This question already has an answer here:

This is a question I had from an exercise session.

Exercise: First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC decryption mode with a secret $IV_2$ and key $K_2$.

My solution:

$IV_1$ = $C''_0$ = $O^n$ and $C'_0$ = $IV_2$

I think encryption would be something like this $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ with $C'$ and $C''$ be the intermediate solutions (and $C''$ the first) of each encryption/decryption method.

For decryption I have this P = $D_{K1}$($E_{K1}$($E_{K2}$($C_i$ $\oplus$ $C'_{i-1}$)) $\oplus$ $P_{i-1}$)

The question: Is this construction safe against meet-in-the-middle attack?

Wouldn't the first two operations negate themselves because $C_1$ would decrypt into $P_1$?


marked as duplicate by Squeamish Ossifrage, AleksanderRas, kelalaka, Maarten Bodewes Jun 20 at 21:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.