0
$\begingroup$

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)?

.

Say the encryption scheme has |key space K| = |plaintext space M| = |ciphertext space C| , all keys are 64 bit length, and $k1,k2,k3,k4,k5$ are all different (no key reuse like in some DES key options).

$c = E_{k5}(E_{k4}(E_{k3}(E_{k2}(E_{k1}(m))))$

You know that double encryption would not result in $|K|^2$ possibilities, but in fact due to the mitm attack the possibilities the attacker is forced to iterate over is only around ~2*K. You also know that triple encryption is much better, as it forces the attacker to have to iterate a total of ~$|K|^2$ even with the mitm tactic. What is the effective key length then when using double encryption, triple encryption, and x5 encryption respectively when using the above scheme?

Improve this question
$\endgroup$
4
  • $\begingroup$ If you search this site you will find very good answers about this. $\endgroup$
    – kelalaka
    Sep 21, 2020 at 6:52
  • $\begingroup$ Hint: Can you perhaps group the five encryptions into two "abstract encryptions" to get a double encryption to apply MITM? $\endgroup$
    – SEJPM
    Sep 21, 2020 at 9:09
  • $\begingroup$ My interest really lies in the fourth iteration; does the "effective doubling" of our encryption per iteration (work the attacker has to do for mitm) continue to increase once we pass triple encryption? Such as with 3DES, reaching an effective key length of 2^112, on iteration four does it achieve 2^224 effective key length? $\endgroup$
    – bb2prime
    Sep 22, 2020 at 22:56
  • $\begingroup$ Or do we need to consider the encryption in bunches of three, given the nature of how the attacker makes the list of pre-processed k values and runs them all through the "left side" of the encryption equation? $\endgroup$
    – bb2prime
    Sep 22, 2020 at 22:58

1 Answer 1

Reset to default
1
$\begingroup$

I believe I have settled it, please comment below if I have inaccuracies or am missing something:

c=Ek5(Ek4(Ek3(Ek2(Ek1(m)))) We can also represent these as the following: (by applying the appropriate decryptions to either side)

Dk4(Dk5(c)) = Ek3(Ek2(Ek1(m))) _____ OR ______ Dk3(Dk4(Dk5(c)))=Ek2(Ek1(m))

Effective key length: with the mitm attacker, it would take 2^192 operations on one side of the equation to find the "collisions" in the stored lists and determine a set of proper keys by brute force, and 2^128 operations on the other side.

Stated more abstractly, approximately ~|K|^3 + ~|K|^2, but in big O notation O(|K|^3)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.