# Understanding Meet-in-the-Middle attack on block ciphers

I understand how to implement a Meet-in-the-Middle attack on 2DES/3DES, by computing for one half all possible keys and storing the outcome and then subsequently do the same for the other half but compare with the previously stored outcome to see if there is a match somewhere. Very unprecise description I know but just to state that I know how to do it for 2DES/3DES

The problem is for Feistel ciphers, where it seems that the very same technique cannot be used. Consider the below (sorry for the poor drawing): So for a simplified example let's say the Feistel structure above operates on 16-bit blocks and uses 8-bit independant round keys. Each branch block is thus of 8 bits.The S-box is an 8-bit AES S-box.

Given that the adversary knows the following:

• Full access to the code which encrypts a 16-bit block using the Feistel above
• Knows exactly two plaintext - ciphertext pairs.

So given the two pairs, the aim is to find the key which maps the plaintext to the ciphertext.

Given the assumptions above, how is a Meet-in-the-Middle attack applied here? I've tried to use the same approach as with the 2DES/3DES, but it just doesn't apply in the same way. I'm in need of a bit of guidance on how to proceed.

I can't see where the "middle" value is, and from where I should compute forwards and backwards to reach such a middle value.

Edit: Forgot to mention that there are 4 rounds in the Feistel cipher.

• Does your toy cipher consist of just the single round (precisely as you drew), or are there multiple rounds (each with a separete $K_i$)? Jun 21 '15 at 19:05
• @poncho Sorry forgot to mention, no it consists of 4 rounds with separate Ki for each round.
– sudo
Jun 21 '15 at 19:05