A b s t r a c t . Thc block cipher DESX is tiefined by D E S X k . k l . k a (~) = k2 a) DESk(51 @ P ) , where cfi denotes bitwise exclusive-or. This construction was first suggested by R.on Rivest as a computationally-cheap way to protect DES against exhaustive key-search attacks. This paper proves, in a formal model, that the DESX coIistruction is sound. We show that, when F is an idealized block cipher, FXk.kl.ka(x) = 52 cfi Fb(5l @ x) is substantially more resistant to key search thaii is F . Iri fact, our analysis says that FX has an effective key length of at least IE. + TI -1 -lg m bits, where IF, is t,he key length of F , n is the block Icngth, arid 'rrL bounds the numbpr of ( P , F X K ( P ) ) pairs the adversary can obtain.
In this model Kilian and Rogaway REF show that the DESX construction increases the effective key length of DES.
How to Protect DES Against Exhaustive Key Search
CRYPTO
Mathematics Computer Science