A cryptanalytic time-memory trade-off

A probabilistic method is presented which cryptanalyzes anyNkey cryptosystem inN2/3operational withN2/3words of memory (average values) after a precomputation which requiresNoperations. If the precomputation can be performed in a reasonable time period (e.g, several years), the additional computation required to recover each key compares very favorably with theNoperations required by an exhaustive search and theNwords of memory required by table lookup. When applied to the Data Encryption Standard (DES) used in block mode, it indicates that solutions should cost between1 and100 each. The method works in a chosen plaintext attack and, if cipher block chaining is not used, can also be used in a ciphertext-only attack.