The other reason is that it was initially feared that DES was a group. That is, encryption with k1 and k2 might be equivalent to single encryption with some unknown (to you and me) key k3. But a cryptanalyst or a brute- force cracker would neither know nor care that you double-encrypted.
It has now been proved that DES is not a group. What isn't clear to me is whether it's ``mostly closed'', though I suspect not. It can be right, but we can use some intermidiant operation. For example: DES(randomHeader+DES(zip(DES (text, k1)), k2), k3)
DES (text, k) - encryption text "text" by key k; randomHeader - some good random text; zip - some archiver. --- Victor A. Borisov aka blaster; Relcom R&D; Email: blaster@rd.relcom.msk.su; Phone: +7(095)-943-4735; +7(095)-198-9510; === Don`t panic! ===