Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?

share|improve this question
by efficient do you mean faster than brute force? – mikeazo Dec 16 '13 at 20:23
up vote 8 down vote accepted

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data.

Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by Junod provides a comprehensive description of the attack for various parameters in Sections 3.1, 3.2. There is a formula of the probability that the correct key is found among the $r$ candidates with the highest score after analysis of $\nu$ (plaintext,ciphertext) pairs. Given only few ciphertexts, all the keys will have almost the same likelihood, and $r$ must be very close to $2^{56}$ to provide the success rate close to 1. Still, the resulting attack must be faster than the brute force, even though only marginally.

share|improve this answer

No. This is known as a known-plaintext attack, and AFAIK no such attack is faster than bruteforce for DES.

However, DES only uses a keyspace of $2^{56}$, so you could theoretically still bruteforce it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.