🚀 go-pugleaf

    Since the total number of possible encrypting functions of 64 bits is
    something like (2^64)!, and there are only 2^56 DES encryption
    functions and multiple DES is half the set of all encryptions, I would
    expect (naively) that double encryption would essentially be as strong
    as a key with 2*56=112 bits, unless DES is almost a group ( ie most
    double encryptions yield the same encryption as some single DES). Why is
    this argument wrong, or is DES almost a group in the above sense?

1. It's not known (that I've heard) that multiple DES is half the
set of all encryptions.  What's known is:
  1) (single) DES is not a group.
  2) The *single round* DES functions generate half of the set of
     all encryptions (i.e. permutations of the 2^64 text blocks).

2. I don't see a simple argument that even if DES generates A_(2^64)
(i.e. half of all the permutations), double DES contains anything
like 2^112 of those elements.  It's a reasonable thing to guess, but
I'd like to hear some actual evidence...