🚀 go-pugleaf

>1.  My understanding is that "Triple DES" is encryption using one
>    key, decryption using another, then re-encryption using the
>    first key.  Is this correct?  i.e., E3(P,K) = E(D(E(P,K1),K2),K1)

No.  You got the message but missed some of the meaning.

That is what IBM does.  It is only double DES.  That is, you
still have only a 112 bit key even though you have triple complexity.
The purpose of this implementation was to preserve compatibility
between this hardware implementation and earlier software implementation.
This implementation has the special property that if the second half
of the 112 bit is equal to the first, then steps one and two cancel
each other.  That is why the second step is a decrypt; it adds just
as much complexity as an encrypt while having this special case.

Note that this is a hardware implementation using three chips in series.
While it double the effective key length, it adds only two block times
to the operation, regardless of how long the message (for reasons of
export control, IBM uses this implementation only for protecting the
key table, i.e., 64 bit blocks.)  If you were to implement the same
mechanism in software, you would triple the message encrypt time.
If you were not trying to solve the special problem of backward 
compatibility, you would likely use two encrypt steps.  This would 
give the same protection and only double the time.

I have heard Martin Hellman recommend three steps using a 168 bit key.
However, my own assessment is that this is overkill for most 
applications.


>2.  Has triple DES actually been proven to be stronger than a single
>    DES encryption?  I guess this boils down to whether DES has been
>    proven to be a group.

No.  The inventors assert that DES is composable under most circumstances.
(See Matyas and Meyers).  However, the independent evaluators are
silent.  IBM notes in passing that an exhaustive attack against a
112 bit would require all of the energy from all of the coal and oil
likely to recovered in the continental US for the next five hundred
years. 

William Hugh Murray, Executive Consultant, Information System Security
49 Locust Avenue, Suite 104; New Canaan, Connecticut 06840                
1-0-ATT-0-700-WMURRAY; WHMurray at DOCKMASTER.NCSC.MIL