Let us assume that we have a very large number of known plaintexts.

How can we prove that $c= DES(K1,M \oplus K2)$ offers no advantage compared to DES?

  • 1
    $\begingroup$ Hint: to prove that this DES variation has almost no advantage compared to DES in term of resistance to brute force, exhibit an attack recovering K1 and K2 assuming two or three distinct plaintext/ciphertext pairs, with cost only about twice that of attacking DES with one or two plaintext/ciphertext pairs. $\endgroup$
    – fgrieu
    Commented Dec 4, 2016 at 19:11
  • $\begingroup$ Thank you for the replay. To be honest , I don't have much experience at that topic . Could you please elaborate a bit ? $\endgroup$ Commented Dec 4, 2016 at 19:14
  • 2
    $\begingroup$ $D(C_1) \oplus D(C_2) = P_1 \oplus P_2$ $\endgroup$ Commented Dec 4, 2016 at 19:46
  • $\begingroup$ What CodesInChaos meant: Basically you're using a multi-time-pad before encrypting with DES. And that is bad - it means your scheme is just DES and nothing else. If you state "$K_2$ is only used once", you could just use OTP directly instead. $\endgroup$
    – tylo
    Commented Dec 5, 2016 at 13:45
  • $\begingroup$ @tylo if we try to solve $D(C_1) \oplus D(C_2) = P_1 \oplus P_2$ we need to precompute all the $2^{56}$ D(C_1) (for the different k1's) and all the D(c2) and then try to find the two that xoring them will give $P_1 \oplus P_2$ . But to find those two we still need $2^{56} \times 2^{56}$ so it actually increases complexity , doesn't it? $\endgroup$ Commented Feb 7, 2023 at 20:02


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.