Skip to main content
12 votes

Triple AES-128 encryption with 2 keys

The academic and regulatory complexity of triple encryption with two keys is nowhere near that of a cipher with twice the key size. There is a line of thought that 2-key 3DES has like 80-bit or even ...
fgrieu's user avatar
  • 141k
7 votes
Accepted

Is it possible to perform a meet-in-the-middle within a block cipher?

Meet-in-the-middle attacks can indeed be used for block cipher (but also hash function) cryptanalysis. As mentioned in the question, this goes back to Diffie and Hellman's analysis of DES. However, ...
Aleph's user avatar
  • 1,876
6 votes

Post quantum hybrid model and its security

If I understand correctly, in hybrid schemes the input date is first encrypted/signed by classical section's algorithm and then the output of classical section is encrypted/signed by the post-quantum ...
poncho's user avatar
  • 147k
5 votes
Accepted

Double DES meet in the middle attack: number of candidate keys

My question is, where do we get the $2^{64}$ mentioned in the very first sentence? There are a couple of equivalent ways of looking at the problem. One way is to treat 2DES with an incorrect key as ...
poncho's user avatar
  • 147k
4 votes
Accepted

FIPS 202/SHAKE: insecure 3DES key derivation example

There may well be situations where Eve does not have to trick anybody; in the scenario in FIPS 202 the parties badly use the XOF so the mistake is not necessarily triggered by Eve. The equations in ...
Maarten Bodewes's user avatar
  • 92.7k
4 votes

Why doesn't TLS provide E2EE?

The question is not correct. Two people can establish direct connection between their laptops in the same network and use TLS (assuming they have share public key in advance). In such case TLS does ...
mentallurg's user avatar
  • 2,611
4 votes
Accepted

Why doesn't TLS provide E2EE?

TLS encrypts a channel, and that channel is between your browser or app and the Facebook server. E2EE usually refers to the ability to send an encrypted message between two users such that the server ...
bmm6o's user avatar
  • 1,067
4 votes
Accepted

Meet in the middle time complexity

What am I missing in my reasoning? Two things: There are other strategies other than sorting to find collisions; one obvious one is to build a huge hash table. Now, in practice, sorting would ...
poncho's user avatar
  • 147k
3 votes
Accepted

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

meet-in-the-middle attacks rely on storing the results in a map Only the naive version of MitM does. The impractical memory requirement (size and accesses) of naive MitM can be greatly lowered with ...
fgrieu's user avatar
  • 141k
3 votes

baby-step, giant-step vs Pollard-rho

BSGS algorithm requires huge storage space for curves with large order. This storage requirement usually exceeds the total available storage capacity across the whole world by several orders of ...
bilinbs's user avatar
  • 31
3 votes

FIPS 202/SHAKE: insecure 3DES key derivation example

My cursory glance says you are absolutely correct in your assumption, which is why the example was given in FIPS-202 to begin with, because it is problematic. $keymaterial$ would still be safe, but $...
Richie Frame's user avatar
  • 13.1k
3 votes

Complexity to find an preimage of a hash function

For an $n$-bit hash with at least $n/2$-bit block size (which is very common and includes MD5, SHA-1, SHA-2, SHA-512), using a round function as in the question, here is how to find a 2-block message ...
fgrieu's user avatar
  • 141k
3 votes

How to calculate the complexity of a meet-in-the-middle attack in terms of the key size k (Use big-O notation)

The meet-in-the-middle attack means that two successive encryptions using two different k bit keys do not give the security against a brute-force attack that you would expect from a 2k bit key. ...
poncho's user avatar
  • 147k
3 votes
Accepted

Is multiple encryption with XTS mode susceptible to Meet-in-the-middle attacks?

Short answer is "yes, this setup is vulnerable". If you want some math, you can read an explanation below. In XTS two keys are independent, so it already has 512 bit security (there are no ...
Georgy Firsov's user avatar
3 votes
Accepted

Is multiple encryption using a block cipher mode of operation that use only encryption processes vulnerable to Meet-in-the-middle attacks?

Consider double encryption with the CTR mode; The first layer outputs a stream $o$ of the encryption of the counter block per NIST definition of the CTR document. $$o_i = \operatorname{AES-CTR}(k_1,...
kelalaka's user avatar
  • 48.5k
3 votes

If meet in the middle is a known plaintext attack, and i already have both plaintext and ciphertext, why would i need to find the key?

The intuition behind known-plaintext attacks is that often an attacker is aware of the plaintexts of some observed ciphertexts (generalizing to being able to /choose/ those, for chosen-plaintext ...
Morrolan's user avatar
  • 1,147
2 votes
Accepted

Using MITM to attack three keys 3-DES encryption?

No, we are not able to break 3-keys 3-DES encryption using something similar to Meet-in-the-Midle with cost much lower than $2^{112}$ encryptions; much less triple encryption in general. In the case ...
fgrieu's user avatar
  • 141k
2 votes

Meet-in-the-middle probability of success

We are given two plaintext/ciphertext pairs $(P_1, C_1)$ and $(P_2, C_2)$ with $E_{k_1^*}(P_i) = D_{k_2^*}(C_i)$ where the true key is $k^* = (k_1^*, k_2^*)$. Suppose the cipher key is $n$ bits long, ...
Squeamish Ossifrage's user avatar
2 votes

Meet-in-the-middle probability of success

In the sentence, the "probability of success" of «1 in $2^{2m - 2n}$» or «1 in $2^{3m - 2n}$» really is an approximation of the probability of concluding that the key was found, when in fact another ...
fgrieu's user avatar
  • 141k
2 votes

Double DES meet in the middle attack: probability that wrong key pair remains

Yes your argument is correct, to an excellent approximation. The reason I say approximation is that the second search in the sample space should really be conducted in the restricted set of DES ...
kodlu's user avatar
  • 22.5k
2 votes

Consider the use of double encryption applied to the AES algorithm with two 128-bit keys

Double encryption applied to the AES-128 algorithm and two random keys is theoretically breakable from 3 plaintext/ciphertext pairs by the generic Meet-in-the-Middle attack with 2128 encryptions for ...
fgrieu's user avatar
  • 141k
2 votes
Accepted

Meet in the Middle Attack on x=2^n + x'

Well, if you absolutely had to do a MITM attack, I suppose one could look like: Rewrite the equation as: $$x - x'_{low} = 2^h + 2^{k/2}x'_{high}$$ where $x' = 2^{k/2}x'_{high} + x'_{low}$ and $0 \...
poncho's user avatar
  • 147k
2 votes
Accepted

Number of cryptographic operations required to perform a MitM for 4DES

In MitM for 2DES, in a tabulation phase we compute and keep $2^{56}$ 64-bit values and their associated key, then in a search phase we compute up to $2^{56}$ 64-bit values and search these in the ...
fgrieu's user avatar
  • 141k
2 votes
Accepted

2Des is double secure of DES?

The Meet-in-the-Middle attack was (first?) exposed publicly in the context of DES by Whitfield Diffie and Martin E. Hellman, in Exhaustive Cryptanalysis of the NBS Data Encryption Standard (published ...
fgrieu's user avatar
  • 141k
2 votes

Is it possible to perform a meet-in-the-middle within a block cipher?

The Demirci-Selcuk attack on reduced round AES (from FSE 2008) uses the "Square distinguisher" on AES, if you are on Researchgate you can find a pdf, I have not seen any accessible versions. The ...
kodlu's user avatar
  • 22.5k
2 votes

Multidimensional meet-in-the-middle attack on AES

Why GOST was broken with such method and AES not? MD-MITM attacks have been published e.g. against KATAN and GOST in https://eprint.iacr.org/2011/619. The authors stated that their attack is "...
Yves's user avatar
  • 51
2 votes

Simplifying Meet-In-The-Middle Attacks

This question asked for the DES years ago. To achieve this kind of attack you need to first show that the target encryption algorithm is closed under functional composition i.e. forming a group. The ...
kelalaka's user avatar
  • 48.5k
2 votes
Accepted

How many collisions (identical pairs) are possible in meet in the middle attack on double DES with two unique keys?

Now our job is to find all $x_i,y_j$ such that $x_i = y_j$. I suppose we can use $2^{56}$ binary searches so we could do this in $2^{56}\lg{2^{56}}= 2^{56} \times 56$ steps? Actually, you're more ...
poncho's user avatar
  • 147k
2 votes
Accepted

Paper "How to Meet Ternary LWE Keys": What is t and how is it used

So after some weeks I succeeded in finding some answers to my question. Is t really completely random or did I miss something? Yes, t is here to reduce the ambiguity of the search space. Everything ...
Asimonu's user avatar
  • 61

Only top scored, non community-wiki answers of a minimum length are eligible