# Why does xor-ing a second key into the plaintext of a blockcipher not improve security?

Let us assume that we have a very large number of known plaintexts.

How can we prove that $c= DES(K1,M \oplus K2)$ offers no advantage compared to DES?

• Hint: to prove that this DES variation has almost no advantage compared to DES in term of resistance to brute force, exhibit an attack recovering K1 and K2 assuming two or three distinct plaintext/ciphertext pairs, with cost only about twice that of attacking DES with one or two plaintext/ciphertext pairs. – fgrieu Dec 4 '16 at 19:11
• Thank you for the replay. To be honest , I don't have much experience at that topic . Could you please elaborate a bit ? – user3697730 Dec 4 '16 at 19:14
• $D(C_1) \oplus D(C_2) = P_1 \oplus P_2$ – CodesInChaos Dec 4 '16 at 19:46
• What CodesInChaos meant: Basically you're using a multi-time-pad before encrypting with DES. And that is bad - it means your scheme is just DES and nothing else. If you state "$K_2$ is only used once", you could just use OTP directly instead. – tylo Dec 5 '16 at 13:45