How to Protect DES Against Exhaustive Key Search

The block cipher DESX is de ned by DESXk:k1:k2(x) = k2 DESk(k1 x), where denotes bitwise exclusive-or. This construction was rst suggested by Ron Rivest as a computationally-cheap way to protect DES against exhaustive key-search attacks. This paper proves, in a formal model, that the DESX construction is sound. We show that, when F is an idealized block cipher, FXk:k1:k2(x) = k2 Fk(k1 x) is substantially more resistant to key search than is F . In fact, our analysis says that FX has an e ective key length of at least +n 1 lgm bits, where is the key length of F , n is the block length, and m bounds the number of hx; FXK(x)i pairs the adversary can obtain.