Regarding Key Strength with DES and Blowfish

I had a small discussion with my friend on combining two encryption algorithms based on 64-bit keys.

Say I have a plain text of 64 bits which I want to encrypt. My Key size is 128 bits. I will use the standard DES algorithm with the first 64 bits of the key to encrypt plaintext. With the remaining 64 bits of key, I will apply the Blowfish algorithm on ciphertext that DES produces. Assume this is my “encryption algorithm”.

Now, what I want to know is: will key size is considered as 120 bits (56-bit for DES + 64 bit for Blowfish), or will it be considered as 2 individual key sizes (56 bit and 64 bit) with two different encryption algorithms? As 64 bit keys based algorithms are weak with current computational environments, can cryptanalysis attack or break the security easily?

Personally I believe double-encryption algorithms provide more security on the plain text. But somehow I am not able to convince my friend that combining two weak 64-bit algorithms will provide a double key strength. Please share your thoughts to help me understand.

• To be secure you would want to E1 E2 E1, so an additional layer of DES encryption with the first key after the Blowfish layer Sep 13, 2014 at 0:59

I won't say someone would be able to break it 'easily'; however it won't be anywhere as difficult as with a true 128 bit cipher (or even 120 bit cipher; your construction ignores 8 of the key bits).

Here's an outline of how the attack would work: we assume we know the plaintext and the ciphertext, and are trying to recover the key. When we do is encrypt the plaintext with all $2^{56}$ possible DES keys, and put them in a huge list. Then, we decrypt the ciphertext will all $2^{64}$ possible Blowfish keys, and put them in another huge list. Then, we go through the lists, and look for a match; when we find a DES-encrypted ciphertext that matches a Blowfish-decrypted plaintext, that gives us both the DES key and the Blowfish key.

Now, the first obvious objection to this is "if the attacker already knows the plaintext, why does he need the key". Well, one answer is that this sort of attack can work even if the attacker has a guess of part of the plaintext; if he can just encrypt that region, that is enough to make the attack work.

The second objection is "there's no way anyone has enough memory for lists that big". While this is true, this attack can be modified to use less memory (at the expense of more computation); in general, if you have $O(2^m)$ memory, this attack can be done in $O(2^{120-m})$ time (for $m \le 56$); this means that if the attacker has a few Terabytes ($2^{40}$ bytes) sitting around, he could do this in $O(2^{80})$ time; that's a bit too close to practical for me

• This paper gives an attack whose heuristic expected runtime is $O(2^{91-(m/2)})$ for $\: 10\leq m \;$. $\hspace{1.03 in}$
– user991
Sep 11, 2014 at 22:44

The actual security would probably be about 65 bits. A meet-in-the-middle attack can be used to find the keys of both ciphers in less time than naive brute force.

The attack would decrypt the ciphertext with all the 64 bit l keys of the outer cipher, encrypt the plaintext with all the 56 bit keys of the inner cipher, then look for matches.

It only requires a known plaintext and ciphertext pair.

What you propose is called Double Encryption. With two independent keys, it is vulnerable to meet-in-the-middle attacks as described in another comment. I just add that this attack can be performed almost memoryless. Details are in the answer to similar question about Double-DES.