☕ Buy me a coffee — $3

DES (Data Encryption Standard)

Overview

DES (Data Encryption Standard) was a symmetric-key algorithm published in 1977 and was the standard for encryption for many years. However, its 56-bit key size is now considered too small and insecure against modern attacks. DES has been replaced by AES (Advanced Encryption Standard).

While DES is deprecated for security purposes, it's still studied for historical and educational reasons. Understanding DES helps in learning the evolution of cryptographic algorithms and the importance of key size in security.

DES is worth understanding as an artifact of a specific moment in cryptographic history: the first widely-adopted commercial cipher, the first cipher whose entire specification was published openly by a national standards body, and the source of most of the intuitions that later cryptographic design would refine. Feistel networks, S-boxes, key schedules with round keys, the interplay between designer expertise and public cryptanalysis, all of these were established as standard practice by DES's 24-year reign as the US federal cipher.

How DES Came To Exist

In 1972 the US National Bureau of Standards (now NIST) issued a public request for a cipher that could be used to protect unclassified but sensitive government data. This was itself an unprecedented step, up to that point, cryptography had been an exclusively classified discipline, and the idea of a government-endorsed cipher that would be published in full for use by anyone was novel and controversial. NBS received no acceptable candidates in its first round. In 1973 it issued a second request, and IBM submitted a cipher called Lucifer, designed by Horst Feistel in the late 1960s.

NBS submitted Lucifer to the NSA for evaluation. What came back, adopted as DES in 1977, differed from IBM's submission in two ways that generated decades of controversy:

  • The key size was reduced from 128 bits to 56 bits. IBM's Lucifer had a 128-bit key; DES has a 56-bit key (padded to 64 bits with 8 parity bits). This reduction was explained at the time as making the cipher fit into standard hardware more easily, but many observers, including senators, noted that a 56-bit key was small enough to be brute-forceable by an organisation with substantial computing resources. In 1975, that meant essentially only the NSA. This raised the persistent suspicion that DES had been deliberately designed so that NSA could break it while foreign adversaries could not.
  • The S-boxes were changed. IBM's submitted S-boxes were replaced with a new set of tables. NSA did not publicly explain the changes, and for two decades cryptographers wondered whether the change had introduced a backdoor.

The suspicion about the S-boxes was resolved in a startling way in 1990. Eli Biham and Adi Shamir published differential cryptanalysis, a new attack technique against block ciphers. When they applied it to DES, they found that DES was surprisingly resistant, the S-boxes were specifically tuned to be as strong as possible against exactly this type of attack. Don Coppersmith of IBM later confirmed that IBM had discovered differential cryptanalysis in 1974 while designing DES and had tuned the S-boxes against it, but the NSA had classified the technique and required IBM to keep it secret. So NSA's changes to the S-boxes had actually made DES stronger against an attack the outside world would not discover for another 16 years.

The 56-bit key remained a legitimate weakness. In 1977 Whitfield Diffie and Martin Hellman estimated that a purpose-built DES cracker could be built for around $20 million and would recover a key in a day. This was a hypothetical calculation at the time; twenty years later the EFF actually built such a machine (Deep Crack) for $250,000 in 1998 dollars, and it broke a DES-encrypted challenge in 56 hours. Diffie and Hellman had been correct about both the possibility and roughly the cost curve.

The Feistel Network

DES is built on a construction called a Feistel network, named for Horst Feistel, its inventor at IBM in the 1960s. The Feistel construction is a beautifully general recipe for turning any function, the "round function" or F-function, into an invertible cipher, without requiring the round function itself to be invertible. This is the key mathematical insight that makes DES's design possible.

The construction: split the block into left and right halves L and R. Compute a new right half as new_R = L XOR F(R, key), and set new_L = R. Then repeat with the halves swapped. To decrypt, run the same operation with the round keys in reverse order, the XOR cancels itself out at each round, unwinding the encryption. Crucially, this works no matter what F is: F does not need to be invertible for the cipher as a whole to be invertible. This lets the designer choose F freely for cryptographic strength, without worrying about whether it can be inverted.

DES uses 16 Feistel rounds. Each round key is 48 bits, derived from the 56-bit master key by a rotation-based key schedule. The F-function itself does:

  1. Expansion. Expand the 32-bit right half to 48 bits by duplicating some bits (following a fixed permutation).
  2. Key mixing. XOR the expanded right half with the 48-bit round key.
  3. S-box substitution. Split the 48-bit result into eight 6-bit chunks and pass each through a separate 6→4 S-box, giving 32 bits of output.
  4. Permutation. Permute the 32-bit result bit-by-bit according to a fixed table.

The initial permutation (IP) and final permutation (FP, which is the inverse of IP) that bracket the 16 rounds serve no cryptographic purpose in the modern view, they exist purely because they were convenient for the hardware DES was designed to run on in the 1970s, where bit-level permutations were free in hardware but were what made software implementations awkward.

The Feistel construction was so influential that many of DES's successors also used it: Blowfish, Twofish, GOST 28147, MISTY, and CAST-128 are all Feistel networks. It is only with AES (and its predecessors in the AES competition) that the field settled on the substitution-permutation network as the alternative approach.

How It Works

DES uses a Feistel network structure:

  1. Initial Permutation (IP): Rearranges input bits
  2. 16 Rounds: Each round performs:
    • Split data into left and right halves
    • Apply F-function to right half
    • XOR with left half
    • Swap halves
  3. Final Permutation (FP): Inverse of IP

DES Algorithm


DES_Encrypt(plaintext, key):
    # Generate 16 round keys
    round_keys = KeySchedule(key)
    
    # Initial permutation
    data = IP(plaintext)
    
    # 16 Feistel rounds
    for round = 1 to 16:
        left, right = split(data)
        new_right = left XOR F(right, round_keys[round])
        data = right || new_right
    
    # Swap final halves
    data = swap_halves(data)
    
    # Final permutation
    ciphertext = FP(data)
    return ciphertext

Specifications

  • Key Size: 56 bits (64 bits with parity)
  • Block Size: 64 bits
  • Number of Rounds: 16
  • Status: Deprecated, insecure

Security Issues

DES is no longer secure due to:

  • Small key size, the practical break. 56 bits is simply too few. This, not any analytic weakness, is what killed DES.
  • Linear cryptanalysis, the strongest analytic attack. Matsui (1993) breaks full 16-round DES with 243 known plaintexts. Still far more data than an attacker usually has, but it is the best cryptanalytic result against the cipher.
  • Differential cryptanalysis, DES resists it. This is a common misconception worth correcting: Biham and Shamir's differential attack needs 247 chosen plaintexts, which is worse than brute force. It turns out IBM and the NSA knew the technique in 1974 and deliberately tuned the S-boxes against it, the design criteria were classified for two decades, which is why DES's unexplained S-box constants were viewed with such suspicion at the time.
  • Weak keys: The key schedule has 4 weak keys and 6 semi-weak key pairs that should be rejected.

DES fell to brute force in 1998, when the Electronic Frontier Foundation's Deep Crack machine recovered a key in 56 hours for about $250,000. In January 1999 Deep Crack combined with distributed.net cut that to 22 hours 15 minutes. Today a single DES key can be recovered in under a day for a few tens of dollars using FPGA services or precomputed tables, though note that a general-purpose CPU or GPU still takes considerably longer than "minutes."

Triple DES (3DES)

Triple DES was developed to extend DES's lifetime by applying DES three times with different keys:

  • Encrypt with key1
  • Decrypt with key2
  • Encrypt with key3

3DES is no longer permitted, not merely discouraged. NIST SP 800-131A Rev. 2 deprecated it through 2023 and disallowed it entirely after 31 December 2023.

Two things ended it. First, effective security is lower than the key length suggests: three-key 3DES has a 168-bit key but only about 112 bits of security, because a meet-in-the-middle attack trades memory for time. Two-key 3DES is weaker still. Second, and more practically, the Sweet32 attack (CVE-2016-2183, 2016) exploits the 64-bit block size: by the birthday bound, collisions between ciphertext blocks become likely after roughly 32 GB encrypted under a single key, and those collisions leak plaintext. That is an achievable amount of traffic on a long-lived HTTPS or VPN connection, and it is why browsers and TLS libraries removed 3DES.

Use AES. Its 128-bit block size makes Sweet32-style attacks irrelevant.

When to Use DES

Do NOT use DES for new systems. It should only be used:

  • For legacy system compatibility
  • For educational purposes
  • For understanding cryptographic history

For new systems, always use AES instead.

Related Algorithms

Explore other encryption algorithms: