The attacker can then compute "E"("P") for all possible keys "K" and store the results in memory. Afterwards he can decrypt the ciphertext by computing "D"("C") for each "K". Any matches between these two resulting sets are likely to reveal the correct keys. (To speed up the comparison, the "E"("P") set is stored in an in-memory lookup table, then each "D"("C") can be matched against the values in the lookup table to find the candidate keys.)