3DES

What Is 3DES?

Triple Data Encryption Standard (3DES3DESCryptographyLegacy triple-DES symmetric cipher in payment smart cards.Click to view →, also known as TDEA or DES-EDE) is a symmetric cipher that applies the DES algorithm three times in succession with two or three independent keys, providing 112 or 168 bits of effective security. 3DES was the primary symmetric encryption algorithm in smart card systems from the 1990s through the mid-2010s, securing EMV payment transactions, SIM card authentication, and GlobalPlatform secure channels.

While 3DES is being phased out in favor of AES, it remains embedded in billions of deployed cards and legacy terminal infrastructure.

How 3DES Works

3DES processes 64-bit data blocks through three DES passes:

The Encrypt-Decrypt-Encrypt (EDE) sequence ensures backward compatibility with single DES when all three keys are identical (Keying Option 3), though this option provides no additional security and is not used in practice.

3DES in Smart Card Protocols

Why 3DES Is Being Retired

Several factors drive the migration from 3DES to AESAESCryptographyNIST symmetric block cipher for smart card encryption.Click to view →:

• Performance -- 3DES requires three DES passes per block, making it roughly 3x slower than AES-128 in both hardware and software.
• Block size -- 3DES operates on 64-bit blocks, making it vulnerable to birthday attacks (Sweet32) after 2^32 blocks (~32 GB) of data under the same key.
• NIST deprecation -- NIST SP 800-131A deprecated 3DES two-key (112-bit) after 2023 and plans to disallow all 3DES by 2025.
• Crypto coprocessor -- modern smart card chips allocate more silicon to AES accelerators than to legacy DES engines.

Migration Timeline

The transition is well underway but not complete:

• SCP03 replaced SCP02 as the default GlobalPlatform secure channel, using AES.
• MIFARE DESFire EV3 supports AES-only mode.
• EMVEMVApplicationGlobal chip payment card standard.Click to view → contactless kernels increasingly default to AES session keys.
• ePassport PACEPACEApplicationStrong ePassport authentication protocol.Click to view → uses AES, replacing BACBACApplicationePassport security using MRZ data.Click to view →'s 3DES-based key derivation.

Legacy EMV contact cards and deployed SIMSIMApplicationSmart card for mobile network authentication.Click to view → populations will continue using 3DES until natural card replacement cycles complete, likely through 2030.