🚀 go-pugleaf

    A pure chosen-plaintext attack against DES would not move directly
    to double DES.  But that only says something about ONE PARTICULAR
    ATTACK; it says nothing about the inherent strength of the
    cryptosystem.

It's worse than this.  We don't even know that double DES is much 
stronger than single DES against exhaustive search.  (We know it's
at least a little bit stronger).

We know that DES is not a group; however, we don't know that DES
doesn't *contain* a large group.  It might be that only a few of
the possible DES keys generate elements outside of DES.  Anyone
know better?