This is a question I had from an exercise session.
First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.
Is this construction safe against meet-in-the-middle attack?
Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?
The CBC ciphertext $C_1 \mathbin\| \cdots \mathbin\| C_\ell$ for plaintext $P_1 \mathbin\| \cdots \mathbin\| P_\ell$ under key $K_1$ is $$C_i = E_{K_1}(P_i \oplus C_{i-1}),$$ where $C_0 = \mathit{IV}_1$. If you then apply ECB decryption under $K_1$, you'll get the ‘ciphertext’ $C'_1 \mathbin\| \cdots \mathbin\| C'_\ell$ where $$C'_i = E_{K_1}^{-1}(C_i).$$ If you then use CBC encryption with a different key and IV, you'll get $C''_1 \mathbin\| \cdots \mathbin\| C''_\ell$ where $$C''_i = E_{K_2}^{-1}(C'_i) \oplus C'_{i-1},$$ where $C'_0 = \mathit{IV}_2$.
If you simplify by canceling inverses, do either of the keys $K_1$ or $K_2$ still figure into this? If yes, can you find a plaintext/ciphertext pair with an unknown intermediate quantity on which you could apply a meet-in-the-middle attack? If no, do you even need to apply a meet-in-the-middle attack at all?
