DESX

| So what's DESX?

DESX is a modification of DES which uses a 64+56+64 bit key, with
what is called "pre- and post-whitening".  Specifically, break the key
into three pieces, 64 bit K1, 56 bit K2, 64 bit K3.  Then DESX is
defined by:

	C = K1 xor DES (K2, K3 xor P)

where P is plaintext, C is ciphertext, and DES (K, P) is the DES
encryption of P under key K.

The encryption then has three steps:

	- XOR the input with K3
	- DES encrypt that with K2
	- XOR the result with K1

The first and last steps are called "whitening" because by xoring with
a random value, any structure is destroyed.  White light is a uniform
and unstructured mixture of all colors.

Whitening has been adopted as a general tool in constructing ciphers
these days and many of the AES candidates use it.  It makes things more
difficult for the cryptanalyst as he won't know exactly what values are
being fed into the guts of the cipher.

On Sun, Oct 11, 1998 at 12:06:14AM +0200, Anonymous wrote:
> | So what's DESX?
> 
> DESX is a modification of DES which uses a 64+56+64 bit key, with
> what is called "pre- and post-whitening".  Specifically, break the key
> into three pieces, 64 bit K1, 56 bit K2, 64 bit K3.  Then DESX is
> defined by:
> 
> 	C = K1 xor DES (K2, K3 xor P)
> 
> where P is plaintext, C is ciphertext, and DES (K, P) is the DES
> encryption of P under key K.
> 
> The encryption then has three steps:
> 
> 	- XOR the input with K3
> 	- DES encrypt that with K2
> 	- XOR the result with K1
> 
> The first and last steps are called "whitening" because by xoring with
> a random value, any structure is destroyed.  White light is a uniform
> and unstructured mixture of all colors.
> 

	Anybody have any estimate as to how much actual strength this
adds to DES ?  How would one break it in a practical cracker machine ?





-- 
	Dave Emery N1PRE,  die@die.com  DIE Consulting, Weston, Mass. 
PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2  5D 27 BD B0 24 88 C3 18

Dave Emery <die@die.com>:

> 	Anybody have any estimate as to how much actual strength this
> adds to DES ?

You might want to read "The Security of DESX" by Phillip Rogaway in
CryptoBytes Vol. 2 Number 2 (Summer 1996) pp 8-11, which is available
somewhere on RSADSI's web site <URL:http://www.rsa.com> (possibly
<URL:http://www.rsa.com/PUBS/> might be a good starting point) or the
underlying research paper "How to protect DES against exhaustive key
search" by Kilian and Rogaway in CRYPTO '96:

     [The] results don't say that it's impossible to build a machine
     which would break DESX in a reasonable amount of time.  But they
     do imply that such a machine would have to employ some radically
     new idea: it couldn't be a machine implementing a key-search
     attack, in the general sense which we've described.

(Quoted from the CryptoBytes article.)

>                How would one break it in a practical cracker machine ?

Maybe not at all; see above.