Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

This question already has an answer here:

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?

share|improve this question

marked as duplicate by Ilmari Karonen, e-sushi, Gilles, rath, Reid Aug 16 '13 at 14:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

DES is based on a Feistel construction - while the one-way function used is.. well.. one-way, you don't need to reverse it at all to "decrypt" (otherwise you are correct we would have a problem). Look at this diagram, specifically the decryption one:

enter image description here

As you can see, even though one half of the ciphertext is passed through the one-way function, there's always a copy of it remaining. In this case, $L_{n + 1}$ goes through the one-way function to mask $R_{n + 1}$, but still becomes one half of the ciphertext, which lets you use it again during decryption to undo the XOR operation you used to mask the other half of the ciphertext.

Then you keep doing that for each round (using the round keys in reverse) and you end up with the plaintext. No information is lost during the encryption process, the one-way function is simply used to mask each half in turn in an interleaved fashion (which can be done again during decryption in the opposite direction, but only if you have the key).

Ultimately decryption is very similar to encryption, a common feature of Feistel ciphers in general. In fact with some arrangements the only difference is the order of the subkeys, which is (or at least was) a big advantage as it makes implementation easier on limited devices, as you can mostly reuse the encryption code for decryption.

share|improve this answer
That schematic does not directly apply to DES: it is missing the final swap, IP, FP; and shows decryption with L and R reversed; whereas in DES, thanks to the final swap, encryption and decryption are identical except for the order of subkeys. –  fgrieu Aug 11 '13 at 14:09
@fgrieu No, it does not apply directly to DES, but it applies directly to the question at hand, which is "why is it not necessary to invert the one-way function to invert a DES round". –  Thomas Aug 11 '13 at 14:13
@Thomas (I know this a old question) So, for decryption in DES you would start with the cipher text, and apply IP, shift the keys, apply PC-2 to create them but apply these keys from K16 to K0. Then apply the XOR function, use the S-Boxes then at round 0 you would apply the FP? I'm currently learning DES and am bit confused on the decryption part. Thanks! –  orange Nov 8 at 18:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.