🚀 go-pugleaf

In article <6703@tuegate.tue.nl>, bartjan@blade.stack.urc.tue.nl (Bartjan Wattel) writes:
|> Hi,
|> 
|> This question sort of belongs to my other question(s) in "Enlarging key size
|> of the DES".
|> 
|> Does anybody know publications about multiple-round DES and/or implementations
|> of it ?
|> 
|> If someone has other interesting info about multiple-round DES, all information
|> is welcome !!
|> 
|> Thanks in advance,
|> 
|> Bartjan Wattel at Eindhoven University of Technology, the Netherlands
|> (Email: bartjan@blade.stack.urc.tue.nl)
|> --------------------------------------------------------------------------------
|> 
|>                     You may be insane, but you're not crazy.

Merkle and Hellman are said to recommend the following:

   ciphertext =  DESEncrypt(k1,DESDecrypt(k2,DESEncrypt(k3,plaintext)));

and that this step be substituted wherever one does  
   
   ciphertext = DESEncrypt(kx,plaintext);

today.

I don't know exactly how much additional security this gives.  For instance,
there are known problems with the obvious:

   DESEncrypt(k1,DESEncrypt(k2,plaintext))
   
and claims of problems with:

   DESEncrypt(k1,DESDecrypt(k2,DESEncrypt(k1,plaintext))) 

(I say "claim" in the second case only because I haven't had time to read
that particular literature :-) ).  In the first case, at least, a table of
2 to the 67 bytes will keep the decryption in the range of 2 to the 55th 
average iterations.

Based on those issues, I would guestimate that Merkle & Hellman's security 
is probably around 2 to the 112 iterations, assuming no shortcut is found 
for the underlying DES proper or for the joint cipher.  Does anyone know
how many iterations Merkle and Hellman claim for the scheme?

This is the simplest approach to increasing DES key size I know of and it
is "off the shelf" with a correct protocol in the implementation of it.

-- 
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer