# Disrupting MITM attack against 3DES by intermingling plaintext and inter-mediate ciphertext between rounds

Let's say someone implements 3DES with three separate 56-bit keys and an attacker is attempting to execute a MITM attack.

Here is the encryption plan designed to attempt to disrupt the MITM attack, or at least make it more expensive. You grab 192 bits of plaintext and shuffle them into three 64-bit blocks, intermingling between all three sub-blocks, if less pad with PKCS#7 padding to be multiple of 192.

My initial suggestion would be byte 0 is 1st byte of 2nd block, byte 1 is 1st byte of 3rd block, byte 3 is 1st byte of 1st block, byte 4 is 2nd byte of 2nd block, etc. A matrix or maybe a key specific columnar transposition would definitely be preferable as long as it is not too expensive.

You then perform the first round of DES encryption on the first block with the first key, the second block with the second key, and the third block with the third key, in parallel if feasible.

You shuffle the 192 bits of intermediate ciphertext afterward, again intermingling bytes between the three blocks and then do the second round, encrypting what is now the first block with the first key, the second round with the second key, and the third block with the third key.

You continue to shuffle the blocks and repeat until 48 rounds of encryption have been performed. You're not changing the keys, so I don't think there should be any re-keying penalty. Shuffling blocks of binary data is a pretty efficient and simple operation that should not add much performance penalty or implementation complexity.

Would this make the MITM attack more difficult, while turning it into a 192-bit block cipher in the process? How significant would the performance penalty be when compared to standard 3DES?

• I believe this would qualify as 3DES because all ciphertext is subjected to 16 rounds of encryption with each of the three keys. – Abercrombie Dorfen Oct 4 '20 at 12:45
• The text is shuffled between rounds and winds up in different blocks and gets encrypted with different keys. You might have to alternate the shuffling pattern so bytes don't stay in the same 64-bit block every time. – Abercrombie Dorfen Oct 4 '20 at 12:52
• The shuffling would be done before every round. – Abercrombie Dorfen Oct 4 '20 at 13:04
• What you define is not 3DES. You define a new cipher with block size 192 by using DES. MITM is applicable when there is a cascaded cipher like $AES(k_1,AES(k_2,m))$. MITM is not applicable to your new cipher. – kelalaka Oct 4 '20 at 13:39
• Note that the general MITM attack on block cipher compositions usually only breaks them if they're combined in a black-box fashion (e.g. only invoking DES as a whole and not caring / knowing about its structure). – SEJPM Oct 4 '20 at 14:46

3DES

What is described here is not 3DES (Triple DES or TDES and officially the Triple Data Encryption Algorithm (TDEA or Triple DEA)). Let us call the $$E$$ as DES encryption and $$D$$ as DES decryption. Then we can write 3DES encryption as

$$E(k_3,D(k_2,E(k_1,message)))$$ with independent keys $$k_1,k_2,k_3$$.

The provided security by 3DES with 3 key is not 192-bits. It is around 122-bit. Therefore the 2 key variant is preferable and it is called 2TDEA.

$$E(k_1,D(k_2,E(k_1,message)))$$ in 2TDEA $$k_1 = k_3$$ and $$k_1$$ and $$k_2$$ are independent.

To apply the Meet-In-The-Middle (MTIM*) attack one needs cascaded ciphers. So that one can divide the encryption/decryption calls and approach from left and right build a table and find the keys with a couple of known-plaintexts.

Your design uses the internals of the DES in a way that you defined a new cipher that has a 192-bit block size with 168-bit keys size. There is no cascading there, therefore, MITM attack is not possible.

• Is it secure ( i.e. does really provide 168-bit security), we don't know. It is a new design and needs a new analysis.

*The MITM here, should not be confuse with Man-in-the-Middle attack. The later attack is an active eavesdropping

• I agree with everything you said. My curiosity was regarding triple encryption, which I see mentioned fairly frequently. I see my suggestion as comparing interweaving vs. cascading in the hopes of eliminating small block size vulnerabilities and MITM attacks. I understand that changes to standard 3DES, even though I stick with a well-analyzed algorithm in DES as the core, would require specific analysis. I was more curious as to whether or not interweaving offered even theoretical benefits regarding block size and MITM attacks. Your answer helped clarify things a bit. – Abercrombie Dorfen Oct 5 '20 at 2:01
• Maybe you should ask a reference to interweave a cipher instead of cascading in anew question? – kelalaka Oct 5 '20 at 12:09