2
$\begingroup$

I am following the notes "Introduction to Modern Cryptography" by Bellare and Rogaway, and on the chapter about blockciphers there is the following claim (page 11 of https://cseweb.ucsd.edu/~mihir/cse207/w-bc.pdf):

2DES, although having the same effective key length as 3DES2 and offering what appears to be the same or at least adequate security, is not popular in practice.

However, from what I understood, the effective length of 2DES is 57 bits, since it can be attacked by the meet-in-the-middle attack (this is stated on the end of page 10). On the other hand, the text says that 3DES2 does not appear to be target of meet-in-the-middle attacks, so its (effective) key length is 112 bits.

So I was wondering if I am missing something about these statements or if there might have been a mistake in the text (I did not find any errata).

| improve this question | |
$\endgroup$
  • $\begingroup$ It's always refreshing to see that the great cryptographers of our time can make the same stupid mistakes as I sometimes do :) $\endgroup$ – Maarten Bodewes♦ Feb 23 '16 at 15:54
5
$\begingroup$

Definitely a mistake. The text clearly contradicts itself.

... 2DES has an effective key length of 57.

And later...

There does not appear to be a meet-in-the-middle attack on 3DES2 however, so that its key length of 112 is also its effective key length.

which clearly contradicts

2DES, although having the same effective key length as 3DES2 and offering what appears to be the same or at least adequate security, is not popular in practice.

As a bit of an aside, 3DES2 is considered by NIST to have an effective key length of at least 80 bits, but definitely not the full 112 bits, due to its vulnerability to known-plaintext attacks with $2^{40}$ blocks.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks for the reply! I also appreciate the info about 3DES2. :) $\endgroup$ – mshcruz Feb 23 '16 at 4:28
  • $\begingroup$ The quoted NIST document says: "The reference to 80 bits of security strength should be interpreted as a security strength of at least 80 bits, but less than 112 bits (i.e., 80 ≤ security strength < 112)." I do not read the quoted document, and any NIST (or other serious) document that I am aware of, as stating 3DES2 has an effective key length of only 80 bits. $\endgroup$ – fgrieu♦ Feb 23 '16 at 19:58
  • $\begingroup$ @fgrieu Fair point. I've clarified. My interpretation was that as 80 bits is their best lower bound, you shouldn't use 3DES2 in any setting requiring more than 80 bits of security, but I don't think I made that clear enough. Thanks! $\endgroup$ – Chris Feb 23 '16 at 20:37
0
$\begingroup$

the effective key length is different with brute force, vs. meet in the middle attacks. As far as my understanding goes.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Could you clarify how do your understanding goes? What is your addition to the answer? $\endgroup$ – kelalaka Oct 17 '19 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.