Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Consider the Triple DES encryption calculated as:
$$C= E_{K_1}(D_{K_2}(E_{K_1}(P))).$$
For a chosen plaintext attack, given plaintext $P$, we compute the result of $D_{K_2}(E_{K_1}(P))$ and store it as a table of length $2^{112}$, then decrypt the cipertext $C$ using $2^{56}$ possible $K_1$. I think we also have a meet-in-the-middle attack here; and the computation complexity is also $2^{56}$ as in DES. Is this right? But then why does the literature say that 3DES is more secure than DES?
The computational complexity of the attack you describe is $2^{112}$, since that's how much work it takes to build the look-up table.
In fact, for standard 2-key 3DES like you describe, an attacker capable of building such a look-up table could just as well store $C = E_{K_1}( D_{K_2}( E_{K_1}( P )))$ instead of just $D_{K_2}( E_{K_1}( P ))$ in the table, allowing them to skip the second half of the meet-in-the-middle attack and just directly look up $(K_1, K_2)$ in the table, given a ciphertext block matching the plaintext $P$.
However, the attack your describe (and variants of it) is precisely the reason why three layers of DES encryption cannot provide more than 112-bit security, even though, naïvely, using 3-key 3DES with $C = E_{K_3}( D_{K_2}( E_{K_1}( P )))$ would seem to offer 168 bits of key-space.
