This cipher can be attacked using a meet-in-the-middle attack. We assume that the adversary has a few plaintext/ciphertext pairs $(m, c)$ . He can then do a brute force attack on the DES part, i.e. compute $x = DES_{k_1}(m)$ for all possible keys $k_1$ , and store the resulting pairs $(x, k_1)$ in a dictionary. Then he goes through all possible $k_2$ , computes $c \oplus k_2$ and looks it up in the dictionary. When found, he has a potential key pair $(k_1, k_2)$ . The complexity of this attack is $2^{64}$ , which shows that the cipher does not provide 120 bits of security.

Alternatively, with two plaintext/ciphertext pairs $(m_1, c_1)$ and $(m_2, c_2)$ , one notes that $c_1 \oplus c_2 = DES_{k_1}(m_1) \oplus DES_{k_1}(m_2)$ , which makes it possible to do a brute force attack with only twice the cost of an attack against DES.