A cryptanalytic time-memory trade-off

A probabilistic method is presented which cryptanalyzes any key cryptosystem in operational with words of memory (average values) after a precomputation which requires operations. If the precomputation can be performed in a reasonable time period (e.g, several years), the additional computation required to recover each key compares very favorably with the operations required by an exhaustive search and the words of memory required by table lookup. When applied to the Data Encryption Standard (DES) used in block mode, it indicates that solutions should cost between 100 each. The method works in a chosen plaintext attack and, if cipher block chaining is not used, can also be used in a ciphertext-only attack.