# What Is 3DES (Triple DES, TDEA)? Definition and Examples

> 3DES (Triple DES) is a block cipher that applies DES three times with a 64-bit block size, now treated as legacy in TLS largely because of the Sweet32 attack.

Source: https://ssl.sh/glossary/3des/
Last updated: 2026-11-10

3DES runs the DES cipher three times in encrypt-decrypt-encrypt order with two or three keys, extending DES's 56-bit key. The three-key variant has 168 key bits but only about 112 bits of effective security because of meet-in-the-middle attacks, and the block size remains 64 bits. In TLS it appears in suites such as TLS_RSA_WITH_3DES_EDE_CBC_SHA, which OpenSSL calls DES-CBC3-SHA.

## Why it matters
The 64-bit block is the real problem. After about 2^32 blocks (32 GiB) encrypted under one key, block collisions in CBC mode become likely, and each collision leaks the XOR of two plaintext blocks. The [Sweet32](https://ssl.sh/glossary/sweet32/) research in 2016 showed that this lets an attacker recover HTTP cookies from long-lived HTTPS connections that use 3DES. 3DES is also slow compared with [AES-GCM](https://ssl.sh/glossary/aes-gcm/), NIST no longer approves it for encryption, and [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) does not include it.

## Example
Find and remove 3DES suites:

```bash
nmap --script ssl-enum-ciphers -p 443 example.com
```

nmap's script warns when it finds a 64-bit block cipher. If you maintain an explicit OpenSSL cipher string, make sure it contains no DES-CBC3 suites, or append `!3DES`.

## Common misconceptions
- **"3DES has 168-bit security."** Meet-in-the-middle attacks reduce it to about 112 bits, and the Sweet32 weakness does not depend on the key length at all.
- **"Sweet32 requires breaking the key."** It exploits block collisions after large volumes of data, so the attacker never needs the key.
- **"3DES must stay for compatibility."** Every TLS 1.2 client must implement an AES suite, since TLS_RSA_WITH_AES_128_CBC_SHA is mandatory in RFC 5246, so 3DES is not needed for any client that browsers would still talk to.

## Related terms

- [Sweet32](https://ssl.sh/zh/glossary/sweet32/): Sweet32 是 2016 年公布的生日攻击（CVE-2016-2183），针对 3DES 等 64 位分组密码的 CBC 模式，可从超长连接中还原 Cookie 等秘密。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [AES-GCM](https://ssl.sh/zh/glossary/aes-gcm/): AES-GCM 是以伽罗瓦/计数器模式运行的 AES 分组密码，属于 AEAD 算法，用计数器模式加密、用 GHASH 认证标签保证完整性。
- [RC4](https://ssl.sh/zh/glossary/rc4/): RC4 是 Ron Rivest 在 1987 年设计的流密码，曾在 SSL/TLS 中广泛使用，因密钥流存在统计偏差，2015 年被 RFC 7465 禁止用于 TLS。
- [TLS 1.0](https://ssl.sh/zh/glossary/tls-1-0/): TLS 1.0 是传输层安全协议的第一个版本，1999 年以 RFC 2246 发布，2021 年被 RFC 8996 正式废弃，主流浏览器已不再支持。
- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。