# How can semi-weak DES keys be leveraged to attack DES?

I see how DES weak keys can be leveraged under chosen plaintext attack where an adversary feeds the ciphertext encrypted by a weak-key back to the DES encryption function and gets plaintext as a result.

The probability that both keys from the semi-weak key pair are used seems to be very small ($6/2^{56} \times 1/2^{56} \approx 1/2^{110}$) making chosen ciphertext attack significantly slower as compared to exhaustive key search ($1/2^{56}$). If this logic is correct, then how can one leverage semi-weak keys to attack DES?

• Further, the question asks about semi-weak keys, which are keys pairs $(K_1,K_2)$ such that $K_1\ne K_2\text{ and }\forall m, E_{K_1}(E_{K_2}(m))=E_{K_2}(E_{K_1}(m))$; it is even more difficult to exhibit a situation where that is a problem than it is for weak keys, such that $\forall m, E_{K_1}(E_{K_1}(m))=m$. – fgrieu Mar 6 '17 at 9:08