# Questions tagged [meet-in-the-middle-attack]

The meet-in-the-middle attack is an optimized brute-force attack that significantly reduces the number of keys the attacker needs to try by utilizing a time-space trade-off. Work is done from the beginning and from the end of the scheme, and the results are combined linearly rather than exponentially.

75 questions
Filter by
Sorted by
Tagged with
1 vote
1 answer
58 views

### What is the security of multiple encryption using Even–Mansour scheme (XEX)?

As I know, the best attack on single or double Even-Mansour scheme is N/2, being N the key size (or size of one of the two keys used). I know that encrypting two times using this scheme is susceptible ...
• 523
2 votes
1 answer
59 views

### Paper "How to Meet Ternary LWE Keys": What is t and how is it used

I have read again and again this paper from A. May, but, probably because I am new to this field, I don't succeed in understanding the MEET-LWE part. In particular, in part 5 it states to choose a &...
• 51
0 votes
0 answers
42 views

### Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
• 523
3 votes
1 answer
70 views

### Devising a Feistel cipher in which the subkeys are constructed badly so that a meet in the middle attack will compromise its security

I'm trying to find a Feistel cipher in which the subkeys are constructed badly so that a meet in the middle attack will compromise its security. I thought about trying out a cipher where all the ...
• 151
0 votes
0 answers
59 views

### Time and space complexity analyzation of meet and middle attack of triple DES

How can we analyze the time and space complexity of meet and middle attack on a Triple-DES?
0 votes
0 answers
29 views

### Is multiple encryption with XORs between each encryption operation susceptible to meet-in-the-middle attacks?

Let's suppose I take a cipher with key size equal to the block size (Threefish). I XOR a random block in the ciphertext, encrypt with a key, XOR another random block, encrypt again with another key ...
• 523
2 votes
1 answer
86 views

### Is multiple encryption using a block cipher mode of operation that use only encryption processes vulnerable to Meet-in-the-middle attacks?

Some block cipher modes of operation use only encryption processes, such as CFB, OFB and CTR. If doing multiple encryptions using them, will these encipherment schemes be vulnerable to Meet-in-the-...
• 523
0 votes
1 answer
58 views

### Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?

Let's suppose I encrypt something with AES-256 in XTS mode two times (there will be 4 four keys, 2 for each encryption operation), wanting to achive 512-bits of security. Will this scheme be ...
• 523
0 votes
0 answers
41 views

### Is there a way of preventing meet-in-the-middle attack when using double-encryption?

Let's suppose I encrypt something with AES-256 two times using 2 different keys wanting to achieve 512-bits of security. I know that this scheme will in fact give me only 257-bits of encryption ...
• 523
3 votes
0 answers
45 views

### Paper "How to Meet Ternary LWE Keys": Why can Odlyzko's hash function not be used to construct the mitm lists recursively?

In Alexander May's Paper "How to Meet Ternary LWE Keys", Alexander May writes the following about combining representation techniques with Odlyzko's locality sensitive hash function (Page ...
0 votes
0 answers
159 views

### Textbook RSA meet in the middle time complexity

Hello, I have a question regarding time complexity of meet in the middle attack on textbook RSA encryption. Let's suppose that I try to encrypt symmetric keys of different length with no padding using ...
• 15
1 vote
2 answers
455 views

### Meet in the middle time complexity

Hello, I am wondering why it is stated that double encrypted message with 2 DES keys is possible to break in worst case in $2\times2^{56}$ time using meet in the middle attack. Here is my reasoning: ...
• 15
0 votes
0 answers
84 views

### Is multiple encryption with stream ciphers vulnerable to meet-in-the-middle attacks?

Let's suppose I encrypt something with a stream cipher (CSPRNG) two times using two 256-bit keys and different IVs. Will I get 512-bit encryption strength?
• 523
1 vote
0 answers
77 views

### Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs. Will I get 512 bits of encryption strength?
• 523
8 votes
1 answer
1k views

### Triple AES-128 encryption with 2 keys

We have a system where two devices communicate. Due to restrictions on one of them, we can only use AES-128 (so no AES-256) for encrypting the communication. However, new requirements on these kinds ...
• 189
1 vote
1 answer
153 views

### How many collisions (identical pairs) are possible in meet in the middle attack on double DES with two unique keys?

I was reading my professors slides, I understand how meet in the middle works, but I have a few confusions. So we need two $\{(P_1, C_1), (P_2, C_2)\}$. Let $\lg{(k_1)} = \lg{(k_2)} = 56$, we generate ...
• 145
0 votes
1 answer
200 views

### Symmetric Encryption, meet in the middle attack, effective key length

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)? . Say the encryption scheme has |...
• 11
1 vote
1 answer
45 views

### Meet in the middle attack: Why would it be easier to get elements of one of the 2 sets?

This is from Bruce Schneier's Book Cryptography Engineering. In his description of Meet-in-the-Middle attack, he writes (Chap 2, Page 35) A meet-in-the-middle attack is more flexible than a birthday ...
• 1,637
1 vote
1 answer
166 views

### Multidimensional meet-in-the-middle attack on AES

Is an MD-MITM attack possible for AES? As I know, we can break 2 rounds of AES. So we could apply the MD-MITM attack 5 times. This should significantly reduce the security of AES. What stops us from ...
• 969
1 vote
3 answers
102 views

### Why doesn't TLS provide E2EE?

Why doesn't TLS provide end-to-end encryption? This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the ...
• 169
1 vote
0 answers
50 views

### How do additional input output pairs help with a Meet in the Middle attack on Double DES

Double DES is vulnerable to a Meet in the Middle attack where an attacker generates intermediate values and then matches them up to find candidate key pairs. For Double DES using $56$ bit keys and $1$ ...
1 vote
0 answers
92 views

### Does fixing partial bits of a SHA256 hash increase the probability of finding a preimage using the meet-in-the-middle attack?

Let’s say I want to find a partial rather than full preimage using the meet-in-the-middle attack. For example, my goal is to find a preimage so that the first 76-bit output of the hash are all ...
• 153
2 votes
1 answer
327 views

### Number of cryptographic operations required to perform a MitM for 4DES

Suppose DES is applied 4 times with 4 different 56-bit keys ($k_1$ to $k_4$). By using meet-in-the-middle attack, what is the number of cryptographic operations required for known-plaintext attack? ...
• 23
1 vote
1 answer
4k views

### 2Des is double secure of DES?

I read this question in my book (that doesn't have a response). 2DES is doubly more secure than DES? I know that 2DES can be attacked from meet in the middle ...
• 189
4 votes
1 answer
432 views

• 385
1 vote
1 answer
151 views

### Can a MITM attack be applied to this construction?

On reading the accepted answer to this question, I was wondering whether a Meet In The Middle attack could be applied to the suggested construction (below), and if not, then what is the effective key ...
• 3,695
-2 votes
2 answers
985 views

### How to calculate the average key search time for the double des?

How to calculate the average key search time for the double des ?Uses standard DES with 56 key bits, and we can test 10^6 keys per second. Many thanks!
3 votes
2 answers
2k views

### Consider the use of double encryption applied to the AES algorithm with two 128-bit keys

Actual Question below. Consider the use of double encryption applied to the AES algorithm with two 128-bit keys. How much storage and computation would be required to execute a meet-in-the-middle ...
6 votes
2 answers
319 views

### FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
3 votes
1 answer
1k views

### Using MITM to attack three keys 3-DES encryption?

I know that MITM can break three keys into two parts $(K_1,K_2)$ and $K_3$ where the worst time complexity is $2^{112}$. My questions is whether we are able to break three keys $(K_1,K_2,K_3)$ into ...
0 votes
1 answer
2k views

### Double DES meet in the middle attack: number of candidate keys

I'm new to cryptography and found this statement in a book, which says that when having a message block of $64$ bits and using a key of $56$ bits, we will get $\frac{2^{112}}{2^{64}}=2^{48}$ candidate ...
• 103
2 votes
1 answer
1k views

### 2DES Meet in the middle attack complexity

In the meet-in-the-middle attack, if we built the tables first and then looked for matches, we would have another high complexity problem. For each of the table 1 entries, compare with all the table 2 ...
1 vote
1 answer
773 views

### How to calculate the complexity of a meet-in-the-middle attack in terms of the key size k (Use big-O notation)

I dont understand this question at all what is it trying to tell me: The meet-in-the-middle attack means that two successive encryptions using two different k bit keys do not give the security ...
2 votes
1 answer
4k views

### Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
• 43
2 votes
1 answer
989 views

### Can the key-complement property of DES be used against 3DES?

The comments in this recent question about the security of 3DES made me wonder if the key complement property of DES (which reduces its security by ~1 bit) can be used in the meet-in-the-middle attack ...
• 31.3k
8 votes
1 answer
9k views

### What is difference between meet in the middle attack and man in the middle attack?

From my understanding man-in-the middle attack works as follow: Alice and Bob agreed to use Diffie-Hellman using $a$ and $q$. Alice sends $Y_A$. Before it reaches Bob, Charlie ...
• 171
6 votes
1 answer
810 views

### Is XTS basically the cheapest form of (secure) double-encryption?

XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios. By the way it works it also doubles the keylength although a meet-in-the-middle attack ...
• 44.6k
7 votes
2 answers
494 views

### Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack, which basically makes double encryption pointless using a time-memory trade-off. Now, the NSA recently recommended to use double encryption to ...
• 44.6k