3DES (Triple DES, TDEA)
Definition
3DES (Triple DES) is a block cipher that applies DES three times with a 64-bit block size, now treated as legacy in TLS largely because of the Sweet32 attack.
3DES runs the DES cipher three times in encrypt-decrypt-encrypt order with two or three keys, extending DES's 56-bit key. The three-key variant has 168 key bits but only about 112 bits of effective security because of meet-in-the-middle attacks, and the block size remains 64 bits. In TLS it appears in suites such as TLS_RSA_WITH_3DES_EDE_CBC_SHA, which OpenSSL calls DES-CBC3-SHA.
Why it matters
The 64-bit block is the real problem. After about 2^32 blocks (32 GiB) encrypted under one key, block collisions in CBC mode become likely, and each collision leaks the XOR of two plaintext blocks. The Sweet32 research in 2016 showed that this lets an attacker recover HTTP cookies from long-lived HTTPS connections that use 3DES. 3DES is also slow compared with AES-GCM, NIST no longer approves it for encryption, and TLS 1.3 does not include it.
Example
Find and remove 3DES suites:
nmap --script ssl-enum-ciphers -p 443 example.com
nmap's script warns when it finds a 64-bit block cipher. If you maintain an explicit OpenSSL cipher string, make sure it contains no DES-CBC3 suites, or append !3DES.
Common misconceptions
- "3DES has 168-bit security." Meet-in-the-middle attacks reduce it to about 112 bits, and the Sweet32 weakness does not depend on the key length at all.
- "Sweet32 requires breaking the key." It exploits block collisions after large volumes of data, so the attacker never needs the key.
- "3DES must stay for compatibility." Every TLS 1.2 client must implement an AES suite, since TLS_RSA_WITH_AES_128_CBC_SHA is mandatory in RFC 5246, so 3DES is not needed for any client that browsers would still talk to.