Meetinthemiddle attack

The MeetintheMiddle attack (MITM) is a generic space–time tradeoff cryptographic attack.
Contents
Description
MITM is a generic attack, applicable on several cryptographic systems. The internal structure of a specific system is therefore unimportant to this attack.
An attacker requires the ability to encrypt and decrypt, and the possession of pairs of plaintexts and corresponding ciphertexts.
When trying to improve the security of a block cipher, a tempting idea is to simply use several independent keys to encrypt the data several times using a sequence of functions (encryptions). Then one might think that this doubles or even ntuples the security of the multipleencryption scheme, depending on the number of encryptions the data must go through.
The MeetintheMiddle attack attempts to find a value using both of the range (ciphertext) and domain (plaintext) of the composition of several functions (or block ciphers) such that the forward mapping through the first functions is the same as the backward mapping (inverse image) through the last functions, quite literally meeting in the middle of the composed function.
The Multidimensional MITM (MDMITM) uses a combination of several simultaneous MITMattacks like described above, where the meeting happens in multiple positions in the composed function.
An exhaustive search on all possible combination of keys (simple bruteforce) would take 2^{k·j} attempts if j encryptions has been used with different keys in each encryption, where each key is k bits long. MITM or MDMITM improves on this performance.
History
It was first developed as an attack on an attempted expansion of a block cipher by Diffie and Hellman in 1977.^{[1]}
Diffie and Hellman, however, devised a spacetime tradeoff that could break the scheme in only double the time to break the singleencryption scheme.
In 2011, Bo Zhu and Guang Gong investigated the Multidimensional MeetintheMiddle attack and presented new attacks on the block ciphers GOST, KTANTAN and Hummingbird2.^{[2]}
MITM (1DMITM)
Assume the attacker knows a set of plaintext P and ciphertext C that satisfies the following:
where ENC is the encryption function, DEC the decryption function defined as ENC^{−1} (inverse mapping) and k_{1} and k_{2} are two keys.
The attacker can then compute ENC_{k1}(P) for all possible keys k_{1} and then decrypt the ciphertext by computing DEC_{k2}(C) for each k_{2}. Any matches between these two resulting sets are likely to reveal the correct keys. (To speed up the comparison, the ENC_{k1}(P) set can be stored in an inmemory lookup table, then each DEC_{k2}(C) can be matched against the values in the lookup table to find the candidate keys)
This attack is one of the reasons why DES was replaced by Triple DES — "Double DES" does not provide much additional security against exhaustive key search for an attacker with 2^{56} space.^{[3]} However, Triple DES with a "triple length" (168bit) key is vulnerable to a meetinthemiddle attack in 2^{56} space and 2^{112} operations.^{[4]}
Once the matches are discovered, they can be verified with a second testset of plaintext and ciphertext.
MITM algorithm
Compute the following:
 :
 and save each together with corresponding in a set A
 :
 and compare each new with the set A
When a match is found, keep k_{f1},k_{b1} as candidate keypair in a table T. Test pairs in T on a new pair of (P,C) to confirm validity. If the keypair does not work on this new pair, do MITM again on a new pair of (P,C).
MITM complexity
If the keysize is k, this attack uses only 2^{k+1}encryptions (and decryptions) (and O(2^{k}) memory in case a lookup table have been built for the set of forward computations) in contrast to the naive attack, which needs 2^{2·k} encryptions but O(1) space.
MultidimensionalMITM
This section possibly contains original research. (May 2013)

While 1DMITM can be efficient, a more sophisticated attack has been developed: Multi DimensionalMeet In The Middle attack, also abbreviated MDMITM. This is preferred when the data has been encrypted using more than 2 encryptions with different keys. Instead of meeting in the middle (one place in the sequence), the MDMITM attack attempts to reach several specific intermediate states using the forward and backward computations at several positions in the cipher.^{[2]}
Assume that the attack has to be mounted on a block cipher, where the encryption and decryption is defined as before:
that is a plaintext P is encrypted multiple times using a repetition of the same block cipher
The MDMITM has been used for cryptanalysis of among many, the GOST block cipher, where it has been shown that a 3DMITM has significantly reduced the time complexity for an attack on it.^{[2]}
MDMITM algorithm
Compute the following:
 ∀ ∈ :
 and save each together with corresponding in a set .
 ∀ ∈ :
 and save each together with corresponding in a set .
For each possible guess on the intermediate state compute the following:
 ∀ ∈ :
 and for each match between this and the set , save and in a new set .
 ∀ ∈ :^{[verification needed]}
 and save each together with corresponding in a set .
 For each possible guess on an intermediate state compute the following:
 1 ∀ ∈
 and for each match between this and the set , check also whether
 it matches with and then save the combination of subkeys together in a new set .
 1 ∀ ∈

 2 ...


 For each possible guess on an intermediate state compute the following:
 a) ∀ ∈
 and for each match between this and the set , check also whether
 it matches with , save and in a new set
 .
 a) ∀ ∈
 For each possible guess on an intermediate state compute the following:




 b) ∀ ∈
 and for each match between this and the set , check also
 whether it matches with . If this is the case then:"
 b) ∀ ∈


Use the found combination of subkeys on another pair of plaintext/ciphertext to verify the correctness of the key.
Note the nested element in the algorithm. The guess on every possible value on s_{j} is done for each guess on the previous s_{j1}. This make up an element of exponential complexity to overall time complexity of this MDMITM attack.
MDMITM complexity
Time complexity of this attack without brute force, is ⋅⋅
Regarding the memory complexity, it is easy to see that are much smaller than the first built table of candidate values: as i increases, the candidate values contained in must satisfy more conditions thereby fewer candidates will pass on to the end destination .
An upper bound of the memory complexity of MDMITM is then
where denotes the length of the whole key (combined).
The data complexity depends on the probability that a wrong key may pass (obtain a false positive), which is , where is the intermediate state in the first MITM phase. The size of the intermediate state and the block size is often the same! Considering also how many keys that are left for testing after the first MITMphase, it is .
Therefore, after the first MITM phase, there are ⋅ ,where is the block size.
For each time the final candidate value of the keys are tested on a new plaintext/ciphertextpair, the amount of keys that will pass will be multiplied by the probability that a key may pass which is .
The part of brute force testing (testing the candidate key on new (P,C)pairs, have time complexity ... ,clearly for increasing multiples of b in the exponent, number tends to zero.
The conclusion on data complexity is by similar reasoning restricted by that around (P,C)pairs.
Below is a specific example of how a 2DMITM is mounted:
A general example of 2DMITM
This is a general description of how 2DMITM is mounted on a block cipher encryption.
In Twodimensional MITM (2DMITM) the method is to reach 2 intermediate states inside the multiple encryption of the plaintext. See below figure:
2DMITM algorithm
Compute the following:
 ∀ ∈
 and save each together with corresponding in a set A
 ∀ ∈
 and save each together with corresponding in a set B.
For each possible guess on an intermediate state s between and compute the following:
 1 ∀ ∈
 and for each match between this and the set A, save and in a new set T.
 2 ∀ ∈
 and for each match between this and the set B, check also whether it matches with T for
 if this is the case then:
Use the found combination of subkeys on another pair of plaintext/ciphertext to verify the correctness of the key.
2DMITM complexity
Time complexity of this attack without brute force, is where ⋅ denotes the length.
Main memory consumption is restricted by the construction of the sets A and B where T is much smaller than the others.
For data complexity see subsection on complexity for MDMITM.
See also
References
 ↑ ^ Lua error in Module:Citation/CS1/Identifiers at line 47: attempt to index field 'wikibase' (a nil value).
 ↑ ^{2.0} ^{2.1} ^{2.2} Zhu, Bo; Guang Gong (2011). "MDMITM Attack and Its Applications to GOST, KTANTAN and Hummingbird2". eCrypt.<templatestyles src="Module:Citation/CS1/styles.css"></templatestyles>
 ↑ Zhu, Bo; Guang Gong (2011). "MDMITM Attack and Its Applications to GOST, KTANTAN and Hummingbird2". eCrypt.<templatestyles src="Module:Citation/CS1/styles.css"></templatestyles>
 ↑ Moore, Stephane (November 16, 2010). "MeetintheMiddle Attacks" (PDF): 2.<templatestyles src="Module:Citation/CS1/styles.css"></templatestyles>