The reason 3DES is avoided is because it is significantly slower than AES and usually leads to generally poorer performance. Security-wise, it's fine to use if you're willing to make these performance tradeoffs (eg, you might want it for backwards compatibility with some ancient DES-friendly system).
The fact that 3DES is slower is actually an advantage if you are trying to prevent against brute-force attacks. Given that we are encrypting binary data, it's unlikely that knowledge of the plaintext (for example, knowing that it's probably US-ASCII and so the 8th bit is probably always zero) is not going to be available to the attacker. Other potential attacks, such as related plaintext attacks, will also not be available to the attacker. Given that brute force attacks are the most likely threat scenario, using a 3DES which is slower is a reasonable choice.
Double-negative in your second sentence, and I think it's not what you meant. I wouldn't be so pedantic, except that crypto is worth being pedantic about.
Thanks for the replies. I'm certainly no expert on this stuff. A few years ago, I implemented DES as a learning exercise [1]. I recall reading something at the time about security concerns with DES. That was several years ago, so I'm probably mis-remembering. Wikipedia vaguely refers to concerns about security being a motivation for AES, but doesn't explain what those concerns were [2].
Key and block size were the concerns. Key size specifically. Cryptographically speaking, DES has been incredibly good and resisted pretty much all attacks but the key size has made brute force feasible.
Comments
The reason 3DES is avoided is because it is significantly slower than AES and usually leads to generally poorer performance. Security-wise, it's fine to use if you're willing to make these performance tradeoffs (eg, you might want it for backwards compatibility with some ancient DES-friendly system).
The fact that 3DES is slower is actually an advantage if you are trying to prevent against brute-force attacks. Given that we are encrypting binary data, it's unlikely that knowledge of the plaintext (for example, knowing that it's probably US-ASCII and so the 8th bit is probably always zero) is not going to be available to the attacker. Other potential attacks, such as related plaintext attacks, will also not be available to the attacker. Given that brute force attacks are the most likely threat scenario, using a 3DES which is slower is a reasonable choice.
Double-negative in your second sentence, and I think it's not what you meant. I wouldn't be so pedantic, except that crypto is worth being pedantic about.
Thanks for the replies. I'm certainly no expert on this stuff. A few years ago, I implemented DES as a learning exercise [1]. I recall reading something at the time about security concerns with DES. That was several years ago, so I'm probably mis-remembering. Wikipedia vaguely refers to concerns about security being a motivation for AES, but doesn't explain what those concerns were [2].
[1] https://github.com/dcuddeback/des_crack
[2] https://en.wikipedia.org/wiki/Data_Encryption_Standard#Repla...
Key and block size were the concerns. Key size specifically. Cryptographically speaking, DES has been incredibly good and resisted pretty much all attacks but the key size has made brute force feasible.