DES-3DES Weak Keys

Updated 13 Sep 2026

• •

  What it is

  • •

    DES has a small published set of "weak" and "semi-weak" keys for which the encryption function becomes an involution — encrypting twice with the same weak key returns the original plaintext, $E_K(E_K(P)) = P$. Triple DES (which normally chains 2 or 3 independent DES keys) can be forced to inherit this weakness by supplying two distinct weak single-DES keys as its sub-keys, which also bypasses library checks that reject a 3DES key degenerating into single DES.

• •

  When to apply

  • •

    An oracle lets you choose the DES/3DES key yourself before it encrypts a secret — supplying a known weak key turns "encrypt" into its own inverse, letting you decrypt by encrypting again.

• •

  Math

  • •

    For a weak key $K$: $E_K \circ E_K = \text{id}$ (the identity function).

• •

  Worked example

  • •

    Weak 3DES key 0101010101010101FEFEFEFEFEFEFEFE (two published single-DES weak keys concatenated): encrypting b"ABCDEFGH" and then encrypting the result with the same key returned b"ABCDEFGH" again exactly — confirming the involution property in practice.

• •

  Python

  • •

    weak_key = bytes.fromhex("0101010101010101FEFEFEFEFEFEFEFE")
    ciphertext = encrypt_oracle(weak_key, flag_plaintext)
    recovered = encrypt_oracle(weak_key, ciphertext)   # encrypting again decrypts it
    

• •

  Related

• •

  Cards

  • •

    What property do DES's weak keys give the encryption function?

    • •

      $E_K(E_K(P)) = P$ — encrypting twice with the same weak key returns the original plaintext.

  • •

    How do you build a "weak" 3DES key from single-DES weak keys?

    • •

      Concatenate two distinct published single-DES weak keys — this also avoids library checks that block a 3DES key collapsing to single DES.

◌ Explore connections in Graph view