---
schema_version: "1"
id: bebee1e81c17859a2a2a40a77673ced914fe49cf2f0f1aa7be0eec91f5b48882
title: Triple DES for SAML Single Sign-On Is No Longer Supported
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_triple_des_retirement.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_triple_des_retirement.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a776b253cf4a0fa851395625b8942ecd88996c45b1a5a8b1ea3c945a158881a9
description: The Triple Data Encryption Standard (Triple DES) algorithm is no longer supported for SAML single sign-on (SSO). If your configuration still uses Triple DES, users can’t log in via SSO. This change applies to all SSO configurations that use the Triple DES algorithm, whether you use Salesforce as an identity provider or as a service provider. To improve security, use the Advanced Encryption Standard (AES) algorithms, AES 128 or AES 256, instead.
products:
  - Cross Cloud
release: "262"
---
# Triple DES for SAML Single Sign-On Is No Longer Supported

The Triple Data Encryption Standard (Triple DES) algorithm is no longer supported for SAML single sign-on (SSO). If your configuration still uses Triple DES, users can’t log in via SSO. This change applies to all SSO configurations that use the Triple DES algorithm, whether you use Salesforce as an identity provider or as a service provider. To improve security, use the Advanced Encryption Standard (AES) algorithms, AES 128 or AES 256, instead.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**Why:** The Triple DES algorithm uses a cryptographic key that’s too short to be secure. The AES 128 and AES 256 algorithms use longer keys that make these algorithms harder to attack. For more information about encryption algorithm security from the National Institute of Standards and Technology, go to [https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd](https://csrc.nist.gov/pubs/sp/800/131/a/r3/ipd).

**How:** If you use Salesforce as an identity provider, check your connected app SAML configuration. First, go to your connected app Web App Settings and check the Block Encryption Algorithm setting. If Block Encryption Algorithm is set to Triple DES, update your configuration to use a more secure algorithm. On the service provider, update your settings to decrypt the new algorithm.

![SAML identity provider settings with Block Encryption Algorithm setting highlighted](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/salesforce_release_notes/images/security_triple_des.png)

If you use Salesforce as a service provider, check with your identity provider to see what encryption algorithm they use. If they use the Triple DES algorithm, work with your identity provider to use a more secure algorithm and to generate a new decryption certificate. In Salesforce, update the Assertion Decryption Certificate in your SAML Single Sign-On Settings.

![SAML service provider settings with Assertion Decryption Certificate highlighted](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/salesforce_release_notes/images/security_decryptioncert.png)

#### See Also

- [_Salesforce Help_: Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml.htm&language=en_US)
- [_Salesforce Help_: Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_saml_parent.htm&language=en_US)