# Why does DES use exactly 16 rounds?

Why does DES use exactly 16 rounds and not more or less than 16? What is the significance of using 16 rounds?

-
The only way to know this is to ask the makers of the algorithm (it does not seem to be specified in the standard). But using a factor of two does make it easier to split it into 4 x 4 or 8 x 2 unrolled loops. – Maarten Bodewes Aug 11 '13 at 16:18
BTW: Adding more rounds would mean a slower cipher, so usually designers are trying to set the number of rounds low enough for the cipher not to be unnecessarily slow, but high enough so it can't be easily broken. – Henrick Hellström Aug 12 '13 at 10:04
@Henrick Hellström: I question your statement that that there is no successful (better-than-brute-force, of course) attack against 8 round DES $\;$ This is a claimed better-than brute-force attack on DES reduced to 13 rounds, with a relatively practical variant for 10 rounds. I tend to agree with this answer. – fgrieu Aug 22 '14 at 12:05
@fgrieu You are probably correct. – Henrick Hellström Aug 22 '14 at 12:13

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3):

DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack.

This explains the "Why not less than 16".

As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = less speed).

-
"variants of DES with a reduced number of rounds have been successfully attacked. DES with three or four rounds was easily broken in 1982".so it may be possible to brake 16 rounds in few years. – Aria Aug 14 '13 at 8:28
yes, but with 16 rounds you have to use brute force, since other type of attacks aren't faster than brute force at 16 rounds, while they are faster with less rounds. Regarding the "possibility to break 16 rounds", see wikipedia - DES Challenges; in 1992 it took 22 hours and 15 minutes to break DES. – tech Aug 14 '13 at 9:06

Applied Cryptography mentioned this.

With 17 or 18 rounds a differential attack is about as costly as brute-force. And 19 rounds or more makes differential attack impossible since it requires more than $2^{64}$ chosen plaintexts, which is impossible since the DES block size is 64 bits.

-