# Security of a block cipher if double encryption $E_{K_2} \circ E_{K_1}$ is always single encryption $E_{f(K_1,K_2)}$

If there always existed a $$k_3$$ such that $$\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$$, how would that affect the security of $$\operatorname{DES}$$?

• 2-DES is only 57-bit secure because of meet-in-the-middle attack, so k3 would decrease the security by 1 bit. Mar 26 '19 at 1:12
• why only 1 bit will be affected? Mar 26 '19 at 2:28
• @DannyNiu That would decrease the security of 2DES relative to DES by 1 bit. But the question is about the security of DES itself. Mar 26 '19 at 23:33

They applied the cycling test and concluded that DES is not a group. Therefore, we don't expect that $$\operatorname{DES}(k_2, \operatorname{DES}(k_1, M)) = \operatorname{DES}(k_3, M)$$
As noted in the article, if there was such functional composition then a known-plaintext attack with $$2^{28}$$ would be able to break DES, on average.