# Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session.

First we do DES in CBC encryption mode using a key $$K_1$$ and $$IV_1 = O^n$$. Then we do DES in ECB decryption mode using $$K_1$$. And then DES in CBC decryption mode with a secret $$IV_2$$ and key $$K_2$$.

Is this construction safe against meet-in-the-middle attack?

Wouldn't the first two operations negate themselves because $$C_1$$ would decrypt into $$P_1$$?

The CBC ciphertext $$C_1 \mathbin\| \cdots \mathbin\| C_\ell$$ for plaintext $$P_1 \mathbin\| \cdots \mathbin\| P_\ell$$ under key $$K_1$$ is $$C_i = E_{K_1}(P_i \oplus C_{i-1}),$$ where $$C_0 = \mathit{IV}_1$$. If you then apply ECB decryption under $$K_1$$, you'll get the ‘ciphertext’ $$C'_1 \mathbin\| \cdots \mathbin\| C'_\ell$$ where $$C'_i = E_{K_1}^{-1}(C_i).$$ If you then use CBC encryption with a different key and IV, you'll get $$C''_1 \mathbin\| \cdots \mathbin\| C''_\ell$$ where $$C''_i = E_{K_2}^{-1}(C'_i) \oplus C'_{i-1},$$ where $$C'_0 = \mathit{IV}_2$$.
If you simplify by canceling inverses, do either of the keys $$K_1$$ or $$K_2$$ still figure into this? If yes, can you find a plaintext/ciphertext pair with an unknown intermediate quantity on which you could apply a meet-in-the-middle attack? If no, do you even need to apply a meet-in-the-middle attack at all?