Consider a new block cipher, DES$2,$ that consists of only two

rounds of the DES block cipher. DES$2$ has the same block and

key size as DES. For this question, you should consider the DES

$F$ function as a black box that takes two inputs, a $32-$bit data

segment, and a $48-$bit round key, and produces a $32-$bit output.

Using the chosen$-$plaintext attack $($CPA$)$ without any restrictions

on the number of oracle calls.

a$)$ Give an algorithm to recover the $48-$bit round keys for

round $1(k_1)$ and round $2(k_2).$ Your algorithm should have

fewer operations than the exhaustive key search for DES$2.$

b$)$ Can your algorithm be converted into a distinguishing

attack against DES$2,$ i$.$e$.,$ an attack that distinguishes DES$2$

ciphertext

from a random permutation?