If DES were a group [117], then given keys K 1 and K 2 , there would exist a key K% such that E(P, K 3 ) = E(E{P, K 1 ),K2) for all plaintext P, and we could also find such a key K 3 if any of the...

If DES were a group [117], then given keys K₁
and K₂, there would exist a key K% such that

E(P, K₃) = E(E{P, K₁),K2) for all plaintext P,

and we could also find such a key K₃
if any of the encryptions were replaced by decryptions. If equation (6.39) holds, then triple DES is no more secure than single DES. It was established in [45] that DES is not a group and, consequently, triple DES is more secure than single DES. Show that TDES is not a group. Hint: Select TDES keys Κ and K₂. You will be finished if you can verify that there does not exist any key K₃
for which E(P,K₃) = E(E(P,K₁),K₂) for all possible choices of P.