Steve Crocker said:
Perhaps there can be a discussion of Triple DES.
If this does come up: At the Amsterdam IETF, Dave Balenson and I took an
action to write up the triple-DES modes as an internet-draft.
I must apologise that I haven't done this yet. (I've been extremely tied up
with some other activities over the last month or so...) I do still intend
to do this, within a reasonable time-scale (definitely before end December).
Phil Zimmerman writes:
I asked Eli Biham at Crypto93 about this. Eli said that single-loop CBC
is stronger for triple-DES, as compared to the three-loop model. ...
He plans on presenting a paper on his findings in December at a conference.
I can confirm that this paper does indeed exist. It will appear in the
proceedings of the Cambridge Workshop on Cryptographic Algorithms. As this
isn't published yet, I'd better not say anything more about it.
Given this, it may be best to reserve judgment on the three-loop mode until
then. (Unless the three-loop mode can be eliminated on other considerations,
which is always a possibility).
Mike