DES (Data Encryption Standard)

Overview

DES (Data Encryption Standard) was a symmetric-key algorithm published in 1977 and was the standard for encryption for many years. However, its 56-bit key size is now considered too small and insecure against modern attacks. DES has been replaced by AES (Advanced Encryption Standard).

While DES is deprecated for security purposes, it's still studied for historical and educational reasons. Understanding DES helps in learning the evolution of cryptographic algorithms and the importance of key size in security.

How It Works

DES uses a Feistel network structure:

  1. Initial Permutation (IP): Rearranges input bits
  2. 16 Rounds: Each round performs:
    • Split data into left and right halves
    • Apply F-function to right half
    • XOR with left half
    • Swap halves
  3. Final Permutation (FP): Inverse of IP

DES Algorithm


DES_Encrypt(plaintext, key):
    # Generate 16 round keys
    round_keys = KeySchedule(key)
    
    # Initial permutation
    data = IP(plaintext)
    
    # 16 Feistel rounds
    for round = 1 to 16:
        left, right = split(data)
        new_right = left XOR F(right, round_keys[round])
        data = right || new_right
    
    # Swap final halves
    data = swap_halves(data)
    
    # Final permutation
    ciphertext = FP(data)
    return ciphertext

Specifications

  • Key Size: 56 bits (64 bits with parity)
  • Block Size: 64 bits
  • Number of Rounds: 16
  • Status: Deprecated, insecure

Security Issues

DES is no longer secure due to:

  • Small key size — the practical break. 56 bits is simply too few. This, not any analytic weakness, is what killed DES.
  • Linear cryptanalysis — the strongest analytic attack. Matsui (1993) breaks full 16-round DES with 243 known plaintexts. Still far more data than an attacker usually has, but it is the best cryptanalytic result against the cipher.
  • Differential cryptanalysis — DES resists it. This is a common misconception worth correcting: Biham and Shamir's differential attack needs 247 chosen plaintexts, which is worse than brute force. It turns out IBM and the NSA knew the technique in 1974 and deliberately tuned the S-boxes against it — the design criteria were classified for two decades, which is why DES's unexplained S-box constants were viewed with such suspicion at the time.
  • Weak keys: The key schedule has 4 weak keys and 6 semi-weak key pairs that should be rejected.

DES fell to brute force in 1998, when the Electronic Frontier Foundation's Deep Crack machine recovered a key in 56 hours for about $250,000. In January 1999 Deep Crack combined with distributed.net cut that to 22 hours 15 minutes. Today a single DES key can be recovered in under a day for a few tens of dollars using FPGA services or precomputed tables — though note that a general-purpose CPU or GPU still takes considerably longer than "minutes."

Triple DES (3DES)

Triple DES was developed to extend DES's lifetime by applying DES three times with different keys:

  • Encrypt with key1
  • Decrypt with key2
  • Encrypt with key3

3DES is no longer permitted, not merely discouraged. NIST SP 800-131A Rev. 2 deprecated it through 2023 and disallowed it entirely after 31 December 2023.

Two things ended it. First, effective security is lower than the key length suggests: three-key 3DES has a 168-bit key but only about 112 bits of security, because a meet-in-the-middle attack trades memory for time. Two-key 3DES is weaker still. Second, and more practically, the Sweet32 attack (CVE-2016-2183, 2016) exploits the 64-bit block size: by the birthday bound, collisions between ciphertext blocks become likely after roughly 32 GB encrypted under a single key, and those collisions leak plaintext. That is an achievable amount of traffic on a long-lived HTTPS or VPN connection, and it is why browsers and TLS libraries removed 3DES.

Use AES. Its 128-bit block size makes Sweet32-style attacks irrelevant.

When to Use DES

Do NOT use DES for new systems. It should only be used:

  • For legacy system compatibility
  • For educational purposes
  • For understanding cryptographic history

For new systems, always use AES instead.

Related Algorithms

Explore other encryption algorithms: