Date: Fri, 16 Jul 93 05:40:25 EDT
Message-Id: <9307160940(_dot_)AA17249(_at_)tsx-11(_dot_)MIT(_dot_)EDU>
Subject: Re: PEM WG Meeting Minutes
[re. triple DES]
Given that the traditional EDE mode is the only one
which has been discussed extensively in the literature, it seems to make
people feel better about its security, more than other variants.
I have seen this tendency in the mail to this mailing list.
However, there is a logic flaw here -- that lack of discussion is the same
as proof of less security.
I believe it is trivial to prove that if three-loop CBC is less secure than
one-loop EDE-CBC, then you have found a weakness in DES itself. However, I
have no time in my schedule to do this -- and the people who wait for
recognized experts to prove security won't trust what I say anyway.
Fortunately, RSA is preparing an analysis of this, if I read the minutes
correctly.
- Carl