 arm64. To run it yourself: mise exec python@3.14.8 -- python3 mitm.py

The search made 131,072 cipher calls, 65,536 to fill the table and 65,536 to look values up, where trying every pair takes up to 8,589,934,592. A single 16-bit key falls to at most 65,536 trials, so the second key doubled the attacker’s work: about one bit. At DES’s size, multiple encryption with independent keys costs an attacker this much:

Construction	Independent keys	Best known search
One encryption	1	about 2⁵⁶ calls
Double encryption	2	about 2⁵⁷ calls and 2⁵⁶ stored values
Triple, three keys	3	about 2¹¹² calls

Checkpoint

Check: Why double encryption adds one bit

Question 1 of 2 Two independent 56-bit DES keys are used one after the other, and the attacker knows one plaintext and its ciphertext. How much work does the best known attack need, against 2⁵⁶ cipher calls for a single DES key?
Choose one answer.

About twice as much, around 2⁵⁷ cipher calls and a table of 2⁵⁶ entries 2²⁸, the square root of one key space No attack is known, so two keys give 112 bits 2¹¹², the number of key pairs

Show the answer: Question 1 of 2

Answer: About twice as much, around 2⁵⁷ cipher calls and a table of 2⁵⁶ entries

Handbook of Applied Cryptography Fact 7.33 counts about 2ᵏ operations and 2ᵏ storage for a k-bit key. For DES that is 2⁵⁶ calls for each half, 2⁵⁷ in all, which is why double encryption is worth about one bit and not 56.
Question 2 of 2 The lab search made 131,072 cipher calls for two 16-bit keys. The keys grow to 24 bits each. By what factor does the work of the meet-in-the-middle search grow?
Type a number.
Your answer times

A hint

The table has one entry for each value of K1 and the lookups one for each value of K2, so each extra key bit doubles both.

Show the answer: Question 2 of 2

Answer: 256 times

The search costs 2 × 2ᵏ calls, so 8 more bits of key make it 2⁸ = 256 times as large, 33,554,432 calls. Trying every pair of keys would grow 65,536 times, from 2³² to 2⁴⁸.

Triple DES encrypts, decrypts, then encrypts again

3DES, short for Triple DES, runs three DES calls on each block: encrypt with K1, decrypt with K2, encrypt with K3. The middle call decrypts for compatibility, because with K1 equal to K2 the first two calls cancel and the result is single DES under K3, so 3DES equipment could still talk to old DES systems. NIST’s published example shows the stages on one block:

Interactive · stage by stage Triple DES on NIST's example block Step through encrypt, decrypt, encrypt with the three keys of NIST's example, and see where the keying options differ.

The drawing shows the whole scene; its 5 steps are listed below.

Every step as text

One block in. NIST's TDES_Core example takes the 64-bit block 6bc1bee22e409f96 and three DES keys. Every DES call here works on the whole block.
Encrypt with K1. The first call is ordinary DES encryption under K1 and gives 7277a00dc1c1c36b.
Decrypt with K2. The second call runs DES backwards under K2, a different key, so it does not undo the first: it scrambles the block into f6c18af658cc11d5.
Encrypt with K3. The third call encrypts under K3 and gives the Triple DES ciphertext 714772f339841d34. Setting K3 equal to K1 gives 06ede3d82884090a instead: two-key Triple DES.
Why the middle call decrypts. If K1 and K2 were equal, the second call would undo the first, and the whole thing would be single DES under K3. That is the point of encrypt-decrypt-encrypt: old DES equipment can still be reached by setting equal keys, and it is also the trap that keeps equal keys out of a real key bundle.

What 3DES is worth depends on which of its keys are equal. NIST’s SP 800-67 calls three different keys 3TDEA, K3 equal to K1 two-key TDEA, and forbids a key bundle: The three DES keys that Triple DES uses together, K1, K2 and K3, written as 24 bytes. It is three-key (3TDEA) when all three differ, and NIST says a bundle shall not consist of three identical keys. of three identical keys. The program computes each option on NIST’s block:

3DES on NIST's example block, and what each keying option computes JavaScript · tdes/tdes_stages.mjs

// Triple DES on the example of NIST's TDES_Core file, computed with the OpenSSL inside Node.js. Node lists des-ede3, the
// three-key form, but not single DES, so a single DES call is des-ede3 with three equal keys: the first two steps cancel.
import { createCipheriv, createDecipheriv } from 'node:crypto';

const hex = (bytes) => Buffer.from(bytes).toString('hex');
const key = (digits) => Buffer.from(digits, 'hex');
const [K1, K2, K3] = ['0123456789abcdef', '23456789abcdef01', '456789abcdef0123'].map(key);
const BLOCK = key('6bc1bee22e409f96');

function ecb(name, secret, data, decrypt = false) {
  const cipher = (decrypt ? createDecipheriv : createCipheriv)(name, secret, null);
  cipher.setAutoPadding(false);
  return Buffer.concat([cipher.update(data), cipher.final()]);
}
const des = (k, data, decrypt = false) => ecb('des-ede3', Buffer.concat([k, k, k]), data, decrypt);
const ede = (k1, k2, k3, data) => ecb('des-ede3', Buffer.concat([k1, k2, k3]), data);

console.log(`Node.js ${process.version}, OpenSSL ${process.versions.openssl}`);
console.log(`NIST TDES_Core, plaintext ${hex(BLOCK)}:`);
const s1 = des(K1, BLOCK);
const s2 = des(K2, s1, true);
const s3 = des(K3, s2);
console.log(`  encrypt with K1  ${hex(s1)}`);
console.log(`  decrypt with K2  ${hex(s2)}`);
console.log(`  encrypt with K3  ${hex(s3)}`);

console.log('\nKeying options on the same block:');
const options = [
  ['K1, K2, K3 all different', K1, K2, K3],
  ['K3 = K1 (two keys)', K1, K2, K1],
  ['K1 = K2 = K3', K1, K1, K1],
  ['K1 = K2', K1, K1, K3],
  ['K2 = K3', K1, K2, K2],
];
for (const [label, a, b, c] of options) {
  const out = ede(a, b, c, BLOCK);
  const same = [['K1', K1], ['K2', K2], ['K3', K3]].find(([, k]) => hex(des(k, BLOCK)) === hex(out));
  console.log(`  ${label.padEnd(25)} ${hex(out)}${same ? `  = single DES under ${same[0]}` : ''}`);
}

Output

Node.js v24.21.0, OpenSSL 3.5.8
NIST TDES_Core, plaintext 6bc1bee22e409f96:
  encrypt with K1  7277a00dc1c1c36b
  decrypt with K2  f6c18af658cc11d5
  encrypt with K3  714772f339841d34

Keying options on the same block:
  K1, K2, K3 all different  714772f339841d34
  K3 = K1 (two keys)        06ede3d82884090a
  K1 = K2 = K3              7277a00dc1c1c36b  = single DES under K1
  K1 = K2                   64864bcd4705dd0c  = single DES under K3
  K2 = K3                   7277a00dc1c1c36b  = single DES under K1

Recorded with Node.js 24.21.0 on macOS 26 arm64. To run it yourself: mise exec node@24.21.0 -- node tdes_stages.mjs

Option	Keys	Strength	Encryption today
Three-key (3TDEA)	K1, K2, K3 all different: 168 key bits	112 bits	disallowed after 2023
Two-key (2TDEA)	K3 = K1: 112 key bits	up to 80 bits	disallowed
Single DES in disguise	K1 = K2, K2 = K3 or all equal: 56 key bits	56 bits	not a valid bundle

Strengths are SP 800-57’s as ASVS 5.0 lists them; the status is SP 800-131A’s. The last lines of the output hold a trap: three equal keys are not the only bundle that is really single DES. K1 = K2 leaves single DES under K3, K2 = K3 leaves it under K1, and OpenSSL computes either without complaint.

Checkpoint

Check: Triple DES and its keying options

Question 1 of 2 Triple DES encrypts with K1, decrypts with K2 and encrypts with K3. Why is the middle call a decryption?
Choose one answer.

It lets the receiver decrypt with the same three steps in the same order Decryption is a stronger operation than encryption With K1 = K2 the first two calls cancel and the result is single DES under K3, so old DES equipment can still be reached It makes the ciphertext shorter than the plaintext

Show the answer: Question 1 of 2

Answer: With K1 = K2 the first two calls cancel and the result is single DES under K3, so old DES equipment can still be reached

The order exists for compatibility, not for strength. The same fact is a trap: any bundle in which K1 equals K2 or K2 equals K3 computes single DES.
Question 2 of 2 A configuration holds a 24-byte Triple DES key K1 K2 K3 in which K1 equals K2 and K3 is different. What does it compute?
Choose one answer.

Three-key Triple DES with 112 bits of strength Single DES under K3, because the first two calls cancel An error, because OpenSSL refuses equal keys Two-key Triple DES, since two keys are equal

Show the answer: Question 2 of 2

Answer: Single DES under K3, because the first two calls cancel

The program printed the same ciphertext for K1 = K2 as for single DES under K3, 64864bcd4705dd0c. Checking only for three equal keys misses this case and its mirror, K2 = K3.

A 64-bit block limits the data under one key, whatever the key length

Key length is one limit of a cipher and block size is the other. DES and 3DES work on 64-bit blocks, and among n random blocks the chance that two are equal is about n² divided by 2⁶⁵, of the order of one half at n = 2³². The table turns that into data under one key, beside AES’s:

Block size	A repeat becomes likely near	Data under one key
64 bits (DES, 3DES)	2³² blocks	32 GiB
128 bits (AES)	2⁶⁴ blocks	256 EiB

These 64-bit block limits matter because of what a repeat gives away: in CBC (cipher block chaining): A mode that XORs each plaintext block with the previous ciphertext block, and the first with an unpredictable IV, before encrypting it. It needs padding and detects no changes to the ciphertext. More in “Block ciphers and modes: why ECB and raw CBC fail” mode two equal ciphertext blocks reveal the XOR of two plaintext blocks, and in 2016 researchers turned that into a practical attack, called Sweet32, on long-lived 3DES connections.

NIST turned the 64-bit block limits into a rule. One 3DES key bundle may protect at most 2²⁰ blocks, which is 8 MiB, down from 2³² in the 2012 edition of SP 800-67. A 64-bit block therefore retires a cipher even when its key is long enough to survive any search.

Checkpoint

Check: The 64-bit block limit

One question Roughly how much data can a 64-bit block cipher encrypt under one key before a repeated ciphertext block becomes likely?
Choose one answer.

About 2⁶⁴ bytes About 8 MiB, which is 2²⁰ blocks About 32 GiB, near 2³² blocks Never, because a block cipher cannot repeat an output

Show the answer: One question

Answer: About 32 GiB, near 2³² blocks

The chance of a repeat among n blocks is about n² divided by 2⁶⁵ for 64-bit blocks, so it is of the order of one half at n = 2³² blocks, which is 32 GiB of 8-byte blocks.

The meet-in-the-middle search, measured, and why three keys Pro: opens with a Pro, Premium or Ultimate pass

A search that meets in the middle trades memory for time, and how many key pairs survive depends on the size of the block. This part counts the survivors over eight secret key pairs, works out the time-memory trade at DES’s size, and shows why a third key lifts the cost from about 2⁵⁶ to about 2¹¹² cipher calls.

In this part:

One known pair leaves about one false key pair
Time against memory: the product stays at 2¹¹³
Why three keys, and why not two

1 runnable example (Python) · about 5 minutes

Opening this part with your pass…

This part opens with any MySmartCoPilot pass.

Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45

One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.

Choose a pass I have a licence key

It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).

The birthday numbers for 64- and 128-bit blocks, the CBC leak and NIST's limit Pro: opens with a Pro, Premium or Ultimate pass

Whether a block cipher repeats a block is a birthday problem, and the answer depends only on the block size. This part computes the chance of a repeat for 64- and 128-bit blocks, reproduces the CBC leak at the lab cipher’s scale, and shows where NIST’s cap of 2²⁰ blocks and the Sweet32 findings fit in.

In this part:

The repeat chance, computed for both block sizes
A repeated block in CBC leaks the XOR of two plaintext blocks
Where NIST’s cap and the Sweet32 findings fit in

2 runnable examples (Python) · about 4 minutes

Opening this part with your pass…Pro part. It opens with the same pass as the part above.

Finding Triple DES in your own code, and retiring it Pro: opens with a Pro, Premium or Ultimate pass

Retired ciphers survive in defaults, in old configuration and in partners’ file formats. This part audits cipher names with a check that fails on a weak configuration and passes on a fixed one, shows what Node.js 24 still lists, and puts a store of 3DES records through retirement, working out which key bundle goes first.

In this part:

What the standards and your tools still say
A cipher-name audit that fails on the weak list and passes on the fix
Retiring a store of Triple DES records, in order
Guard a Triple DES store while you retire it
- Results of the sample tests

1 diagram · 1 runnable example (JavaScript) · 1 exercise with sample tests · about 7 minutes

Opening this part with your pass…Pro part. It opens with the same pass as the part above.

Practise

Check yourself on the first three ideas, one question at a time, with every answer explained:

Interview questions

Fresher to mid · Warm-up

What is a meet-in-the-middle attack, and why is double DES not used?

Double encryption applies a cipher twice under two independent keys, C = E(K2, E(K1, P)), and looks as if it doubles the key length. A meet-in-the-middle attack needs one known plaintext and its ciphertext. It encrypts the plaintext under every possible K1 and stores the results, decrypts the ciphertext under every possible K2, and looks for a match, because the middle value is the same on both sides for the true keys. For k-bit keys that costs about 2^k work and 2^k storage instead of 2^(2k), so two 56-bit DES keys are worth about 57 bits, not 112. On the lesson's toy cipher with 16-bit keys the search took 131,072 cipher calls where trying every pair takes up to 8.6 billion. This is why DES moved to three stages, whose three-key form costs about 2^112.
Mid to senior

A design document for a new file format says: encrypt every file twice with AES-128, under key A and then under key B, for "256-bit security". Review the claim. What is the real strength, what does the design cost, and what do you propose instead?

Model answer, Pro. Model answers open with any pass; prices are in the notice on this page. First step and follow-ups
Mid to senior

A scan of a partner integration finds a 24-byte Triple DES key whose first 16 bytes are one 8-byte value twice, followed by 8 different bytes. What does the configuration really compute, how do you check for it in your own code, and what do you do next?

Model answer, Pro. First step and follow-ups
Mid to staff

A nightly job encrypts 40 GiB of backups with Triple DES in CBC mode under one long-lived key. A report cites the Sweet32 research. Put numbers on the risk, say what is exposed, and propose the fix and the order of the migration.

Model answer, Pro. First step and follow-ups

Flashcards · 6 cards

Recall it, then check

Say the answer to yourself before you look: recalling it is what makes it stick.

What does double encryption under two independent keys buy, and how is it attacked?

About one bit. With one known plaintext P and its ciphertext C, the middle value M = E(K1, P) = D(K2, C) lets an attacker search each half alone and compare the two lists: a meet-in-the-middle attack costing about 2^k operations and 2^k stored values for a k-bit key. At DES's size that is about 2^57 calls, not 2^112.
How many cipher calls did the lab's meet-in-the-middle search take, and what did it show?

131,072: 65,536 to fill the table and 65,536 to look values up, against up to 8,589,934,592 to try every pair of 16-bit keys. A single 16-bit key falls to at most 65,536 trials, so the second key only doubled the attacker's work: about one bit.
How does Triple DES work, and why is its middle call a decryption?

Three DES calls on each block: encrypt with K1, decrypt with K2, encrypt with K3. With K1 equal to K2 the first two calls cancel and the result is single DES under K3, so 3DES equipment could still talk to old DES systems.
What are the Triple DES keying options and their status?

Three-key (3TDEA): K1, K2, K3 all different, 168 key bits, 112 bits of strength, disallowed after 2023. Two-key (2TDEA): K3 = K1, 112 key bits, up to 80 bits, disallowed. K1 = K2, K2 = K3 or all equal: single DES in disguise, 56 bits, not a valid key bundle (SP 800-67). OpenSSL computes the invalid bundles without complaint.
Why does a 64-bit block limit the data under one key, whatever the key length?

Among n random blocks the chance that two are equal is about n² ÷ 2^65, near one half at n = 2^32 blocks: 32 GiB for DES and 3DES, against 2^64 blocks (256 EiB) for AES's 128-bit block. In CBC two equal ciphertext blocks reveal the XOR of two plaintext blocks, which Sweet32 (2016) turned into a practical attack on long-lived 3DES connections.
What limit does NIST put on one Triple DES key bundle?

At most 2^20 blocks, 8 MiB, down from 2^32 in the 2012 edition of SP 800-67. A 64-bit block retires a cipher even when its key is long enough to survive any search.

Key takeaways

Encrypting twice under two independent keys adds about one bit: the lab search needed 131,072 cipher calls where trying every pair takes up to 8,589,934,592.
3DES encrypts, decrypts, then encrypts: three different keys give 112 bits, two-key use at most 80, and a bundle with K1 = K2 or K2 = K3 computes single DES.
A 64-bit block repeats a ciphertext block after about 2³² blocks, 32 GiB, and NIST caps one 3DES key bundle at 2²⁰ blocks, 8 MiB.

Terms in this lesson

key bundle: The three DES keys that Triple DES uses together, K1, K2 and K3, written as 24 bytes. It is three-key (3TDEA) when all three differ, and NIST says a bundle shall not consist of three identical keys.
meet-in-the-middle attack: An attack on double or triple encryption that encrypts forwards from a known plaintext and decrypts backwards from its ciphertext, then matches the middle values. Two independent k-bit keys cost about 2^k work and storage, not 2^(2k).
Triple DES (3DES, TDEA): DES applied three times to each block: encrypt with K1, decrypt with K2, encrypt with K3. Three different keys give 112 bits of strength and two-key use at most 80. NIST disallows it for encryption after 2023 and allows decrypting old data.

References

Handbook of Applied Cryptography, chapter 7: Block Ciphers (Definition 7.32, Facts 7.33, 7.35, 7.39 and 7.40, Notes 7.37 and 7.38) (CRC Press (authors' copy, University of Waterloo))
EFF DES Cracker Machine Brings Honesty to Crypto Debate (Electronic Frontier Foundation)
SP 800-67 Rev. 2: Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher (withdrawn; sections 3.1 and 3.4) (National Institute of Standards and Technology (NIST))
NIST to Withdraw SP 800-67 Rev. 2 (National Institute of Standards and Technology (NIST))
SP 800-131A Rev. 2: Transitioning the Use of Cryptographic Algorithms and Key Lengths (section 2) (National Institute of Standards and Technology (NIST))
Cryptographic Standards and Guidelines: Examples with Intermediate Values (TDES_Core) (National Institute of Standards and Technology (NIST))
Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN (Karthikeyan Bhargavan and Gaëtan Leurent (Inria))
OWASP Application Security Verification Standard 5.0, Appendix C: Cryptography Standards (OWASP Foundation)
OWASP Application Security Verification Standard 5.0, V11 Cryptography (requirements 11.1.2, 11.2.2 and 11.3.2) (OWASP Foundation)
OWASP Cryptographic Storage Cheat Sheet (cipher modes and usage limits) (OWASP Foundation)
Node.js 24 documentation: Crypto (crypto.getCiphers, createCipheriv) (OpenJS Foundation (Node.js))
pyca/cryptography documentation: Symmetric encryption (TripleDES, OFB, CFB) (Python Cryptographic Authority)
MIT Kerberos documentation: krb5.conf (allow_des3 and allow_rc4) (Massachusetts Institute of Technology)
RFC 8429: Deprecate Triple-DES (3DES) and RC4 in Kerberos (Internet Engineering Task Force (IETF))

Report a problem with this lesson

In this module: Inside DES, 3DES and AES

Feistel networks and a worked DES example Free: 35 minutes
Multiple encryption, 3DES and 64-bit block limits Free core, Pro depth: 10 of 30 minutes free
AES rounds and key expansion, step by step Free intro, Pro: 6 of 35 minutes free
CBC-MAC, CMAC and hashes built from block ciphers Free intro, Pro: 6 of 35 minutes free

Your country

Multiple encryption, 3DES and 64-bit block limits

What you will learn

Before you start

What you will learn

Before you start

Encrypting twice with two keys adds about one bit

Triple DES encrypts, decrypts, then encrypts again

A 64-bit block limits the data under one key, whatever the key length

The meet-in-the-middle search, measured, and why three keys Pro: opens with a Pro, Premium or Ultimate pass

The birthday numbers for 64- and 128-bit blocks, the CBC leak and NIST's limit Pro: opens with a Pro, Premium or Ultimate pass

Finding Triple DES in your own code, and retiring it Pro: opens with a Pro, Premium or Ultimate pass

Practise

Interview questions

What is a meet-in-the-middle attack, and why is double DES not used?

A design document for a new file format says: encrypt every file twice with AES-128, under key A and then under key B, for "256-bit security". Review the claim. What is the real strength, what does the design cost, and what do you propose instead?

A scan of a partner integration finds a 24-byte Triple DES key whose first 16 bytes are one 8-byte value twice, followed by 8 different bytes. What does the configuration really compute, how do you check for it in your own code, and what do you do next?

A nightly job encrypts 40 GiB of backups with Triple DES in CBC mode under one long-lived key. A report cites the Sweet32 research. Put numbers on the risk, say what is exposed, and propose the fix and the order of the migration.

Key takeaways

References

Related tools