Skip to content

Retired ciphers

DES, 3DES, the 64-bit block ciphers and RC4: what each one was, what broke it, and where it still turns up. Keep them only to read old data.

Status and standards: see Symmetric ciphers in the main table.

A cipher retires when its key can be searched (DES) or its design leaks whatever the key size (RC4's biases, 64-bit blocks hitting the birthday bound). For new work use AES-GCM or ChaCha20-Poly1305.

DES

What it was. IBM's design, published by the US National Bureau of Standards as FIPS 46 in January 1977: 16 Feistel rounds, a 64-bit block and a 56-bit key.

What broke it. The key. In July 1998 the EFF's DES Cracker ("Deep Crack"), built for under $250,000, found a challenge key in less than three days. In January 1999, with about 100,000 PCs on distributed.net, it took 22 hours 15 minutes, and by 2008 hardware under $15,000 averaged less than a day (RFC 6649). Differential (Biham and Shamir) and linear (Matsui) cryptanalysis need 2⁴⁷ chosen or 2⁴³ known plaintexts, so brute force was the real threat. NIST withdrew FIPS 46-3 on May 19, 2005.

Where you still see it. Inside 3DES, and in old 13-character Unix crypt(3) password hashes. Kerberos dropped it with RFC 6649 (2012).

3DES

What it was. DES three times, encrypt-decrypt-encrypt (EDE) with three keys: 168 key bits, but meet-in-the-middle cuts the strength to 112. With all three keys equal it is single DES, which eased the move from DES hardware. It is in ANSI X9.52 (1998), FIPS 46-3 (1999) and NIST SP 800-67 (2004).

What broke it. Not the key but the 64-bit block. Sweet32 (Bhargavan and Leurent, CCS 2016) recovered a secure HTTPS cookie from a long-lived 3DES connection after capturing about 785 GB of traffic, in under two days. NIST cut use to 2²⁰ blocks (8 MB) per key in 2017, and SP 800-131A Rev. 2 (2019) disallowed 3DES encryption after December 31, 2023. SP 800-67 was withdrawn on January 1, 2024. Decrypting old data is still allowed.

Where you still see it. Old TLS servers (TLS 1.3 has no 3DES), old OpenPGP messages (RFC 9580: MUST NOT encrypt with it), Kerberos realms that RFC 8429 (2018) asked to move off it, and legacy PKCS#12 files, which encrypt the private key with 3DES.

64-bit block ciphers

Blowfish, IDEA, CAST5 and RC2 have no practical attack on the full cipher at normal key sizes. What retires them is the block. After about 2³² blocks (32 GB) under one key, two ciphertext blocks are likely to collide, and in CBC mode a collision reveals the XOR of two plaintext blocks. Sweet32 did it in practice against Blowfish in OpenVPN as well as 3DES in TLS. OpenSSL 3.0 moved all four, and single DES, to its legacy provider.

Blowfish

What it was. Bruce Schneier's free, unpatented replacement for DES (1993): 16 Feistel rounds, key-dependent S-boxes, keys of 32 to 448 bits. OpenVPN used it by default until 2.5 (2020), and OpenSSH removed blowfish-cbc in 7.6 (2017).

Where you still see it. In bcrypt, which uses its slow key setup as a password hash, where the block size doesn't matter.

IDEA

What it was. Xuejia Lai and James Massey's cipher (1991): a 128-bit key, 8.5 rounds that mix XOR, addition mod 2¹⁶ and multiplication mod 2¹⁶ + 1. It was the cipher of PGP 2. The best attack on all 8.5 rounds, a biclique attack from 2012, is barely faster than brute force at about 2¹²⁶.

Where you still see it. Old PGP messages. RFC 9580 lets implementations decrypt IDEA, with a warning, but never encrypt with it.

CAST5

What it was. Carlisle Adams's CAST-128, RFC 2144 (1997): 12 or 16 rounds, keys of 40 to 128 bits. GnuPG made it the default cipher in 2002 and dropped it from the default preferences in 2.1 (2014). OpenSSH removed cast128-cbc in 7.6.

Where you still see it. Old OpenPGP data, which RFC 9580 treats like IDEA.

RC2

What it was. Ron Rivest's cipher, an RSA Data Security trade secret until RFC 2268 (1998). Keys are 1 to 128 bytes, cut down by an "effective key bits" setting. The US approved RC2 at short key sizes for easier export, so S/MIME v2 (RFC 2311, 1998) made 40-bit RC2 the one cipher every receiver had to support.

Where you still see it. Old .p12 / .pfx files, which often encrypt the certificates with 40-bit RC2. OpenSSL 3.0 writes AES-256-CBC by default and needs -legacy to read them.

RC4

What it was. Rivest's 1987 stream cipher, a trade secret until its source was posted anonymously to the cypherpunks list in September 1994. The key shuffles a 256-byte permutation; after that each output byte costs one swap. It was small and fast, so it went everywhere: SSL and TLS, WEP and WPA-TKIP Wi-Fi, SSH (arcfour), and Windows Kerberos (RC4-HMAC, RFC 4757).

What broke it. Biased output, worst at the start of the stream.

  • Mantin and Shamir (FSE 2001): the second byte is 0 twice as often as it should be.
  • Fluhrer, Mantin and Shamir (SAC 2001): with related keys, the first bytes leak key bytes. WEP built each packet key from a public IV plus the secret key, so it fell to this.
  • AlFardan et al. (USENIX Security 2013) used the biases in the first 256 bytes to recover plaintext repeated over many TLS connections. Vanhoef and Piessens (2015) got an HTTPS cookie in 75 hours.

Retired by RFC 7465 (2015) for TLS, RFC 8429 (2018) for Kerberos and RFC 8758 (2020) for SSH. OpenBSD's arc4random dropped it for ChaCha20 in 2014.

Where you still see it. Active Directory kept RC4-HMAC as a Kerberos fallback for compatibility. In December 2025 Microsoft said domain controllers would switch to AES-only defaults by mid-2026.

The cipher fits in a few lines. This checks it against RFC 6229, then counts how often the second byte is 0 over 100,000 keys (the fixed seed makes the counts repeat).

import random

def rc4(key, n):
    S, j = list(range(256)), 0
    for i in range(256):                  # key schedule: shuffle S with the key
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    i = j = 0
    out = []
    for _ in range(n):                    # keystream: one swap, one byte out
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        out.append(S[(S[i] + S[j]) % 256])
    return bytes(out)

print(rc4(bytes([1, 2, 3, 4, 5]), 8).hex())   # b2396305f03dc027, as in RFC 6229

random.seed(1)
N = 100000
zeros = sum(rc4(random.randbytes(16), 2)[1] == 0 for _ in range(N))
print(zeros, round(N / 256))              # 822 391: about twice what a fair byte gives

See also

References

Weaker sources: EFF's DES Cracker page and press releases (1998, 1999) for the cost and timings; the cypherpunks list (September 1994) for the RC4 leak; heise, "Microsoft Sweeps RC4 Remnants from Kerberos" (December 2025) for the Active Directory plan; the 1987 date for RC4 is from secondary accounts.