Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to implement DES from scratch using the NIST paper and the Wikipedia article on DES.

I got 16 round DES done, but I can't seem to get 8 round DES working. I figure it's because I got the rotation table wrong. The rotation table I'm using for the 16 round version is straight off of Wikipedia's DES Supplementary Materials, while the 8 round version is the same with a few 2's in the middle taken out to make the length 8. { 1, 1, 2, 2, 1, 2, 2, 1 } for encryption and { 0, 1, 2, 2, 1, 2, 2, 1 } for decryption, which uses inverted key scheduler for decryption. Apparently, that's wrong, and I can't find a table or a algorithm for creating a rotation table.

If anyone can point me to either, it'd be much appreciated.

share|improve this question
up vote 0 down vote accepted

The catch is that for decryption to work reliably for all keys, the subkeys must be the same for encryption and decryption with order reversed. With many DES implementations, that implies the sum of the rotations in the key schedule should be a multiple of $28$, the width of the C and D registers.

Use say $15,2,2,2,2,2,2,1$ rather than your $1,1,2,2,1,2,2,1$ and you should be flying (assuming the code handles these larger values, and does not use the optimization enabled by the fact that after removing the first value in the DES key schedule table $1,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1$, the $15$ remaining entries are a palindrome). Note: I have changed my suggested values so that the subkeys used match the ones in the last $8$ rounds of encryption in standard DES; that reuses some of the work made by DES designers when crafting PC-2 w.r.t. the key schedule.

Alternatively, use $1,1,2,2,2,2,2,2$ for encryption and make an extra rotation by $14$ before decryption. That way we use the same subkeys as for the first $8$ rounds of encryption in standard DES.

Update: the modified question tells us that the implementation uses different tables for encryption and decryption. In that case, $1,1,2,2,2,2,2,2$ for encryption and $14,2,2,2,2,2,2,1$ for decryption should work (with rotation counts in opposite directions and before the use of the generated subkey). The first decryption value must equal the sum of encryption values$\pmod{28}$. The following decryption values are obtained by dropping the first encryption value and reversing the list.

Caution: care should be taken that all keys bits are used about evenly and regularly, by considering the interaction of rotation counts with PC-2. Because I'm lazy I kept the original first $8$ $rotations, which is at least not disastrous in this respect.

share|improve this answer
Works with 1,1,2,2,2,2,2,2 for encryption and 14,2,2,2,2,2,2,1 for decryption, and also thanks for the explanation on how to get the appropriate decryption rotation table. – dare0021 Apr 10 '14 at 7:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.