Consider the Triple DES encryption calculated as:

$$C= E_{K_1}(D_{K_2}(E_{K_1}(P))).$$

For a chosen plaintext attack, given plaintext $P$, we compute the result of $D_{K_2}(E_{K_1}(P))$ and store it as a table of length $2^{112}$, then decrypt the cipertext $C$ using $2^{56}$ possible $K_1$. I think we also have a meet-in-the-middle attack here; and the computation complexity is also $2^{56}$ as in DES. Is this right? But then why does the literature say that 3DES is more secure than DES?


1 Answer 1


The computational complexity of the attack you describe is $2^{112}$, since that's how much work it takes to build the look-up table.

In fact, for standard 2-key 3DES like you describe, an attacker capable of building such a look-up table could just as well store $C = E_{K_1}( D_{K_2}( E_{K_1}( P )))$ instead of just $D_{K_2}( E_{K_1}( P ))$ in the table, allowing them to skip the second half of the meet-in-the-middle attack and just directly look up $(K_1, K_2)$ in the table, given a ciphertext block matching the plaintext $P$.

However, the attack your describe (and variants of it) is precisely the reason why three layers of DES encryption cannot provide more than 112-bit security, even though, naïvely, using 3-key 3DES with $C = E_{K_3}( D_{K_2}( E_{K_1}( P )))$ would seem to offer 168 bits of key-space.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.