3
$\begingroup$

I'm interested by the compositions of the block cipher DES, instantiated with independent keys $k_1$, $k_2$ and $k_3$.

Are these 3 compositions equivalent in terms of security? $$DES_{k_1}(DES_{k_2}(DES_{k_3}(.)))$$ $$DES_{k_1}(DES_{k_2}(DES^{-1}_{k_3}(.)))$$ $$DES_{k_1}(DES^{-1}_{k_2}(DES^{-1}_{k_3}(.)))$$

I'm also interested in the same question with two iterations (instead of 3). Are these equivalent in security? $$DES_{k_1}(DES^{-1}_{k_2}(.))$$ $$DES_{k_1}(DES_{k_2}(.))$$

Improve this question
$\endgroup$
8
  • $\begingroup$ Can you please check your questions? I think the last one should read $DES_{k1}(DES_{k2}(.))$ $\endgroup$
    – Uwe Plonus
    Commented Jun 10, 2013 at 10:59
  • $\begingroup$ The inverse of a block cipher is a block cipher of equivalent strength (it's perfectly OK to use the decryption algorithm to encrypt and the encryption algorithm to decrypt from a security point of view, should you want to do so for some reason) so unless your cipher has weaknesses with respect to related keys, they should all be the same, afaik. I dunno about DES though. $\endgroup$
    – Thomas
    Commented Jun 10, 2013 at 11:14
  • $\begingroup$ @Thomas, Thank you. So you say that, given a composition of blocks cipher I can turn one decryption into an encryption operation whithout any consequence about the security of the composed block cipher ? $\endgroup$
    – Dingo13
    Commented Jun 10, 2013 at 13:39
  • 1
    $\begingroup$ @user7060 What I'm saying is that an for an ideal keyed pseudorandom permutation $E_k$, using $E^{-1}_k(X)$ in place of $E_k(X)$ and vice versa makes no difference, thus in the standard model it does not matter if you call the encryption function or the decryption function (with the same key) as long as all three keys are independent. And I mean swapping the two, not just substituting them at will. For instance, $E_k(E_k(X))$ and $E^{-1}_k(E^{-1}_k(X))$ are both good but $E_k(E^{-1}_k(X))$ is a pretty bad cipher... $\endgroup$
    – Thomas
    Commented Jun 10, 2013 at 13:47
  • $\begingroup$ @Thomas. The counterexample that you give is related to the use of a same key. I can substitute if the keys are different, I have well understood ? So $DES_{k_1}(DES^{-1}_{k_2}(.))$ and $DES_{k_1}(DES_{k_2}(.))$ are equivalent in terms of security ? $\endgroup$
    – Dingo13
    Commented Jun 10, 2013 at 14:02

2 Answers 2

Reset to default
3
$\begingroup$

Yes, you can reasonably expect that these will provide equivalent security, if you choose all keys uniformly and independently at random. The decryption operation is basically the same as the encryption operation, so it would be extremely surprising if there was any significant difference in security among these.

(Of course, if you don't generate the keys randomly, then this all goes out the window. For instance, $DES_{k1}(DES_{k1}(\cdot))$ has very different security properties than $DES_{k1}(DES_{k1}^{-1}(\cdot))$. I suspect this doesn't need saying, but I'm listing the caveat explicitly: it is important that you choose all keys uniformly and independently at random.)

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thank you. "The decryption operation is basically the same as the encryption operation, so it would be extremely surprising if there was any significant difference in security among these". What about the use of a block cipher which is not based on a Feistel structure, where the decryption and encryption are not so similar ? For instance AES ? $\endgroup$
    – Dingo13
    Commented Jun 11, 2013 at 7:25
  • $\begingroup$ @user7060, I'd answer the same for AES. $\endgroup$
    – D.W.
    Commented Jun 11, 2013 at 15:28
  • $\begingroup$ I agree, the differences between encryption and decryption are small enough, that the security should be almost the same. $\endgroup$
    – tylo
    Commented Jun 12, 2013 at 14:33
2
$\begingroup$

Short answer: (Probably) yes.

Long answer: DES is a Feistel cipher, and therefore encryption and decryption are almost the same process. The only difference is the reverse order of the subkeys. There are theoretical attacks on DES, which might have to be adjusted if you use reverse order of subkeys for encryption. If these attacks target the subkeys themselves, the attack works just the same. If it uses some correlation between the subkeys, it can be adapted easily enough.

However, in practice DES can be brute forced "in the cloud" pretty easily. For example, it is part of CloudCracker ( see their blog on MS-CHAPv2 Cracking). This attack can also be adapted to the reverse subkey order.

Therefore, your security should be the same whether you use the encryption or decryption for any of the encryptions.

But in general, triple DES has not seen much attention lately, Wikipedia mentions the best attack was from 1998 (on 3 independent keys). We are not even sure, if the following doesn't hold for some $m,k_1,k_2$: $\exists \; k_3: DES_{k_3}(m) = DES_{k_1}(DES_{k_2}(m)). $

Such a result would totally destroy the triple DES scheme, because it might make it as bad as single-DES.

If you are designing a system, you should try to avoid DES and switch to AES. You should never use outdated crypto.

Improve this answer
$\endgroup$
3
  • 3
    $\begingroup$ It is extremely likely that it holds for some $m$, $k1$, $k2$: $\exists k_3: DES_{k_3}(m)=DES_{k_1}(DES_{k_2}(m))$; in fact it would be reasonably easy to explicitly exhibit such $m$, $k1$, $k2$, $k3$. $\endgroup$
    – fgrieu ♦
    Commented Jun 10, 2013 at 18:42
  • 2
    $\begingroup$ "Such a result would totally destroy the triple DES scheme" - This is not true. The first 4 paragraphs of your answer, and the last paragraph, are fine -- but the business about $k_1,k_2,k_3$ is not correct. I would suggest you edit the answer to delete the paragraphs "But in general....as bad as single-DES". $\endgroup$
    – D.W.
    Commented Jun 12, 2013 at 20:06
  • 1
    $\begingroup$ TDEA (aka 3DES) is still a current standard when you follow keying option 1, it's a robust encryption scheme, and is still in heavy use by the financial industries. The primary reason to avoid TDEA is that it is not nearly as efficient as AES (on a general purpose computer.) Furthermore, being so heavily attacked over the last 40 years has been excellent at ferreting out its weaknesses, so it is probably the best-studied modern encryption algorithm ever. You don't necessarily have to run from TDEA because it's not new. $\endgroup$
    – John Deters
    Commented Jun 13, 2013 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.