Problem 2 (15 pts) In EDE mode of 3DES, encryption of message m with keys k1, k2 and k3 works as follows: C=E_k1(D_k2(E_k3(m))), where E and D denote the encryption and decryption operation of DES respectively. Given several pairs, how can an attacker find the three keys with effort in the order of 2¹¹² instead of 2¹⁶⁸? Describe the attack in detail. (Hint: meet-in-the-middle attack)