🚀 go-pugleaf

In article <oye4wB7w165w@works.uucp>, hagopes@works.uucp (Yinco Schmeer) writes:
> >>They suggest using triple encryption for key distribution.<<
> (Steven Bellovin)
> 
> I was under the impression that Double and Tripple encryption was no more 
> secure than single encryption. I believe that there was a mathmatical 
> proof of this...

Not to my knowledge.  In fact, the only mathematical proofs I know of
go the other way.

Originally, there was some concern that DES was a group.  That is,
encrypting first with A, and then with B, was equivalent to encrypting
instead with some third key C.  That is now known not to be a problem.
It has been proved that DES is *not* a group.

Now, for simple double encryption, one would think that 2^112
operations were needed for exhaustive search.  But there's a
time-memory tradeoff that will cut that to an effective key length of
2^56 operations and 2^56 words of memory.  This attack would work even
for ``encrypt with A, decrypt with B''.  Hence, the suggestion is to
use ``encrypt with A, decrypt with B, re-encrypt with A''.  IBM uses
this scheme to protect master keys.  Merkle and Hellman showed an
attack that can defeat even this scheme, but it required 2^56 chosen
plaintexts.  That doesn't seem to be feasible.  They suggest using three
different keys in either encrypt/encrypt/encrypt mode or
encrypt/decrypt/encrypt mode.

References:  Davies and Price, ``Security for Computer Networks'' (my
favorite general-purpose reference); Merkle and Hellman, ``On the
Security of Multiple Encryption'', CACM July 1981, pp 465-467; and the
RSA FAQ on cryptography.