Cryptography Reference
In-Depth Information
counterintuitive fact in the next section. Another very simple yet effective approach
to increase the brute-force resistance of block ciphers is called key whitening; it is
also discussed below.
We note here that when using AES, we already have three different security levels
given by the key lengths of 128, 192 and 256 bits. Given that there are no realistic
attacks known against AES with any of those key lengths, there appears no reason
to perform multiple encryption with AES for practical systems. However, for some
selected older ciphers, especially for DES, multiple encryption can be a useful tool.
5.3.1 Double Encryption and Meet-in-the-Middle Attack
Let's assume a block cipher with a key length of
bits. For
double encryption
,a
plaintext
x
is first encrypted with a key
k
L
, and the resulting ciphertext is encrypted
again using a second key
k
R
. This scheme is shown in Fig. 5.10.
κ
Fig. 5.10
Double encryption and meet-in-the-middle attack
Anaıve brute-force attack would require us to search through all possible com-
binations of both keys, i.e., the effective key lengths would be 2
κ
and an exhaustive
key search would require 2
κ
·
2
κ
= 2
2κ
encryptions (or decryptions). However, using
the
meet-in-the-middle
attack, the key space is drastically reduced. This is a divide-
and-conquer attack in which Oscar first brute-force-attacks the encryption on the
left-hand side, which requires 2
κ
cipher operations, and then the right encryption,
which again requires 2
κ
operations. If he succeeds with this attack, the total com-
plexity is 2
κ
+ 2
κ
= 2
2
κ
= 2
κ+1
. This is barely more complex than a key search of
a single encryption and of course is much less complex than performing 2
2κ
·
search
operations.
The attack has two phases. In the first one, the left encryption is brute-forced and
a lookup table is computed. In the second phase the attacker tries to find a match in
the table which reveals both encryption keys. Here are the details of this approach.
