  This paper reconsiders the security offered by 2-key triple DES, an
encryption technique that remains widely used despite recently being
de-standardised by NIST. A generalisation of the 1990 van Oorschot-Wiener
attack is described, constituting the first advance in cryptanalysis of 2-key
triple DES since 1990. We give further attack enhancements that together imply
that the widely used estimate that 2-key triple DES provides 80 bits of
security can no longer be regarded as conservative; the widely stated assertion
that the scheme is secure as long as the key is changed regularly is also
challenged. The main conclusion is that, whilst not completely broken, the
margin of safety for 2-key triple DES is slim, and efforts to replace it, at
least with its 3-key variant, should be pursued with some urgency.
