Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Consider the Triple DES encryption calculated as:

$$C= E_{K_1}(D_{K_2}(E_{K_1}(P))).$$

For a chosen plaintext attack, given plaintext $P$, we compute the result of $D_{K_2}(E_{K_1}(P))$ and store it as a table of length $2^{112}$, then decrypt the cipertext $C$ using $2^{56}$ possible $K_1$. I think we also have a meet-in-the-middle attack here; and the computation complexity is also $2^{56}$ as in DES. Is this right? But then why does the literature say that 3DES is more secure than DES?

share|improve this question

migrated from May 8 '14 at 19:07

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted

The computational complexity of the attack you describe is $2^{112}$, since that's how much work it takes to build the look-up table.

In fact, for standard 2-key 3DES like you describe, an attacker capable of building such a look-up table could just as well store $C = E_{K_1}( D_{K_2}( E_{K_1}( P )))$ instead of just $D_{K_2}( E_{K_1}( P ))$ in the table, allowing them to skip the second half of the meet-in-the-middle attack and just directly look up $(K_1, K_2)$ in the table, given a ciphertext block matching the plaintext $P$.

However, the attack your describe (and variants of it) is precisely the reason why three layers of DES encryption cannot provide more than 112-bit security, even though, naïvely, using 3-key 3DES with $C = E_{K_3}( D_{K_2}( E_{K_1}( P )))$ would seem to offer 168 bits of key-space.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.