Data Encryption Standard (DES)

The basic structure of DES

Describe the details of building elements of
DES
Describe the round keys generation process
To analyze DES
Mode of encryption in modern symmetric
key ciphers
 The Data Encryption Standard (DES) is a symmetric-key
block cipher published by the National Institute of
Standards and Technology (NIST).

 In 1973, NIST published a request for proposals for a

national symmetric-key cryptosystem. A proposal from
IBM, a modification of a project called Lucifer, was accepted
as DES.

 DES was published in the Federal Register in March 1975 as

a draft of the Federal Information Processing Standard
(FIPS).
st widely used encryption scheme is based on th
on Standard (DES) adopted in 1977 by the N
of Standards, now the National Institute of Standar
ogy (NIST), as Federal Information Processing Stand
UB 46). The algorithm itself is referred to as th
ed Algorithm later they used Data Encryption Stand

, data are encrypted in 64-bit blocks using a 56-bit k

m transforms 64-bit input in a series of steps into a
The same steps, with the same key, are used to reve
on.
Overview of DES
DES is a block cipher (64 bits)
DES Structure
• The encryption process is made of
One initial permutation box (P-Box)
One final permutation box (P-box)
Sixteen Feistel rounds.
Round Function (Permutation and
Substitution)
Swift
DES: General structure
DES: Key Generation
 The round-key generator creates sixteen 48-bit keys out of a 56-bit key.
DES: Key Generation…
DES: Key Generation…
Actually, the function expects a 64-bit key as input. However, only 56 of these bits are ever used; the
other 8 bits can be used as parity bits or simply set arbitrarily.

56 bit key generation from initial 64 bit key

DES: Key Generation…
Drops the parity bits and then permutes the rest of the bits according
to the table.

Parity-bit drop table

DES: Key Generation…
Shift Left
 The key is divided into two 28-bit parts
 Each part is shifted left (circular) one or two bits
 After shifting, two parts are then combined to form a 56 bit-
bit part
DES: Key Generation…
Key-compression table (P-Box)
 The compression P-box changes the 56 bits key to 48 bits key,
which is used as a key for the corresponding round
DES: Initial permutation
DES: Rounds
DES uses 16 rounds. Each round of DES is a Feistel cipher.

Figure: A round in DES (encryption site)

DES: Final permutation
 DES Round Function
eart of DES is the DES round
on.

ES round function applies a 48-bit

the rightmost 32 bits to produce a
output.
DES Function…
Expansion P-box
Since RI−1 is a 32-bit input and KI is a 48-bit key, we first need to
expand RI−1 to 48 bits.
Expansion P-box
DES Function…

Expansion P-box table

 DES Function…
er (XOR)
er the expansion permutation, DES
s the XOR operation on the
anded right section and the round
.
h the right section and the key are
bits in length.
e round key is used only in this
ration.
xes
he S-boxes do the real mixing (confusion).
ES uses 8 S-boxes, each with a 6-bit input and a
bit output.
S-Box Operation

S-box rule
DES Function…
The permutation for S-box 1

The input is 100011, then the output is 1100

DES Function…
DES Function…
DES Function…
DES Function…

Straight Permutation
DES Analysis
Critics have used a strong magnifier to analyze DES. Tests have
been done to measure the strength of some desired properties
in a block cipher.
DES: Properties
• Two desired properties of a block cipher are the avalanche effect
and the completeness.
• Avalanche effect: It means a small change in plaintext/key should
create a significant change in the ciphertext. DES has been proved
to be strong with regard to this property.
• Completeness: It means that each bit in ciphertext needs to be
dependent on many bits on the plaintext. The P-boxes and S-
boxes show a very strong completeness effect.
DES: Properties…
• Avalanche effect:

Number of bit differences

DES design criteria
S-Boxes
• The design provides confusion and diffusion of bits from each
round to the next.
P-Boxes
• They provide diffusion of bits.
Number of Rounds
• DES uses sixteen rounds of Feistel ciphers.
• The ciphertext is thoroughly a random function of plaintext and
ciphertext.
DES Security Issues
• The S-boxes are nonlinear and are vital to DES security.
• Its S-boxes might contain hidden trapdoors.
• Known plaintext attack is possible on a special purpose machine
• In 1977, Diffie & Hellman suggested a VLSI chip with (test 106
keys/sec) 106 chips could search the entire key space with in a day.
Cost is $20,000,000.
DES Security Issues…
• In 1993, Session & Wiener design a machine with chips in
pipelined fashion that performs 16 encryptions simultaneously. A
chip ($10.5 per chip) would test 5X107 keys/sec. A DES machine
with 10 frames (5760 chips/frames) found the key in 1.5 days.
Cost is $10,000,000.
• Differential cryptanalysis in infeasible in DES
• In 1994, Matsui proposed Linear cryptanalysis on DES. It is a
known plaintext attack with 243 plaintext-ciphertext pairs all of
which are encrypted by the same key. It took 40 days to generate
243 plaintext-ciphertext pairs and 10 days to find the key.
DES Keys

39
DES Keys…
DES Keys…
Double encryption and decryption with a weak key
DES Keys…
DES Keys…
DES Keys…
A pair of semi-weak keys in encryption and decryption
DES Keys…
Possible weak key
DES Keys…
What is the probability of randomly selecting a weak, a semi-
weak, or a possible weak key?

DES has a key domain of 256. The total number of the above keys are
64 (4 + 12 + 48). The probability of choosing one of these keys is 8.8
× 10−16, almost impossible.
DES Keys…
 Double DES
• It uses two keys K1 and K2.
• First, it performs DES on the plaintext P using the key K1.
D =(EK1(P))
• It again performs DES on D using the key K2.
C=EK2(D)=EK2(EK1(P)), P=DK1(EK2(C))
 Double DES…
• No of possible keys is 22n=2112.
• Merkle & Hellman introduce the meet-in-the-middle attack,
which involves encryption from one end and decryption from the
other end and matching the result in the middle.
• This attack requires knowing some plaintext/ciphertext pairs.
Meet-in-the-middle attack on Double DES
Triple-DES with Three-Keys
Triple-DES with Two-Keys