0
$\begingroup$

This is a question I had from an exercise session.

First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.

Is this construction safe against meet-in-the-middle attack?

Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?

$\endgroup$
1
$\begingroup$

The CBC ciphertext $C_1 \mathbin\| \cdots \mathbin\| C_\ell$ for plaintext $P_1 \mathbin\| \cdots \mathbin\| P_\ell$ under key $K_1$ is $$C_i = E_{K_1}(P_i \oplus C_{i-1}),$$ where $C_0 = \mathit{IV}_1$. If you then apply ECB decryption under $K_1$, you'll get the ‘ciphertext’ $C'_1 \mathbin\| \cdots \mathbin\| C'_\ell$ where $$C'_i = E_{K_1}^{-1}(C_i).$$ If you then use CBC encryption with a different key and IV, you'll get $C''_1 \mathbin\| \cdots \mathbin\| C''_\ell$ where $$C''_i = E_{K_2}^{-1}(C'_i) \oplus C'_{i-1},$$ where $C'_0 = \mathit{IV}_2$.

If you simplify by canceling inverses, do either of the keys $K_1$ or $K_2$ still figure into this? If yes, can you find a plaintext/ciphertext pair with an unknown intermediate quantity on which you could apply a meet-in-the-middle attack? If no, do you even need to apply a meet-in-the-middle attack at all?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.