Questions tagged [meet-in-the-middle-attack]

The meet-in-the-middle attack is an optimized brute-force attack that significantly reduces the number of keys the attacker needs to try by utilizing a time-space trade-off. Work is done from the beginning and from the end of the scheme, and the results are combined linearly rather than exponentially.

Filter by
Sorted by
Tagged with
1
vote
0answers
34 views

Lightweight provably secure design [closed]

Is it possible to device lightweight (i.e. without asymmetric crypto and PKI; and without third party Trent) provably secure (in the exact security sense) scheme? Were there any attempts? Is it ...
1
vote
1answer
62 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
1
vote
1answer
44 views

Simplifying Meet-In-The-Middle Attacks

Considering the fact that a block cipher is a bijective function on the set of possible plaintexts, if one views the encryption of a datum with a key $K_2$, which has been already encrypted with the ...
5
votes
2answers
206 views

Is it possible to perform a meet-in-the-middle within a block cipher?

Standard meet-in-the-middle explanations show that you can perform a meet-in-the-middle attack on a repeated block cipher such as double-DES (performing DES twice in a row). However, block ciphers ...
0
votes
0answers
44 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
1
vote
0answers
31 views

Meet-in-the-middle attack (on custom encryption scheme) [duplicate]

This is a question I had from an exercise session. Exercise: First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES ...
0
votes
1answer
58 views

Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session. First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC ...
0
votes
2answers
175 views

Meet-in-the-middle probability of success

In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «...
1
vote
2answers
64 views

What is meant by encrypting/decrypting a known plaintext/ciphertext with every possible key in meet-in-the-middle?

I am working on the Meet-in-the-middle attack on 2DES and I have got some questions I am not sure about. I read several websites/articles about it so I have got an idea of what it is and how it works. ...
3
votes
1answer
357 views

Double DES meet in the middle attack: probability that wrong key pair remains

My Question is based on poncho's answer in this post. If you're doing a meet-in-the-middle attack against 2DES with only on a plaintext-ciphertext pair $(P,C)$, I understand that the expected amount ...
3
votes
1answer
475 views

baby-step, giant-step vs Pollard-rho

I'm studying algorithms that solve the discrete logarithm problem over elliptic curve. Reading online, it seems that people use the bsgs algorithm when the order of the curve is "low" and P-rho when ...
1
vote
1answer
113 views

Meet in the Middle Attack on x=2^n + x'

I encountered today the following equation: $x = 2^n + x'$, where $0 \le x' < 2^k < 2^n$, $2|k$ and $n, k$ is known. There seems to be a meet in the middle attack for this, with runtime $O(2^{\...
1
vote
1answer
128 views

Can a MITM attack be applied to this construction?

On reading the accepted answer to this question, I was wondering whether a Meet In The Middle attack could be applied to the suggested construction (below), and if not, then what is the effective key ...
-2
votes
2answers
355 views

How to calculate the average key search time for the double des?

How to calculate the average key search time for the double des ?Uses standard DES with 56 key bits, and we can test 10^6 keys per second. Many thanks!
3
votes
2answers
689 views

Consider the use of double encryption applied to the AES algorithm with two 128-bit keys

Actual Question below. Consider the use of double encryption applied to the AES algorithm with two 128-bit keys. How much storage and computation would be required to execute a meet-in-the-middle ...
6
votes
2answers
217 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
2
votes
1answer
586 views

Using MITM to attack three keys 3-DES encryption?

I know that MITM can break three keys into two parts $(K_1,K_2)$ and $K_3$ where the worst time complexity is $2^{112}$. My questions is whether we are able to break three keys $(K_1,K_2,K_3)$ into ...
0
votes
1answer
1k views

Double DES meet in the middle attack: number of candidate keys

I'm new to cryptography and found this statement in a book, which says that when having a message block of $64$ bits and using a key of $56$ bits, we will get $\frac{2^{112}}{2^{64}}=2^{48}$ candidate ...
2
votes
1answer
1k views

2DES Meet in the middle attack complexity

In the meet-in-the-middle attack, if we built the tables first and then looked for matches, we would have another high complexity problem. For each of the table 1 entries, compare with all the table 2 ...
0
votes
1answer
561 views

How to calculate the complexity of a meet-in-the-middle attack in terms of the key size k (Use big-O notation)

I dont understand this question at all what is it trying to tell me: The meet-in-the-middle attack means that two successive encryptions using two different k bit keys do not give the security ...
1
vote
1answer
3k views

Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
2
votes
1answer
500 views

Can the key-complement property of DES be used against 3DES?

The comments in this recent question about the security of 3DES made me wonder if the key complement property of DES (which reduces its security by ~1 bit) can be used in the meet-in-the-middle attack ...
7
votes
1answer
6k views

What is difference between meet in the middle attack and man in the middle attack?

From my understanding man-in-the middle attack works as follow: Alice and Bob agreed to use Diffie-Hellman using $a$ and $q$. Alice sends $Y_A$. Before it reaches Bob, Charlie ...
6
votes
1answer
406 views

Is XTS basically the cheapest form of (secure) double-encryption?

XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios. By the way it works it also doubles the keylength although a meet-in-the-middle attack ...
6
votes
2answers
395 views

Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack which basically makes double encryption pointless using a time-memory-tradeoff. Now there was recently the recommendation by the NSA to use double ...
0
votes
0answers
51 views

Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable? [duplicate]

I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double ...
3
votes
1answer
850 views

Understanding Meet-in-the-Middle attack on block ciphers

I understand how to implement a Meet-in-the-Middle attack on 2DES/3DES, by computing for one half all possible keys and storing the outcome and then subsequently do the same for the other half but ...
2
votes
1answer
1k views

2DES vs. two-key triple encryption, with no decryption step

So studying double encryption (double DES) and understanding why it is subject to a meet-in-the-middle attack, I tried to see if the same attack could be applied to a triple encryption with only two ...
2
votes
2answers
13k views

Meet-in-the-Middle attack on 3DES [duplicate]

How can I apply the Meet-in-the-Middle attack to the 3DES algorithm, and why does the literature say that 3DES is more secure than DES?
8
votes
1answer
241 views

Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?

A 2DES like cipher $c=E^{(2)}_{K_2}(E^{(1)}_{K_1}(p))$ where both halves have an $n$ bit key is vulnerable to a meet-in-the-middle attack. Meet-in-the-middle using a big table Create a table ...
5
votes
1answer
2k views

Why does applying 56-bit DES twice only give 57 bits of security? [duplicate]

Given two 56-bit keys, $k_1$ and $k_2$, why does $E_{k_1}(E_{k_2}(M))$ only give 57 bits of security? So basically I'm unsure why it only gives 57 bits of security; I understand that one key will ...
3
votes
1answer
791 views

3DES Modes EED or EDE?

Can we use EED with 2 keys $(k_1, k_1, k_3)$ rather than EDE $(k_1, k_2, k_1)$? We measure the strength of DES by the effort (in terms of the number of tries) in finding some $k_1$ & $k_2$ to ...
1
vote
1answer
820 views

Why sorting is needed for Meet-in-the-middle attack

The weakness of double DES, E (k1, E(k2, M)) is that Meet-in-the-middle attack is possible. When performing Meet-in-the-middle ...
2
votes
1answer
507 views

Complexity to find an preimage of a hash function

Suppose a hash function based on Merkle-Damguard construction. Its compression function is given as $H_i=E_{m_i}(H_{i-1})$, where $E_{m_i}()$ denotes the encryption of an ideal block cipher with $n$-...
1
vote
1answer
814 views

AES— Brute force attack versus Known plain text attack

I am taking a codes and cryptology course and the following is a questions on a past exam that I could not and still can't solve: ...
1
vote
1answer
632 views

What's the point of a Meet In The Middle attack using i.e. double AES with throw-away keys?

What's the point of a Meet In The Middle attack while using, for example, a double AES encryption and using one time keys? You can recover the keys for a secret message already known and you can't use ...
2
votes
1answer
6k views

Why is Triple DES not vulnerable to meet in the middle attacks?

Consider the Triple DES encryption calculated as: $$C= E_{K_1}(D_{K_2}(E_{K_1}(P))).$$ For a chosen plaintext attack, given plaintext $P$, we compute the result of $D_{K_2}(E_{K_1}(P))$ and store ...
2
votes
2answers
910 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly appreciated....
3
votes
1answer
762 views

Can you help me with this DES variant analysis?

I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14). The variant is as follows: The left half of the master key is used to derive all the sub-...
4
votes
2answers
6k views

Attacking 2DES efficiently

Meet in the middle on 2DES uses $2^{56}$ memory. Given the fact that the attacker has only $2^{45}$ memory. How can the attacker adjust the attack so even with this memory limit, it will still be more ...
2
votes
0answers
108 views

Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash? [closed]

I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ...
7
votes
2answers
1k views

Encrypting 8 times with 8-bit key beneficial?

I was trying to understand cryptography from the book Information Security by Mark Stamp and I am confused by something. Suppose that Alice has a secure block cipher, but the cipher only uses an ...
6
votes
2answers
2k views

Meet-in-the-middle with checking complexity

In regards to meet in the middle type attacks, I have been considering the amount of operations in order to successfully find a key given two sets of plaintext / ciphertext pairs. All of the sources I ...
3
votes
1answer
1k views

Textbook-RSA meet-in-the-middle attack against other RSA based schemes?

A “meet-in-the-middle” (not “man-in-the-middle”!) attack on textbook-RSA was presented to me. The only requirements for it was that the attacker gets the output of RSA and the public key, and that the ...
1
vote
1answer
473 views

chaining rsa with ecies

In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
18
votes
1answer
18k views

Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?

Among other sources, this wikipedia entry states that triple DES using three seperate keys (k1, k2, k3) is vulnerable to meet-in-the-middle-attacks, while triple DES using only two keys (k1, k2, k1) ...
2
votes
1answer
568 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = $E_{k_1}(...
6
votes
1answer
572 views

Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?

It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack. This is an attack ...
16
votes
1answer
3k views

Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32MiB of ciphertext) by the method devised by Paul C. van Oorschot and ...
4
votes
1answer
2k views

Cryptanalysis Affine Cipher: Brute-Force Search Vs. Meet-in-the-middle

Affine Cipher: $Enc(x) = (ax + b) \mod m$ $Dec(x) = a^{-1}(x-b) \mod m$ For a brute-force key search, we need to do $a \cdot b$ encryptions in the worst case. For a meet-in-the-middle attack, how ...