Questions tagged [meet-in-the-middle-attack]

The meet-in-the-middle attack is an optimized brute-force attack that significantly reduces the number of keys the attacker needs to try by utilizing a time-space trade-off. Work is done from the beginning and from the end of the scheme, and the results are combined linearly rather than exponentially.

Filter by
Sorted by
Tagged with
0
votes
1answer
61 views

Symmetric Encryption, meet in the middle attack, effective key length

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)? . Say the encryption scheme has |...
16
votes
1answer
4k views

Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32GiB of ciphertext) by the method devised by Paul C. van Oorschot and ...
1
vote
1answer
35 views

Meet in the middle attack: Why would it be easier to get elements of one of the 2 sets?

This is from Bruce Schneier's Book Cryptography Engineering. In his description of Meet-in-the-Middle attack, he writes (Chap 2, Page 35) A meet-in-the-middle attack is more flexible than a birthday ...
1
vote
1answer
56 views

Multidimensional meet-in-the-middle attack on AES

Is an MD-MITM attack possible for AES? As I know, we can break 2 rounds of AES. So we could apply the MD-MITM attack 5 times. This should significantly reduce the security of AES. What stops us from ...
1
vote
1answer
959 views

AES— Brute force attack versus Known plain text attack

I am taking a codes and cryptography course and the following is a questions on a past exam that I could not and still can't solve: Suppose that $E_k$ denotes the function that encrypts a message $M$ ...
1
vote
3answers
75 views

Why doesn't TLS provide E2EE?

Why doesn't TLS provide end-to-end encryption? This question is somewhat related to this, this and this. If you want to talk to someone, say, through facebook, the TLS connection ends in the ...
1
vote
0answers
30 views

How do additional input output pairs help with a Meet in the Middle attack on Double DES

Double DES is vulnerable to a Meet in the Middle attack where an attacker generates intermediate values and then matches them up to find candidate key pairs. For Double DES using $56$ bit keys and $1$ ...
6
votes
2answers
435 views

Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack, which basically makes double encryption pointless using a time-memory trade-off. Now, the NSA recently recommended to use double encryption to ...
1
vote
0answers
59 views

Does fixing partial bits of a SHA256 hash increase the probability of finding a preimage using the meet-in-the-middle attack?

Let’s say I want to find a partial rather than full preimage using the meet-in-the-middle attack. For example, my goal is to find a preimage so that the first 76-bit output of the hash are all ...
2
votes
1answer
148 views

Number of cryptographic operations required to perform a MitM for 4DES

Suppose DES is applied 4 times with 4 different 56-bit keys ($k_1$ to $k_4$). By using meet-in-the-middle attack, what is the number of cryptographic operations required for known-plaintext attack? ...
1
vote
1answer
824 views

2Des is double secure of DES?

I read this question in my book (that doesn't have a response). 2DES is doubly more secure than DES? I know that 2DES can be attacked from meet in the middle ...
7
votes
2answers
458 views

Is it possible to perform a meet-in-the-middle within a block cipher?

Standard meet-in-the-middle explanations show that you can perform a meet-in-the-middle attack on a repeated block cipher such as double-DES (performing DES twice in a row). However, block ciphers ...
4
votes
1answer
288 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
3
votes
1answer
961 views

3DES Modes EED or EDE?

Can we use EED with 2 keys $(k_1, k_1, k_3)$ rather than EDE $(k_1, k_2, k_1)$? We measure the strength of DES by the effort (in terms of the number of tries) in finding some $k_1$ & $k_2$ to ...
1
vote
0answers
39 views

Lightweight provably secure design [closed]

Is it possible to device lightweight (i.e. without asymmetric crypto and PKI; and without third party Trent) provably secure (in the exact security sense) scheme? Were there any attempts? Is it ...
1
vote
1answer
136 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
2
votes
1answer
694 views

Using MITM to attack three keys 3-DES encryption?

I know that MITM can break three keys into two parts $(K_1,K_2)$ and $K_3$ where the worst time complexity is $2^{112}$. My questions is whether we are able to break three keys $(K_1,K_2,K_3)$ into ...
0
votes
2answers
220 views

Meet-in-the-middle probability of success

In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «...
1
vote
1answer
60 views

Simplifying Meet-In-The-Middle Attacks

Considering the fact that a block cipher is a bijective function on the set of possible plaintexts, if one views the encryption of a datum with a key $K_2$, which has been already encrypted with the ...
0
votes
1answer
67 views

Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session. First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC ...
0
votes
0answers
58 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
1
vote
0answers
31 views

Meet-in-the-middle attack (on custom encryption scheme) [duplicate]

This is a question I had from an exercise session. Exercise: First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES ...
-2
votes
2answers
644 views

How to calculate the average key search time for the double des?

How to calculate the average key search time for the double des ?Uses standard DES with 56 key bits, and we can test 10^6 keys per second. Many thanks!
1
vote
2answers
78 views

What is meant by encrypting/decrypting a known plaintext/ciphertext with every possible key in meet-in-the-middle?

I am working on the Meet-in-the-middle attack on 2DES and I have got some questions I am not sure about. I read several websites/articles about it so I have got an idea of what it is and how it works. ...
3
votes
1answer
523 views

Double DES meet in the middle attack: probability that wrong key pair remains

My Question is based on poncho's answer in this post. If you're doing a meet-in-the-middle attack against 2DES with only on a plaintext-ciphertext pair $(P,C)$, I understand that the expected amount ...
3
votes
1answer
638 views

baby-step, giant-step vs Pollard-rho

I'm studying algorithms that solve the discrete logarithm problem over elliptic curve. Reading online, it seems that people use the bsgs algorithm when the order of the curve is "low" and P-rho when ...
2
votes
1answer
643 views

Complexity to find an preimage of a hash function

Suppose a hash function based on Merkle-Damguard construction. Its compression function is given as $H_i=E_{m_i}(H_{i-1})$, where $E_{m_i}()$ denotes the encryption of an ideal block cipher with $n$-...
0
votes
1answer
1k views

Double DES meet in the middle attack: number of candidate keys

I'm new to cryptography and found this statement in a book, which says that when having a message block of $64$ bits and using a key of $56$ bits, we will get $\frac{2^{112}}{2^{64}}=2^{48}$ candidate ...
3
votes
2answers
1k views

Consider the use of double encryption applied to the AES algorithm with two 128-bit keys

Actual Question below. Consider the use of double encryption applied to the AES algorithm with two 128-bit keys. How much storage and computation would be required to execute a meet-in-the-middle ...
1
vote
1answer
122 views

Meet in the Middle Attack on x=2^n + x'

I encountered today the following equation: $x = 2^n + x'$, where $0 \le x' < 2^k < 2^n$, $2|k$ and $n, k$ is known. There seems to be a meet in the middle attack for this, with runtime $O(2^{\...
1
vote
1answer
134 views

Can a MITM attack be applied to this construction?

On reading the accepted answer to this question, I was wondering whether a Meet In The Middle attack could be applied to the suggested construction (below), and if not, then what is the effective key ...
2
votes
2answers
16k views

Meet-in-the-Middle attack on 3DES [duplicate]

How can I apply the Meet-in-the-Middle attack to the 3DES algorithm, and why does the literature say that 3DES is more secure than DES?
8
votes
1answer
287 views

Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?

A 2DES like cipher $c=E^{(2)}_{K_2}(E^{(1)}_{K_1}(p))$ where both halves have an $n$ bit key is vulnerable to a meet-in-the-middle attack. Meet-in-the-middle using a big table Create a table ...
0
votes
1answer
623 views

How to calculate the complexity of a meet-in-the-middle attack in terms of the key size k (Use big-O notation)

I dont understand this question at all what is it trying to tell me: The meet-in-the-middle attack means that two successive encryptions using two different k bit keys do not give the security ...
6
votes
2answers
250 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
2
votes
1answer
1k views

2DES Meet in the middle attack complexity

In the meet-in-the-middle attack, if we built the tables first and then looked for matches, we would have another high complexity problem. For each of the table 1 entries, compare with all the table 2 ...
6
votes
2answers
2k views

Meet-in-the-middle with checking complexity

In regards to meet in the middle type attacks, I have been considering the amount of operations in order to successfully find a key given two sets of plaintext / ciphertext pairs. All of the sources I ...
2
votes
1answer
2k views

2DES vs. two-key triple encryption, with no decryption step

So studying double encryption (double DES) and understanding why it is subject to a meet-in-the-middle attack, I tried to see if the same attack could be applied to a triple encryption with only two ...
2
votes
1answer
4k views

Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
2
votes
1answer
704 views

Can the key-complement property of DES be used against 3DES?

The comments in this recent question about the security of 3DES made me wonder if the key complement property of DES (which reduces its security by ~1 bit) can be used in the meet-in-the-middle attack ...
7
votes
1answer
7k views

What is difference between meet in the middle attack and man in the middle attack?

From my understanding man-in-the middle attack works as follow: Alice and Bob agreed to use Diffie-Hellman using $a$ and $q$. Alice sends $Y_A$. Before it reaches Bob, Charlie ...
6
votes
1answer
523 views

Is XTS basically the cheapest form of (secure) double-encryption?

XTS, as given by the below equation, is a mode of operation primarily targeting full-disk encryption scenarios. By the way it works it also doubles the keylength although a meet-in-the-middle attack ...
0
votes
0answers
53 views

Is double encryption using AES using different key lengths (128 bit and then 256 bit) vulnerable? [duplicate]

I know that AES 256 bit is far more than enough to secure a file. I just want to know if there are any vulnerabilities or known attacks which can make such this combination less secure "double ...
3
votes
1answer
929 views

Understanding Meet-in-the-Middle attack on block ciphers

I understand how to implement a Meet-in-the-Middle attack on 2DES/3DES, by computing for one half all possible keys and storing the outcome and then subsequently do the same for the other half but ...
5
votes
1answer
2k views

Why does applying 56-bit DES twice only give 57 bits of security? [duplicate]

Given two 56-bit keys, $k_1$ and $k_2$, why does $E_{k_1}(E_{k_2}(M))$ only give 57 bits of security? So basically I'm unsure why it only gives 57 bits of security; I understand that one key will ...
1
vote
1answer
843 views

Why sorting is needed for Meet-in-the-middle attack

The weakness of double DES, E (k1, E(k2, M)) is that Meet-in-the-middle attack is possible. When performing Meet-in-the-middle ...
2
votes
2answers
972 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly appreciated....
1
vote
1answer
711 views

What's the point of a Meet In The Middle attack using i.e. double AES with throw-away keys?

What's the point of a Meet In The Middle attack while using, for example, a double AES encryption and using one time keys? You can recover the keys for a secret message already known and you can't use ...
2
votes
0answers
109 views

Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash? [closed]

I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ...
2
votes
1answer
587 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = $E_{k_1}(...