Disrupting MITM attack against 3DES by intermingling plaintext and inter-mediate ciphertext between rounds

Question

Let's say someone implements 3DES with three separate 56-bit keys and an attacker is attempting to execute a MITM attack.

Here is the encryption plan designed to attempt to disrupt the MITM attack, or at least make it more expensive. You grab 192 bits of plaintext and shuffle them into three 64-bit blocks, intermingling between all three sub-blocks, if less pad with PKCS#7 padding to be multiple of 192.

My initial suggestion would be byte 0 is 1st byte of 2nd block, byte 1 is 1st byte of 3rd block, byte 3 is 1st byte of 1st block, byte 4 is 2nd byte of 2nd block, etc. A matrix or maybe a key specific columnar transposition would definitely be preferable as long as it is not too expensive.

You then perform the first round of DES encryption on the first block with the first key, the second block with the second key, and the third block with the third key, in parallel if feasible.

You shuffle the 192 bits of intermediate ciphertext afterward, again intermingling bytes between the three blocks and then do the second round, encrypting what is now the first block with the first key, the second round with the second key, and the third block with the third key.

You continue to shuffle the blocks and repeat until 48 rounds of encryption have been performed. You're not changing the keys, so I don't think there should be any re-keying penalty. Shuffling blocks of binary data is a pretty efficient and simple operation that should not add much performance penalty or implementation complexity.

Would this make the MITM attack more difficult, while turning it into a 192-bit block cipher in the process? How significant would the performance penalty be when compared to standard 3DES?

Answer 1

3DES

What is described here is not 3DES (Triple DES or TDES and officially the Triple Data Encryption Algorithm (TDEA or Triple DEA)). Let us call the $E$ as DES encryption and $D$ as DES decryption. Then we can write 3DES encryption as

$$E(k_3,D(k_2,E(k_1,message)))$$ with independent keys $k_1,k_2,k_3$.

The provided security by 3DES with 3 key is not 192-bits. It is around 122-bit. Therefore the 2 key variant is preferable and it is called 2TDEA.

$$E(k_1,D(k_2,E(k_1,message)))$$ in 2TDEA $k_1 = k_3$ and $k_1$ and $k_2$ are independent.

To apply the Meet-In-The-Middle (MTIM^*) attack one needs cascaded ciphers. So that one can divide the encryption/decryption calls and approach from left and right build a table and find the keys with a couple of known-plaintexts.

Your Design

Your design uses the internals of the DES in a way that you defined a new cipher that has a 192-bit block size with 168-bit keys size. There is no cascading there, therefore, MITM attack is not possible.

• Is it secure ( i.e. does really provide 168-bit security), we don't know. It is a new design and needs a new analysis.

_{*The MITM here, should not be confuse with Man-in-the-Middle attack. The later attack is an active eavesdropping}