Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack.

This is an attack with known plaintext. The theory is that the attacker encrypts the plaintext with every possible key, and decrypts the known cipher text with every possible key and then looks for a match between decrypted cipher text and encrypted plaintext. So brute force attacks takes only twice as long as for single encryption instead of $2^{\text{number of key bits}}$ times as long as you might expect.

However, as far as I can see, if the first encryption using $k_1$ used CBC with a truly random and secret IV, then no meet in the middle is possible because the attacker would have to encrypt for every key for every IV to find a match which for example in DES is harder than encrypting for every possible pair of keys. In my hypothetical system, the IV can be simply double encrypted and prepended to the start of the ciphertext for the benefit of the intended recipient. It must not be used for anything else and if the second encryption wants to use CBC then it should use a separate random IV.

This seems so obvious that it must have been thought before, so what understanding am I missing?

share|improve this question
The IV is meant to be public. – Thomas Dec 25 '12 at 0:32
After further thought inspired by @Thomas, the IV can be "public" in the sense of not being encrypted under the first encryption, but encrypted only with key2 during the second encryption. This second encryption would mean that the pt (in the sense of the actual input to the block cipher) for encryption 1 was unknown to the attacker and the brute force attack on encryption 1 would have to encrypt under every possible key1 using a candidate IV decrypted using every possible key2.That seems to defeat the attack. – David Stein Dec 27 '12 at 11:45

Eli Biham examined this, along with a long series of other "internal chaining" modes in the paper "Cryptanalysis of Multiple Modes of Operation" in AsiaCrypt 1994.

His conclusion was that there were ways of attacking such modes that were strictly easier than the standard "external chaining" mode that is now commonly used; his paper is the chief reason that we stick to what we do use.

For example, in the case that you have CBC mode (with secret IV, as you suggested), followed by an independently keyed ECB mode, one way to attack this is to do a chosen ciphertext attack; ask for the decryption of the message (A B B) (where A and B are distinct blocks); if the plaintext message is (P1 P2 P3), then it turns out that $D_{k2}(A) \oplus D_{k2}(B) = P2 \oplus P3$; this makes brute forcing $k2$ straightforward (and once that is recovered, $k1$ can then be brute forced).

Other modes (I believe CBC mode followed by CBC mode would be one example) don't have such easy tricks; for them, you need to find an internal collision and exploit it. One possible way to do it (for CBC mode followed by CBC mode) is as for the repeated decryptions of plaintexts of the form (A A A) (for various block-sizes values of A); if two different values A, B satisfy $A \oplus D_{k2}(A) = B \oplus D_{k2}(B)$, then the third word of the corresponding plaintexts will be the same. Hence, if we ask for $2^{32}$ (assuming DES) such plaintexts, we can scan the plaintexts for collisions in the third word; once we find such collisions, we can do a brute force search to verify that the collision was caused at the $k2$ level, and if so, recover $k2$.

Now, it may be that these attacks are of mostly theoretical interest; they are often chosen ciphertext attacks, and chosen ciphertext attacks can be thwarted by a simple Message Authentication Code. However, given that the standard modes don't have these theoretical weaknesses, people have found it safer just to stick with the now standard modes.

share|improve this answer
Thank you for very informative answer. I found the abstract of Biham It's not yet obvious to me that it is always safer to stick with the standard modes. It might depend on the kinds of attack that are possible. In some applications chosen cipher attack is not possible. So is it possible that in those cases double DES with "inner chaining" could be stronger than TDEA with 2 keys which has its own theoretical weaknesses (seems accepted that it is not equivalent to 112 bit key)? I'm also wondering about double encryption in CTR mode.. – David Stein Dec 28 '12 at 20:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.