Meet-in-the-middle attack

An attack against a cryptosystem based on looking for a match between intermediate values which may be calculated from either end of the system.

The attack was first developed by Diffie and Hellman. It has been improved since then; see for example

This why triple DES rather than just double DES is used. Suppose you use DES twice expecting to obtain the security of a 112-bit key by combining two 56-bit DES keys. You do indeed obtain that if the attacker tries a brute force attack searching all possible combinations of keys. However, attackers cannot be expected to co-operate.

Assuming the attacker can obtain or guess one block of plaintext for which he has the matching ciphertext, the meet-in-the-middle attack is a much better strategy for him. He runs a number of decryptions of the known ciphertext with possible 2nd-half keys, stores results in a table, then runs encryptions of the known plaintext using possible first-half keys and checking each output to see if it matches the table. On average, his total cost is 2⁵⁷ encrypt/decrypt operations. Against triple DES, a similar attack is possible but not practical; the cost is 2¹¹².