3DES with three different keys can be broken with about 22k encryptions and 2k memory cells, k = 56. Design the corresponding attack. How many pairs (x,y) should be available so that the probability to determine an incorrect key triple (k1,k2,k3) is sufficiently low?

ote that this is a purely theoretical problem. Key spaces of size 2128 and beyond can not be brute-forced. 5.15. 3DES with three different keys can be broken with about 22k encryptions and 2k memory cells, k-56. Design the corresponding attack. How many pa (x,y) should be available so that the probability to determine an incorrect key triple (k1,k2,k3) is sufficiently low? 5 More About Block Ciphers 148 5.16. This is your chance to break a cryptosystem. As we know by now, cryptogra- phy is a tricky business. The following problem illustrates how easy it is to turn a strong scheme into a weak one with minor modifications. We saw in this chapter that key whitening is a good technique for strengthening block ciphers against brute-force attacks. We now look at the following variant of prs uhich we'll call DESA: ote that this is a purely theoretical problem. Key spaces of size 2128 and beyond can not be brute-forced. 5.15. 3DES with three different keys can be broken with about 22k encryptions and 2k memory cells, k-56. Design the corresponding attack. How many pa (x,y) should be available so that the probability to determine an incorrect key triple (k1,k2,k3) is sufficiently low? 5 More About Block Ciphers 148 5.16. This is your chance to break a cryptosystem. As we know by now, cryptogra- phy is a tricky business. The following problem illustrates how easy it is to turn a strong scheme into a weak one with minor modifications. We saw in this chapter that key whitening is a good technique for strengthening block ciphers against brute-force attacks. We now look at the following variant of prs uhich we'll call DESA