Triple DES Encrypt / Decrypt

What is Triple DES (3DES) encryption?

Triple DES survives in one industry longer than anywhere else: payments. EMV chip cards, the DUKPT key-per-transaction scheme used by point-of-sale terminals, the ANSI X9.17 key management standard, and ATM PIN-block encryption were all built on it, and replacing the cipher means replacing hardware in millions of terminals — a migration measured in years rather than releases.

The construction is DES applied three times per block under two or three independent keys (2TDEA and 3TDEA), giving 112 or 168 nominal key bits. It was the fastest available answer when DES became indefensible in the 1990s, because it reused already-deployed DES implementations instead of requiring a new cipher. NIST deprecated it in 2023; this tool exists for the installed base.

Sweet32, published in 2016, is the reason it cannot simply be left alone. The weakness is not in the key but in the block: 64 bits means a birthday collision becomes likely after roughly 2^32 blocks, about 32 GB under a single key, and collisions in CBC mode leak the XOR of two plaintext blocks. The researchers demonstrated recovery of an HTTP session cookie from a long-lived HTTPS connection negotiated with a 3DES suite. TLS 1.3 dropped the cipher entirely, and browsers followed.

Migration is a performance win as much as a security one. Three DES passes cannot use the AES-NI instructions present on every modern processor, so 3DES runs several times slower than AES in software and cannot be hardware-accelerated at all. The 168-bit key of 3TDEA is worth only about 112 bits against meet-in-the-middle attacks, which is below AES-128. AES-256 is the replacement NIST names in SP 800-131A Rev. 2, and our encryption algorithms guide compares the families in more detail.

Frequently asked questions