DES and AES cryptography I have a question that I can't answer:


  A plain text has been encrypted 3 times in a DES method with 3 different keys 56 bit each, after it the text was encrypted for the forth time using a AES method using a 128 bit key, an attacker is planning to decrypt the text using meet in the middle method, how many encryptions and decryption approximately he need to do.
  
  
  $2^{56}$
  $2^{112}$
  $2^{128}$
  $2^{168}$
  $2^{184}$
  $2^{240}$
  $2^{296}$
Assuming this is ECB mode encryption, the workload of a known-plaintext meet-in-the-middle attack will depend strongly on the plaintext here.

If the plaintext contains some non-identical 128 bit blocks that partly coincide on a DES-block, the adversary can reverse the final AES encryption with $2^{128}$ AES decryptions work factor. They can then execute a standard meet-in-the-middle attack on 3DES using parallel collision search (easy compared to the preceding step). See van Oorschot/Wiener for details on the techniques used. 

If the plaintext consists only of non-identical 64-bit blocks, the adversary can use the same idea (look for collisions of 64-bit blocks in the ciphertext after AES decryption) to at least rule out some AES keys. They should be able to rule out the vast majority of AES keys when the size of all encrypted plaintexts significantly exceeds the birthday bound for a 64-bit block cipher.

If the plaintext is short and does not contain repetitions of DES blocks that are not also repetitions of AES blocks, there may be no better idea than to perform a meet in the middle attack between 3DES and AES using parallel collision search. This should be doable in time about $\approx 2^{212}/(\sqrt{w} m)$ on a machine with $2w$ AES blocks of memory and $m$ processors (see again the parallel collision search paper).