If there always existed a $k_3$ such that $\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$, how would that affect the security of $\operatorname{DES}$?

  • 1
    $\begingroup$ 2-DES is only 57-bit secure because of meet-in-the-middle attack, so k3 would decrease the security by 1 bit. $\endgroup$
    – DannyNiu
    Mar 26, 2019 at 1:12
  • $\begingroup$ why only 1 bit will be affected? $\endgroup$
    – nanopro
    Mar 26, 2019 at 2:28
  • $\begingroup$ @DannyNiu That would decrease the security of 2DES relative to DES by 1 bit. But the question is about the security of DES itself. $\endgroup$ Mar 26, 2019 at 23:33

1 Answer 1


This question was tested years ago by Kaliski at. al Is the Data Encryption Standard a group? (Results of cycling experiments on DES as;

  • Is DES closed under functional composition?

They applied the cycling test and concluded that DES is not a group. Therefore, we don't expect that $$\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$$

As noted in the article, if there was such functional composition then a known-plaintext attack with $2^{28}$ would be able to break DES, on average.

  • $\begingroup$ I hope you dont mind, fixed some words in your nice answer. $\endgroup$
    – kodlu
    Mar 27, 2019 at 1:56
  • $\begingroup$ @kodlu nope. Thanks. $\endgroup$
    – kelalaka
    Mar 27, 2019 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.