# Have these compositions of block ciphers the same security?

I'm interested by the compositions of the block cipher DES, instantiated with independent keys $k_1$, $k_2$ and $k_3$.

Are these 3 compositions equivalent in terms of security? $$DES_{k_1}(DES_{k_2}(DES_{k_3}(.)))$$ $$DES_{k_1}(DES_{k_2}(DES^{-1}_{k_3}(.)))$$ $$DES_{k_1}(DES^{-1}_{k_2}(DES^{-1}_{k_3}(.)))$$

I'm also interested in the same question with two iterations (instead of 3). Are these equivalent in security? $$DES_{k_1}(DES^{-1}_{k_2}(.))$$ $$DES_{k_1}(DES_{k_2}(.))$$

-
Can you please check your questions? I think the last one should read $DES_{k1}(DES_{k2}(.))$ – Uwe Plonus Jun 10 '13 at 10:59
@Uwe Plonus it's corrected, thank you. – Dingo13 Jun 10 '13 at 11:05
The inverse of a block cipher is a block cipher of equivalent strength (it's perfectly OK to use the decryption algorithm to encrypt and the encryption algorithm to decrypt from a security point of view, should you want to do so for some reason) so unless your cipher has weaknesses with respect to related keys, they should all be the same, afaik. I dunno about DES though. – Thomas Jun 10 '13 at 11:14
@Thomas, Thank you. So you say that, given a composition of blocks cipher I can turn one decryption into an encryption operation whithout any consequence about the security of the composed block cipher ? – Dingo13 Jun 10 '13 at 13:39
@user7060 What I'm saying is that an for an ideal keyed pseudorandom permutation $E_k$, using $E^{-1}_k(X)$ in place of $E_k(X)$ and vice versa makes no difference, thus in the standard model it does not matter if you call the encryption function or the decryption function (with the same key) as long as all three keys are independent. And I mean swapping the two, not just substituting them at will. For instance, $E_k(E_k(X))$ and $E^{-1}_k(E^{-1}_k(X))$ are both good but $E_k(E^{-1}_k(X))$ is a pretty bad cipher... – Thomas Jun 10 '13 at 13:47

Yes, you can reasonably expect that these will provide equivalent security, if you choose all keys uniformly and independently at random. The decryption operation is basically the same as the encryption operation, so it would be extremely surprising if there was any significant difference in security among these.

(Of course, if you don't generate the keys randomly, then this all goes out the window. For instance, $DES_{k1}(DES_{k1}(\cdot))$ has very different security properties than $DES_{k1}(DES_{k1}^{-1}(\cdot))$. I suspect this doesn't need saying, but I'm listing the caveat explicitly: it is important that you choose all keys uniformly and independently at random.)

-
Thank you. "The decryption operation is basically the same as the encryption operation, so it would be extremely surprising if there was any significant difference in security among these". What about the use of a block cipher which is not based on a Feistel structure, where the decryption and encryption are not so similar ? For instance AES ? – Dingo13 Jun 11 '13 at 7:25
@user7060, I'd answer the same for AES. – D.W. Jun 11 '13 at 15:28
I agree, the differences between encryption and decryption are small enough, that the security should be almost the same. – tylo Jun 12 '13 at 14:33

Long answer: DES is a Feistel cipher, and therefore encryption and decryption are almost the same process. The only difference is the reverse order of the subkeys. There are theoretical attacks on DES, which might have to be adjusted if you use reverse order of subkeys for encryption. If these attacks target the subkeys themselves, the attack works just the same. If it uses some correlation between the subkeys, it can be adapted easily enough.

However, in practice DES can be brute forced "in the cloud" pretty easily. For example, it is part of CloudCracker ( see their blog on MS-CHAPv2 Cracking). This attack can also be adapted to the reverse subkey order.

Therefore, your security should be the same whether you use the encryption or decryption for any of the encryptions.

But in general, triple DES has not seen much attention lately, Wikipedia mentions the best attack was from 1998 (on 3 independent keys). We are not even sure, if the following doesn't hold for some $m,k_1,k_2$: $\exists \; k_3: DES_{k_3}(m) = DES_{k_1}(DES_{k_2}(m)).$

Such a result would totally destroy the triple DES scheme, because it might make it as bad as single-DES.

If you are designing a system, you should try to avoid DES and switch to AES. You should never use outdated crypto.

-
It is extremely likely that it holds for some $m$, $k1$, $k2$: $\exists k_3: DES_{k_3}(m)=DES_{k_1}(DES_{k_2}(m))$; in fact it would be reasonably easy to explicitly exhibit such $m$, $k1$, $k2$, $k3$. – fgrieu Jun 10 '13 at 18:42
"Such a result would totally destroy the triple DES scheme" - This is not true. The first 4 paragraphs of your answer, and the last paragraph, are fine -- but the business about $k_1,k_2,k_3$ is not correct. I would suggest you edit the answer to delete the paragraphs "But in general....as bad as single-DES". – D.W. Jun 12 '13 at 20:06
TDEA (aka 3DES) is still a current standard when you follow keying option 1, it's a robust encryption scheme, and is still in heavy use by the financial industries. The primary reason to avoid TDEA is that it is not nearly as efficient as AES (on a general purpose computer.) Furthermore, being so heavily attacked over the last 40 years has been excellent at ferreting out its weaknesses, so it is probably the best-studied modern encryption algorithm ever. You don't necessarily have to run from TDEA because it's not new. – John Deters Jun 13 '13 at 13:58