Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Round 16 on the encryption side, and round 16 on the decryption side of DES have no swapping module.

Why is it like this? Can anyone provide any justification? This is my homework question.

share|improve this question
Work it out from FIPS46-3, pages 8-12. Note: a few implementations do have a final swap, but canceled by hiding another in the final permutation. – fgrieu Aug 27 '13 at 5:15
Something similar happens with AES for the same reason, take a look at this – rath Aug 27 '13 at 8:14
up vote 4 down vote accepted

In "Applied Cryptography" — Chapter 12, , Bruce Schneier writes:

The final permutation is the inverse of the initial permutation and is described in Table 12.8. Note that the left and right halves are not exchanged after the last round of DES; instead the concatenated block $R$16$L$16 is used as the input to the final permutation. There’s nothing going on here; exchanging the halves and shifting around the permutation would yield exactly the same result.

This is so that the algorithm can be used to both encrypt and decrypt.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.