How to protect DES against exhaustive key search

Abstract

The block cipher DESX is defined by DESXk.k1.k2(x) = k2 ⊕ DESk(k1 ⊕ x), where ⊕ denotes bitwise exclusive-or. This construction was first suggested by Ron Rivest as a computationally-cheap way to protect DES against exhaustive key-search attacks. This paper proves, in a formal model, that the DESX construction is sound. We show that, when F is an idealized block cipher, FXk.k1.k2(x) = k2 ⊕ F k(k1 ⊕ x) is substantially more resistant to key search than isF. In fact, our analysis says that FX has an effective key length of at least k + n− 1 − lg m bits, where k is the key length of F, n is the block length, and mbounds the number of pairs the adversary can obtain.