Questions tagged [meet-in-the-middle-attack]

The meet-in-the-middle attack is an optimized brute-force attack that significantly reduces the number of keys the attacker needs to try by utilizing a time-space trade-off. Work is done from the beginning and from the end of the scheme, and the results are combined linearly rather than exponentially.

Filter by
Sorted by
Tagged with
1 vote
1 answer
58 views

What is the security of multiple encryption using Even–Mansour scheme (XEX)?

As I know, the best attack on single or double Even-Mansour scheme is N/2, being N the key size (or size of one of the two keys used). I know that encrypting two times using this scheme is susceptible ...
user avatar
2 votes
1 answer
59 views

Paper "How to Meet Ternary LWE Keys": What is t and how is it used

I have read again and again this paper from A. May, but, probably because I am new to this field, I don't succeed in understanding the MEET-LWE part. In particular, in part 5 it states to choose a &...
user avatar
  • 51
0 votes
0 answers
42 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
user avatar
3 votes
1 answer
70 views

Devising a Feistel cipher in which the subkeys are constructed badly so that a meet in the middle attack will compromise its security

I'm trying to find a Feistel cipher in which the subkeys are constructed badly so that a meet in the middle attack will compromise its security. I thought about trying out a cipher where all the ...
user avatar
0 votes
0 answers
59 views

Time and space complexity analyzation of meet and middle attack of triple DES

How can we analyze the time and space complexity of meet and middle attack on a Triple-DES?
user avatar
0 votes
0 answers
29 views

Is multiple encryption with XORs between each encryption operation susceptible to meet-in-the-middle attacks?

Let's suppose I take a cipher with key size equal to the block size (Threefish). I XOR a random block in the ciphertext, encrypt with a key, XOR another random block, encrypt again with another key ...
user avatar
2 votes
1 answer
86 views

Is multiple encryption using a block cipher mode of operation that use only encryption processes vulnerable to Meet-in-the-middle attacks?

Some block cipher modes of operation use only encryption processes, such as CFB, OFB and CTR. If doing multiple encryptions using them, will these encipherment schemes be vulnerable to Meet-in-the-...
user avatar
0 votes
1 answer
58 views

Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?

Let's suppose I encrypt something with AES-256 in XTS mode two times (there will be 4 four keys, 2 for each encryption operation), wanting to achive 512-bits of security. Will this scheme be ...
user avatar
0 votes
0 answers
41 views

Is there a way of preventing meet-in-the-middle attack when using double-encryption?

Let's suppose I encrypt something with AES-256 two times using 2 different keys wanting to achieve 512-bits of security. I know that this scheme will in fact give me only 257-bits of encryption ...
user avatar
3 votes
0 answers
45 views

Paper "How to Meet Ternary LWE Keys": Why can Odlyzko's hash function not be used to construct the mitm lists recursively?

In Alexander May's Paper "How to Meet Ternary LWE Keys", Alexander May writes the following about combining representation techniques with Odlyzko's locality sensitive hash function (Page ...
user avatar
0 votes
0 answers
159 views

Textbook RSA meet in the middle time complexity

Hello, I have a question regarding time complexity of meet in the middle attack on textbook RSA encryption. Let's suppose that I try to encrypt symmetric keys of different length with no padding using ...
user avatar
  • 15
1 vote
2 answers
455 views

Meet in the middle time complexity

Hello, I am wondering why it is stated that double encrypted message with 2 DES keys is possible to break in worst case in $2\times2^{56}$ time using meet in the middle attack. Here is my reasoning: ...
user avatar
  • 15
0 votes
0 answers
84 views

Is multiple encryption with stream ciphers vulnerable to meet-in-the-middle attacks?

Let's suppose I encrypt something with a stream cipher (CSPRNG) two times using two 256-bit keys and different IVs. Will I get 512-bit encryption strength?
user avatar
1 vote
0 answers
77 views

Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs. Will I get 512 bits of encryption strength?
user avatar
8 votes
1 answer
1k views

Triple AES-128 encryption with 2 keys

We have a system where two devices communicate. Due to restrictions on one of them, we can only use AES-128 (so no AES-256) for encrypting the communication. However, new requirements on these kinds ...
user avatar
  • 189
1 vote
1 answer
153 views

How many collisions (identical pairs) are possible in meet in the middle attack on double DES with two unique keys?

I was reading my professors slides, I understand how meet in the middle works, but I have a few confusions. So we need two $\{(P_1, C_1), (P_2, C_2)\}$. Let $\lg{(k_1)} = \lg{(k_2)} = 56$, we generate ...
user avatar
  • 145
0 votes
1 answer
200 views

Symmetric Encryption, meet in the middle attack, effective key length

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)? . Say the encryption scheme has |...
user avatar
1 vote
1 answer
45 views

Meet in the middle attack: Why would it be easier to get elements of one of the 2 sets?

This is from Bruce Schneier's Book Cryptography Engineering. In his description of Meet-in-the-Middle attack, he writes (Chap 2, Page 35) A meet-in-the-middle attack is more flexible than a birthday ...
user avatar
  • 1,637
1 vote
1 answer
166 views

Multidimensional meet-in-the-middle attack on AES

Is an MD-MITM attack possible for AES? As I know, we can break 2 rounds of AES. So we could apply the MD-MITM attack 5 times. This should significantly reduce the security of AES. What stops us from ...
user avatar
  • 969
1 vote
3 answers
102 views

Why doesn't TLS provide E2EE?

Why doesn't TLS provide end-to-end encryption? This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the ...
user avatar
  • 169
1 vote
0 answers
50 views

How do additional input output pairs help with a Meet in the Middle attack on Double DES

Double DES is vulnerable to a Meet in the Middle attack where an attacker generates intermediate values and then matches them up to find candidate key pairs. For Double DES using $56$ bit keys and $1$ ...
user avatar
1 vote
0 answers
92 views

Does fixing partial bits of a SHA256 hash increase the probability of finding a preimage using the meet-in-the-middle attack?

Let’s say I want to find a partial rather than full preimage using the meet-in-the-middle attack. For example, my goal is to find a preimage so that the first 76-bit output of the hash are all ...
user avatar
2 votes
1 answer
327 views

Number of cryptographic operations required to perform a MitM for 4DES

Suppose DES is applied 4 times with 4 different 56-bit keys ($k_1$ to $k_4$). By using meet-in-the-middle attack, what is the number of cryptographic operations required for known-plaintext attack? ...
user avatar
  • 23
1 vote
1 answer
4k views

2Des is double secure of DES?

I read this question in my book (that doesn't have a response). 2DES is doubly more secure than DES? I know that 2DES can be attacked from meet in the middle ...
user avatar
  • 189
4 votes
1 answer
432 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
user avatar
1 vote
0 answers
50 views

Lightweight provably secure design [closed]

Is it possible to device lightweight (i.e. without asymmetric crypto and PKI; and without third party Trent) provably secure (in the exact security sense) scheme? Were there any attempts? Is it ...
user avatar
1 vote
1 answer
218 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
user avatar
1 vote
1 answer
87 views

Simplifying Meet-In-The-Middle Attacks

Considering the fact that a block cipher is a bijective function on the set of possible plaintexts, if one views the encryption of a datum with a key $K_2$, which has been already encrypted with the ...
user avatar
7 votes
2 answers
858 views

Is it possible to perform a meet-in-the-middle within a block cipher?

Standard meet-in-the-middle explanations show that you can perform a meet-in-the-middle attack on a repeated block cipher such as double-DES (performing DES twice in a row). However, block ciphers ...
user avatar
  • 85.2k
0 votes
0 answers
79 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
user avatar
1 vote
0 answers
31 views

Meet-in-the-middle attack (on custom encryption scheme) [duplicate]

This is a question I had from an exercise session. Exercise: First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES ...
user avatar
0 votes
1 answer
80 views

Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session. First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC ...
user avatar
0 votes
2 answers
282 views

Meet-in-the-middle probability of success

In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «...
user avatar
  • 252
1 vote
2 answers
97 views

What is meant by encrypting/decrypting a known plaintext/ciphertext with every possible key in meet-in-the-middle?

I am working on the Meet-in-the-middle attack on 2DES and I have got some questions I am not sure about. I read several websites/articles about it so I have got an idea of what it is and how it works. ...
user avatar
  • 113
4 votes
1 answer
789 views

Double DES meet in the middle attack: probability that wrong key pair remains

My Question is based on poncho's answer in this post. If you're doing a meet-in-the-middle attack against 2DES with only on a plaintext-ciphertext pair $(P,C)$, I understand that the expected amount ...
user avatar
3 votes
1 answer
1k views

baby-step, giant-step vs Pollard-rho

I'm studying algorithms that solve the discrete logarithm problem over elliptic curve. Reading online, it seems that people use the bsgs algorithm when the order of the curve is "low" and P-rho when ...
user avatar
  • 179
1 vote
1 answer
131 views

Meet in the Middle Attack on x=2^n + x'

I encountered today the following equation: $x = 2^n + x'$, where $0 \le x' < 2^k < 2^n$, $2|k$ and $n, k$ is known. There seems to be a meet in the middle attack for this, with runtime $O(2^{\...
user avatar
  • 385
1 vote
1 answer
151 views

Can a MITM attack be applied to this construction?

On reading the accepted answer to this question, I was wondering whether a Meet In The Middle attack could be applied to the suggested construction (below), and if not, then what is the effective key ...
user avatar
  • 3,695
-2 votes
2 answers
985 views

How to calculate the average key search time for the double des?

How to calculate the average key search time for the double des ?Uses standard DES with 56 key bits, and we can test 10^6 keys per second. Many thanks!
user avatar
3 votes
2 answers
2k views

Consider the use of double encryption applied to the AES algorithm with two 128-bit keys

Actual Question below. Consider the use of double encryption applied to the AES algorithm with two 128-bit keys. How much storage and computation would be required to execute a meet-in-the-middle ...
user avatar
6 votes
2 answers
319 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
user avatar
3 votes
1 answer
1k views

Using MITM to attack three keys 3-DES encryption?

I know that MITM can break three keys into two parts $(K_1,K_2)$ and $K_3$ where the worst time complexity is $2^{112}$. My questions is whether we are able to break three keys $(K_1,K_2,K_3)$ into ...
user avatar
0 votes
1 answer
2k views

Double DES meet in the middle attack: number of candidate keys

I'm new to cryptography and found this statement in a book, which says that when having a message block of $64$ bits and using a key of $56$ bits, we will get $\frac{2^{112}}{2^{64}}=2^{48}$ candidate ...
user avatar
2 votes
1 answer
1k views

2DES Meet in the middle attack complexity

In the meet-in-the-middle attack, if we built the tables first and then looked for matches, we would have another high complexity problem. For each of the table 1 entries, compare with all the table 2 ...
user avatar
1 vote
1 answer
773 views

How to calculate the complexity of a meet-in-the-middle attack in terms of the key size k (Use big-O notation)

I dont understand this question at all what is it trying to tell me: The meet-in-the-middle attack means that two successive encryptions using two different k bit keys do not give the security ...
user avatar
2 votes
1 answer
4k views

Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
user avatar
  • 43
2 votes
1 answer
989 views

Can the key-complement property of DES be used against 3DES?

The comments in this recent question about the security of 3DES made me wonder if the key complement property of DES (which reduces its security by ~1 bit) can be used in the meet-in-the-middle attack ...
user avatar
  • 31.3k
8 votes
1 answer
9k views

What is difference between meet in the middle attack and man in the middle attack?

From my understanding man-in-the middle attack works as follow: Alice and Bob agreed to use Diffie-Hellman using $a$ and $q$. Alice sends $Y_A$. Before it reaches Bob, Charlie ...
user avatar
  • 171
6 votes
1 answer
810 views

Is XTS basically the cheapest form of (secure) double-encryption?

XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios. By the way it works it also doubles the keylength although a meet-in-the-middle attack ...
user avatar
  • 44.6k
7 votes
2 answers
494 views

Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack, which basically makes double encryption pointless using a time-memory trade-off. Now, the NSA recently recommended to use double encryption to ...
user avatar
  • 44.6k