Does encrypting with $\operatorname{DES}$ in the following way $$\operatorname{DES}(\operatorname{DES}(x,k), k)$$ make $\operatorname{DES}$ as strong as $\operatorname{2DES}$ with 2 keys?

Because we have to run $\operatorname{DES}$ twice now for each key in order to find it - first run $\operatorname{DES}(x,k)$ and the output is the input as text for the second round of encryption? So overall $2*2^{56} = 2^{57}$ just like meet in the middle complexity, right ?

Does encrypting with $\operatorname{DES}$ in the following way $\operatorname{DES}(\operatorname{DES}(x,k), k)$ make $\operatorname{DES}$ as strong as $\operatorname{2DES}$ with 2 keys?

No.

So overall $2*2^{56} = 2^{57}$ just like meet in the middle complexity, right ?

This time estimate ignores the memory requirement that the meet-in-the-middle attack on 2DES requires.

Memory is cheap, but it's not free. The estimate of $2^{57}$ operations to break 2DES ignores the overhead of both the memory and the interprocessor communication (it's unlikely that a single processor will be able to perform $2^{57}$ DES operations in an acceptable period of time). As these objections can be addressed, it's not a lie to ignore them, but they are nontrivial considerations.

In contrast, finding the key for $DES(DES(x,k), k)$ requires no memory, and can be trivially parallelized.

  • 1
    ... and should be feasible using a couple of thousand USD on modern cloud platforms. – SEJPM Nov 15 at 9:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.