Actually, you often can take advantage of this property to
save some work, and I imagine DESCHALL clients do.
The reason is that even though you have to do two
encryptions to check K and K', you can use the same key in
both encryptions. Since there's usually some work
associated with setting up a new key for encryption, you
win. It's not a 2x speedup, but it helps.
So for each key, K, that you test, you try encrypting P with
K and compare against C, then you try encrypting P' with K
and compare against C'. If the first test succeeds, the
real key is K; if the second test succeeds, the real key is
K'.
- Darrell