3 ms·

You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP i

by jingo 13y ago

You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP idea. I guess I'm not communicating clearly enough. What I mean is the computer ("phone") itself, of which the smart card subsystem (e.g. SIM card system) is a part, is of inferior quality. This is only my opinion. I understand there are barriers to entry in place. But how does that relate to low quality, minimally viable products? I'll let you or someone else answer that. Maybe we need to remove the barriers, lower the cost of entry and lower the complexity (simplify)? No, those sound like ignoble pursuits.

rdl 13y ago
Not recommended for new systems: Mostly because it's slow (vs. AES), and 3DES is effectively 112 bits, which is a bit weaker than you'd want for a new system deployed today (which might be in service for...20-30 years?) I don't know of any attacks on DES better than brute force and on 3DES better than brute force w/ meet-in-the-middle.
- KMag 13y ago
  The 64-bit block length is more of a problem than the 112-bit key length. For instance, if 3DES were used in OFB mode, one would expect on average to have a unique 64 GB keystream before entering a repeating 32 GB keystream. If the attacker is able to choose the data being encrypted, CFB could have similar limitations. With CBC mode, you'd expect only 32 GB of encrypted data before you got your first self-collision in ciphertext. CTR mode with perfectly random IVs does much better, at 64 exabytes. Even 64 EB isn't as big as it used to be, especially for a key that can't be changed. For many uses, you'd much rather have an ideal block cipher with a 128-bit block and 112-bit keys than an ideal block cipher with a 64-bit block and 512-bit keys.

3 ms·

You're right. DES repeated thrice is better than DES. But I wonder why 3DES is not recommended for new systems? Hmmm.... You're wrong on the SIM as an MVP i

by jingo 13y ago

rdl 13y ago
Not recommended for new systems: Mostly because it's slow (vs. AES), and 3DES is effectively 112 bits, which is a bit weaker than you'd want for a new system deployed today (which might be in service for...20-30 years?) I don't know of any attacks on DES better than brute force and on 3DES better than brute force w/ meet-in-the-middle.
- KMag 13y ago
  The 64-bit block length is more of a problem than the 112-bit key length. For instance, if 3DES were used in OFB mode, one would expect on average to have a unique 64 GB keystream before entering a repeating 32 GB keystream. If the attacker is able to choose the data being encrypted, CFB could have similar limitations. With CBC mode, you'd expect only 32 GB of encrypted data before you got your first self-collision in ciphertext. CTR mode with perfectly random IVs does much better, at 64 exabytes. Even 64 EB isn't as big as it used to be, especially for a key that can't be changed. For many uses, you'd much rather have an ideal block cipher with a 128-bit block and 112-bit keys than an ideal block cipher with a 64-bit block and 512-bit keys.