On the security of double and 2-key triple modes of operation

Abstract

The DES has reached the end of its lifetime due to its too short key length and block length (56 and 64 bits respectively). As we are awaiting the new AES, triple (and double) encryption are the common solution. However, several authors have shown that these multiple modes are much less secure than anticipated. The general belief is that these schemes should not be used, as they are not resistant against attacks requiring 264 chosen plaintexts. This paper extends the analysis by con- sidering some more realistic attack models. It also presents an improved attack on multiple modes that contain an OFB mode and discusses prac- tical solutions that take into account realistic constraints.