# How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?

-

## marked as duplicate by Ilmari Karonen, e-sushi, Gilles, rath, ReidAug 16 '13 at 14:15

DES is based on a Feistel construction - while the one-way function used is.. well.. one-way, you don't need to reverse it at all to "decrypt" (otherwise you are correct we would have a problem). Look at this diagram, specifically the decryption one:

As you can see, even though one half of the ciphertext is passed through the one-way function, there's always a copy of it remaining. In this case, $L_{n + 1}$ goes through the one-way function to mask $R_{n + 1}$, but still becomes one half of the ciphertext, which lets you use it again during decryption to undo the XOR operation you used to mask the other half of the ciphertext.

Then you keep doing that for each round (using the round keys in reverse) and you end up with the plaintext. No information is lost during the encryption process, the one-way function is simply used to mask each half in turn in an interleaved fashion (which can be done again during decryption in the opposite direction, but only if you have the key).

Ultimately decryption is very similar to encryption, a common feature of Feistel ciphers in general. In fact with some arrangements the only difference is the order of the subkeys, which is (or at least was) a big advantage as it makes implementation easier on limited devices, as you can mostly reuse the encryption code for decryption.

-
That schematic does not directly apply to DES: it is missing the final swap, IP, FP; and shows decryption with L and R reversed; whereas in DES, thanks to the final swap, encryption and decryption are identical except for the order of subkeys. – fgrieu Aug 11 '13 at 14:09
@fgrieu No, it does not apply directly to DES, but it applies directly to the question at hand, which is "why is it not necessary to invert the one-way function to invert a DES round". – Thomas Aug 11 '13 at 14:13
@Thomas (I know this a old question) So, for decryption in DES you would start with the cipher text, and apply IP, shift the keys, apply PC-2 to create them but apply these keys from K16 to K0. Then apply the XOR function, use the S-Boxes then at round 0 you would apply the FP? I'm currently learning DES and am bit confused on the decryption part. Thanks! – orange Nov 8 '14 at 18:30
@orange DES decryption works the same way as encryption, just with the round key order reversed (IP -> 16 rounds with $k_{16} .. k_1$ -> FP). Note that in DES, after the last (or before the first) round $L_i$ and $R_i$ are not swapped, making the entire structure easily reversible. The key scheduling algorithm can also be easily reversed. – Lukas Dec 4 '14 at 8:23