4

Let $\mathcal{M}$ be our message space and $\mathcal{K}$ our key space. Now, let $\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$ be a block cipher. Define the block cipher $\mathrm{EX}((k_1, k_2, k_3), m) := k_1 \oplus \mathrm{E}(k_2, m \oplus k_3)$, where $m \in \mathcal{M}$, $k_2 \in \mathcal{K}$, and $k_1$ and $k_3$ are of the same length as the message (I suppose I could write $k_1, k_3 \in \mathcal{M}$).

In the case of DES, we get DESX, giving us a total key size of $64 + 56 + 64 = 184$ bits.

At the end of this lecture (as well as what can be inferred from the Wikipedia entry), prof. Dan Boneh mentions that there is a simple attack on all block ciphers of the form $\mathrm{EX}$ in time $|\mathcal{K}| \cdot |\mathcal{M}|$, meaning a simple attack on DESX in time $2^{120}$.

I finished the course during this summer and generally had no problems, but could not figure this attack out for DESX / the general case. Can anyone explain to me what it is?

d125q
  • 192
  • 1
  • 7

1 Answers1

10

It is vulnerable to a sort of meet-in-the-middle attack since you don't really have to brute force $k_1$. Given a plaintext-ciphertext pair, $P$ and $C$, you can calculate $C' = E(k_2', P \oplus k_3')$ for candidate values $k_2'$ and $k_3'$. Then, you can determine $k_1' = C' \oplus C$. So, you only need to brute force the two keys $k_2$ and $k_3$, making the complexity $2^{|\mathcal{K}\cdot\mathcal{M}|}$.

Equivalently, you could attack it from the other side by trying all possible values for $k_1$ and $k_2$, decrypting $C$, and using XOR with the plaintext to determine $k_3$.

Travis Mayberry
  • 1,315
  • 9
  • 8