Meet-in-the-middle attack

An attack against a cryptosystem based on looking for a match between intermediate values which may be calculated from either end of the system.

This why triple DES rather than just double DES is used. Suppose you use DES twice expecting to obtain the security of a 112-bit key by combining two 56-bit DES keys. This fails, assuming the attacker can obtain or guess one block of plaintext for which he has the matching ciphertext. He runs a number of decryptions with possible 2nd-half keys, stores results in a table, then runs encryptions using possible first-half keys checking each output to see if it matches the table. On average, his total cost is 2⁵⁷ encrypt/decrypt operations. Against triple DES, a similar attack is possible but not practical; the cost is 2¹¹².

A naive version of this attack requires huge amounts of memory to store the intermediate values, but there has been considerable work on variants that reduce the memory requirement, often by trading off some speed. See for example

References

{reflist/2}