A naive approach to increase strength of a block encryption algorithm with short key length (like DES) would be to use two keys formula_1 instead of one, and encrypt each block twice: formula_2. If the original key length is formula_3 bits, one would hope this scheme provides security equivalent to using key formula_4 bits long. Unfortunately, this approach is vulnerable to meet-in-the-middle attack: given a known plaintext pair formula_5, such that formula_6, one can recover the key pair formula_1 in formula_8 steps, instead of the formula_9 steps one would expect from an ideally secure algorithm with formula_4 bits of key.