🚀 go-pugleaf

copper@WATSON.IBM.COM (Don Coppersmith) writes:
: Andrew Haley ( ahaley@eoe.co.uk ) writes:
: 
: >                                    There's no point in using any more
: > key bits, because differential cryptanalysis will find the subkeys in
: > 2**47 operations whatever the key length.
: ........----------
: 
: The Biham-Shamir work requires 2**47 _chosen_plaintext_ messages,
: not just that many operations.  Running 2**47 > 10**14 messages past
: the machine that contains the secret key is _much_ trickier than doing
: that many operations on your own machine.  This respresents massive
: data that you've got to get out of your opponent's machine!

Yes, I should have mentioned that, but as a design principle of
cryptosystems I would have thought that there shouldn't be any
possible chosen text attacks which involve less encryptions than
exhaustive search.  There should not be more key bits than needed to
prevent the opponent's best atack, simply as a principle of economy.

Anyway, my original point is still valid; DES is secure as far as any
of us know (and I'm sure you know better than most) and dual key
triple encryption usefully extends the key of DES for long term use.

Andrew.