did someone solve this questions

finding k0,k1,k2 efficiently when you know one plaintext and its encryption (P,C)

thank you "The" youre a genius

Genius, I am not :)

In any case, I couldn't think of anything more efficient than a meet in the middle attack.

That is, for each $k_0$, calculate $R_1=L_0\oplus f(R_0,k_0)$

And for each $k_2$, calculate $R_1=L_2=R_c\oplus f(L_c, k_2)$ (where $C=L_c||R_c$)

Then compare the strings and hope for no collisions.

Now go over all possible $k_1$-s and find the final key.

This should take around $O(|K|log(|K|))$ time and $O(|K|)$ memory which while far better than the trivial $O(|K|^3)$ is far from efficient.

This time I don't have any better solution and would also appreciate a better result.

Perhaps the direction has to do with the fact that we are told this uses a OWF instead of the usual PRF- but just OWF is NOT good (one can easily envision a OWF that will ruin this Feistel network acting as a PRP) The problem with that approach is that we are given a specific candidate (and that it tends to ruin the previous questions)

What is the solution for (b) in this question?

Thanks.

Try all key combination, and take only those with 0's in the padding area.

There are $2^{120}$ key combinations, and the padding area has a length of 70 bits

Since we expect the Feistel network to act as a PRP (with probability over the keys), the probability of getting all zeros for any 3 keys should be close to $2^{-70}$ (that is, close to uniformly sampling the padding part).

This gives us an expected number of $\frac{2^{120}}{2^{70}}=2^{50}$ matches.

If we have two messages, the number of keys is the same, but we require all zeros in bot padding areas - effectively now we can see it as one area of length 140 bits

So now we have $\frac{2^{120}}{2^{140}}<<1$ expected matches, which means (by Markov) that the probability that we fail will be low

If I understood correctly,

you choose 2 ciphers C,C' and go over all possible triples (k0,k1,k2).

if for (k0,k1,k2) it holds that Dec(k0,k1,k2)(C) has 70 zeroes pad you put (k0,k1,k2) in table1

and also if Dec(k0,k1,k2)(C') has 70 zeroes pad you put it in table2.

Then you argue that the probability that the intersection of table1 and table2 to have more than 1 triple of keys is very low.

Thanks!