Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Why DES uses 16 rounds why not more or less then 16. what is the significant of using 16.

share|improve this question
The only way to know this is to ask the makers of the algorithm (it does not seem to be specified in the standard). But using a factor of two does make it easier to split it into 4 x 4 or 8 x 2 unrolled loops. –  owlstead Aug 11 '13 at 16:18
Good question, considering that there still doesn't seem to be any successful attack against 8 round DES. –  Henrick Hellström Aug 12 '13 at 10:01
BTW: Adding more rounds would mean a slower cipher, so usually designers are trying to set the number of rounds low enough for the cipher not to be unnecessarily slow, but high enough so it can't be easily broken. –  Henrick Hellström Aug 12 '13 at 10:04

2 Answers 2

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): “DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack.” This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = less speed).

share|improve this answer
"variants of DES with a reduced number of rounds have been successfully attacked. DES with three or four rounds was easily broken in 1982".so it may be possible to brake 16 rounds in few years. –  Aria Aug 14 '13 at 8:28
yes, but with 16 rounds you have to use brute force, since other type of attacks aren't faster than brute force at 16 rounds, while they are faster with less rounds. Regarding the "possibility to break 16 rounds", see wikipedia - DES Challenges; in 1992 it took 22 hours and 15 minutes to break DES. –  tech Aug 14 '13 at 9:06

Applied Cryptography mentioned this. With 17 or 18 rounds a differential attack is about as costly as brute-force. And 19 rounds or more makes differential attack impossible since it requires more than 2^64 chosen plaintexts, which is impossible since the DES block size is 64 bits.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.