What if we were to use DES in the following way: for a given text x and key k we would perform DES(DES(x,k),k'), where k' is the complementary of k.

If an adversary has a few texts and their cipher-texts would he still need to run DES twice in each of the 2^56 rounds yielding a total of 2^57 rounds of encryption ?

Because if the opponent can't choose his texts then the complementary attribute of DES would not assist us in any way.

So would this type of encryption be similar in its strength to 2DES with 2 different keys since 2DES is also 2^57 runs (meet in the middle) ?

Or is there a smarter way ?

  • 1
    How is this fundamentally different from your previous question? Also, what's the point in doubling the attacker's effort at the cost of doubling the legitimate user's effort? We generally look for far better trade-offs, which increase the attacker's work load much more than it increases ours. – poncho Nov 15 at 5:00
  • 2
    There's a way to sizably speedup the practical attack of $\text{DES}(\text{DES}(x,k),\overline k)$ using the DES complementation property [that $\text{DES}(\overline x,\overline k)=\overline{\text{DES}(x,k)}$ ]. It brings the attack cost to nearly as low as attacking $\text{DES}(\text{DES}(x,k),k)$. Hint: there's no reduction in the number of rounds, the saving is elsewhere. – fgrieu Nov 15 at 7:12
  • @poncho These are practice questions that show how seemingly innocent constructions can be subverted, i.e. by taking the complementary property into account. Different constructions can be attacked using different vectors. There is no practical point to make - using any kind of DES construction isn't practical, except possibly triple DES because of backwards compatibility. – Maarten Bodewes Nov 15 at 13:46

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.