In recent years, several new attacks on DES were introduced. These att
acks have led researchers to suggest stronger replacements for DES, an
d in particular new modes of operation for DES. The most popular new m
odes are triple DES variants, which are claimed to be as secure as tri
ple DES. To speed up hardware implementations of these modes, and to i
ncrease the avalanche, many suggestions apply several standard modes s
equentially. In this paper we study these multiple (cascade) modes of
operation. This study shows that many multiple modes are much weaker t
han multiple DES, and their strength is theoretically comparable to a
single DES. We conjecture that operation modes should be designed arou
nd an underlying cryptosystem without any attempt to use intermediate
data as feedback, or to mix the feedback into an intermediate round. T
hus, in particular, triple DES used in CBC mode is more secure than th
ree single DESs used in triple CBC mode. Alternatively, if several enc
ryptions are applied to each block, the best choice is to concatenate
them to one long encryption, and build the mode of operation around it
.