DES / 3DES / AES calculator

Notes

Which key lengths go with which cipher?

DES takes an 8-byte key. 3DES takes 16 bytes (two-key, where K3 = K1) or 24 bytes (three-key), applied as encrypt-decrypt-encrypt. AES takes 16, 24 or 32 bytes for AES-128, 192 or 256. Keys and data are entered as hex, so an 8-byte DES key is 16 hex characters.

What is the KCV and why three bytes?

The key check value encrypts an all-zero block under the key and keeps the leading bytes — a fingerprint you can compare to confirm two systems hold the same key without revealing it. Three bytes is the near-universal convention on HSMs and key-ceremony forms, so that is what is shown.

What is the difference between CBC-MAC and the Retail MAC?

CBC-MAC chains the message through CBC under one key and keeps the final block. The ANSI X9.19 Retail MAC (ISO/IEC 9797-1 algorithm 3) runs that CBC-MAC under a single-DES key K1, then applies an output transformation — decrypt with K2, re-encrypt with K1 — which strengthens it against known CBC-MAC attacks. The Retail MAC therefore needs two 8-byte keys.

Is this safe to use with real keys?

It is correct — every operation is anchored to published NIST and ANSI X9 known-answer vectors — and it runs entirely in your browser with no backend, so nothing you type leaves the tab. But it is a debugging aid, not an HSM: single DES and ECB in particular are not secure for protecting real data, and production key material belongs in a hardware security module, not a web page.

These are debugging aids, not certified reference implementations. If a tool disagrees with your specification, trust the specification.