NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/sci/crypt/6609

Internet Message Format | 1993-01-10 | 1.9 KB

Path: sparky!uunet!dtix!darwin.sura.net!spool.mu.edu!uwm.edu!linac!att!att!dptg!ulysses!ulysses!smb
From: [e-mail] (Steven Bellovin)
Newsgroups: sci.crypt
Subject: Re: tripple encrypt
Message-ID: <[e-mail]>
Date: 10 Jan 93 13:42:57 GMT
References: <[e-mail]>
Organization: AT&T Bell Laboratories
Lines: 32

In article <[e-mail]>, [e-mail] (Yinco Schmeer) writes:
> >>They suggest using triple encryption for key distribution.<<
> (Steven Bellovin)
>
> I was under the impression that Double and Tripple encryption was no more
> secure than single encryption. I believe that there was a mathmatical
> proof of this...

Not to my knowledge.  In fact, the only mathematical proofs I know of
go the other way.

Originally, there was some concern that DES was a group.  That is,
encrypting first with A, and then with B, was equivalent to encrypting
instead with some third key C.  That is now known not to be a problem.
It has been proved that DES is *not* a group.

Now, for simple double encryption, one would think that 2^112
operations were needed for exhaustive search.  But there's a
time-memory tradeoff that will cut that to an effective key length of
2^56 operations and 2^56 words of memory.  This attack would work even
for ``encrypt with A, decrypt with B''.  Hence, the suggestion is to
use ``encrypt with A, decrypt with B, re-encrypt with A''.  IBM uses
this scheme to protect master keys.  Merkle and Hellman showed an
attack that can defeat even this scheme, but it required 2^56 chosen
plaintexts.  That doesn't seem to be feasible.  They suggest using three
different keys in either encrypt/encrypt/encrypt mode or
encrypt/decrypt/encrypt mode.

References:  Davies and Price, ``Security for Computer Networks'' (my
favorite general-purpose reference); Merkle and Hellman, ``On the
Security of Multiple Encryption'', CACM July 1981, pp 465-467; and the
RSA FAQ on cryptography.