Banks and 128 bit DES

[Greg Rose]

At 21:17 20/03/2000 -0500, you wrote:
>Triple-DES reaches its maximal strength with two keys (112 bits) - use a to
>encrypt, b to decrypt, a to encrypt again. This limit is of the algorithm
>(48 Li'l Orphan Annies) and not the key length. You gain no advantage from
>using three keys (168 bits).

I've heard this (or equivalent) statement a number of times recently, but 
have not been able to find a reference to such a result. Both Schneier and 
MvOV say the same thing... that the best attack against 2-key is 2^120/p 
(where p is the number of known plaintexts, and is better than 2^112 when 
p > 256), whereas the best attack against 3-key is 2^112, flat, and 
requires chosen plaintexts. Both require 2^56 (or 2^57) storage. So, in 
practice, there really is an advantage to 3-key.

... unless I've missed something recently. Do you have a reference?

regards,
Greg.

Greg Rose                                     INTERNET: ggr@Qualcomm.com
Qualcomm Australia        VOICE:  +61-2-9181-4851   FAX: +61-2-9181-5470
Suite 410, Birkenhead Point,             http://people.qualcomm.com/ggr/
Drummoyne NSW 2047    232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C