This exercise is from Introduction to Modern Cryptography (2nd Edition) by Katz & Lindell

In this question we assume a three-round SPN with 64-bit block length. Assume independent 64-bit sub-keys are used in each round, so the master key is 256 bits long. Show a key-recovery attack using approximately 2 128 - 2128 time. In this question we assume a three-round SPN with 64-bit block length. Assume independent 64-bit sub-keys are used in each round, so the master key is 256 bits long. Show a key-recovery attack using approximately 2 128 - 2128 time