DES vs 3DES vs AES — Smart Card Encryption Algorithms Compared

Three symmetric block ciphers have dominated smart card and payment system encryption for decades: DES (1977), 3DES (Triple DES, 1998), and AES (2001). DES is broken. 3DES is being sunset. AES is the modern standard. Yet in the smart card world, all three coexist — because billions of EMV cards still use 3DES, and migration to AES is slow. This guide explains the technical differences, where each is used, and which to choose for new systems.

Specs at a Glance

1. DES (Data Encryption Standard) — The Pioneer

DES was adopted as a US federal standard in 1977. It uses a 56-bit key (stored in 8 bytes, with 1 parity bit per byte) and a 64-bit block size, processing data through 16 rounds of Feistel network operations.

The problem: 56 bits is only 2^56 ≈ 7.2 × 10^16 possible keys. In 1998, the EFF built a DES cracker for $250,000 that brute-forced a key in 56 hours. Today, cloud computing can do it in hours for a few dollars. DES is categorically broken and must not be used for new systems.

2. 3DES (Triple DES) — The Workaround

3DES applies the DES algorithm three times with two or three different keys, using an encrypt-decrypt-encrypt (EDE) construction:

3DES Encrypt:  C = E_K3(D_K2(E_K1(P)))
3DES Decrypt:  P = D_K1(E_K2(D_K3(C)))

Where E = DES encrypt, D = DES decrypt, K1/K2/K3 = DES keys

Keying options:
  Option 1 (3TDEA): K1 ≠ K2 ≠ K3  →  168-bit key (effective ~112 bits)
  Option 2 (2TDEA): K1 = K3, K1 ≠ K2  →  112-bit key (effective ~80 bits)
  Option 3 (backward-compat): K1 = K2 = K3  →  equivalent to single DES

In smart cards, Option 2 (2TDEA, 16-byte key) is the most common. This is what EMV SCP02 uses for session key derivation and MAC computation. The effective security is ~80 bits (due to meet-in-the-middle attacks), which is below the 112-bit target.

Why 3DES Is Being Sunset

NIST SP 800-131A disallowed 3DES for new applications after 2023 and will disallow it for all applications by 2025-2030. The Sweet32 attack (2016) showed that 3DES's 64-bit block size is vulnerable to birthday attacks when encrypting large amounts of data (>32 GB with the same key). For payment systems processing millions of transactions, this is a real concern.

3. AES (Advanced Encryption Standard) — The Modern Standard

AES was selected by NIST in 2001 after a 4-year public competition. It uses a 128-bit block size and supports key sizes of 128, 192, or 256 bits. Unlike DES's Feistel network, AES uses a substitution-permutation network (SPN) with 10, 12, or 14 rounds depending on key size.

AES is the default for:

• GlobalPlatform SCP03 — AES-128-CBC and AES-CMAC for secure channel
• FIDO2 / CTAP2 — AES-256 for resident key encryption
• EMV (new cards) — AES-128 for contactless and some contact cards
• Calypso / CIPURSE — AES-128 for transit payment cards
• Java Card 3.x — AES is natively supported in the API

4. Security Comparison

Key Space

5. Performance Comparison

6. Smart Card Usage: Which Algorithm Where?

7. When to Use Each (2026 Guidelines)

8. Migration Path: 3DES → AES

If you're maintaining a system that still uses 3DES, here's the migration path:

Key Diversification Migration

When migrating from SCP02 (3DES) to SCP03 (AES), the key diversification changes:

// SCP02 (3DES) key diversification
card_key = 3DES_CBC(master_key, diversification_data)
// 16-byte 2TDEA key derived from master

// SCP03 (AES) key diversification
card_key = AES_CMAC(master_key, diversification_data)
// 16-byte AES-128 key derived from master
// Different algorithm, different S-MAC/S-ENC/S-DEK derivation

9. Code Examples

Python: AES-128-CBC Encryption

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding
import os

# AES-128-CBC encryption (recommended for new systems)
key = os.urandom(16)  # 128-bit key
iv = os.urandom(16)   # random IV

cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
encryptor = cipher.encryptor()

padder = padding.PKCS7(128).padder()
plaintext = b"EMV transaction data"
padded = padder.update(plaintext) + padder.finalize()

ciphertext = encryptor.update(padded) + encryptor.finalize()
print(f"Ciphertext: {ciphertext.hex()}")

JavaScript: AES-256-GCM with Web Crypto API

// AES-256-GCM authenticated encryption (in-browser)
async function aesEncrypt(plaintext, key256) {
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const key = await crypto.subtle.importKey(
        'raw', key256, { name: 'AES-GCM' }, false, ['encrypt']
    );
    const ciphertext = await crypto.subtle.encrypt(
        { name: 'AES-GCM', iv },
        key,
        new TextEncoder().encode(plaintext)
    );
    return { iv, ciphertext: new Uint8Array(ciphertext) };
}

Python: 3DES-CBC (for legacy EMV compatibility)

from Crypto.Cipher import DES3
from Crypto.Util.Padding import pad
import os

# 3DES-CBC encryption (legacy only - migrating to AES)
key = os.urandom(16)  # 16 bytes = 2TDEA (K1=K3)
iv = os.urandom(8)    # 64-bit IV for DES block size

cipher = DES3.new(key, DES3.MODE_CBC, iv=iv)
plaintext = b"Legacy EMV data"
ciphertext = cipher.encrypt(pad(plaintext, 8))
print(f"Ciphertext: {ciphertext.hex()}")

10. Summary — Which to Choose?