DocID018909 Rev 11
715/1731
RM0090
Cryptographic processor (CRYP)
757
The TDES allows three different keying options:
•
Three independent keys
The first option specifies that all the keys are independent, that is, K1, K2 and K3 are
independent. FIPS PUB 46-3 – 1999 (and ANSI X9.52 – 1998) refers to this option as
the Keying Option 1 and, to the TDES as 3-key TDES.
•
Two independent keys
The second option specifies that K1 and K2 are independent and K3 is equal to K1,
that is, K1 and K2 are independent, K3 = K1. FIPS PUB 46-3 – 1999 (and ANSI X9.52
– 1998) refers to this second option as the Keying Option 2 and, to the TDES as 2-key
TDES.
•
Three equal keys
The third option specifies that K1, K2 and K3 are equal, that is, K1 = K2 = K3. FIPS
PUB 46-3 – 1999 (and ANSI X9.52 – 1998) refers to the third option as the Keying
Option 3. This “1-key” TDES is equivalent to single DES.
FIPS PUB 46-3 – 1999 (and ANSI X9.52-1998) provides a thorough explanation of the
processing involved in the four operation modes supplied by the TDEA (TDES algorithm):
TDES-ECB encryption, TDES-ECB decryption, TDES-CBC encryption and TDES-CBC
decryption.
This reference manual only gives a brief explanation of each mode.
DES and TDES Electronic codebook (DES/TDES-ECB) mode
•
DES/TDES-ECB mode encryption
illustrates the encryption in DES and TDES Electronic codebook
(DES/TDES-ECB) mode. A 64-bit plaintext data block (P) is used after bit/byte/half-
word swapping (refer to
Section 23.3.3: Data type on page 730
) as the input block (I).
The input block is processed through the DEA in the encrypt state using K1. The output
of this process is fed back directly to the input of the DEA where the DES is performed
in the decrypt state using K2. The output of this process is fed back directly to the input
of the DEA where the DES is performed in the encrypt state using K3. The resultant 64-
bit output block (O) is used, after bit/byte/half-word swapping, as ciphertext (C) and it is
pushed into the OUT FIFO.
•
DES/TDES-ECB mode decryption
illustrates the DES/TDES-ECB decryption. A 64-bit ciphertext block (C) is
used, after bit/byte/half-word swapping, as the input block (I). The keying sequence is
reversed compared to that used in the encryption process. The input block is
processed through the DEA in the decrypt state using K3. The output of this process is
fed back directly to the input of the DEA where the DES is performed in the encrypt
state using K2. The new result is directly fed to the input of the DEA where the DES is
performed in the decrypt state using K1. The resultant 64-bit output block (O), after
bit/byte/half-word swapping, produces the plaintext (P).