What does it mean that DES algorithm was meant to run on hardware?

Question

According to sources that I've read, it says that DES is not suited to a software implementation and that it is better suited to hardware, what does this mean?

Answer 1

DES is not suited to a software implementation and is better suited to hardware

Indeed. There are several indications of / reasons for that:

• Each data byte of an (8-byte) plaintext or ciphertext block goes thru permutation IP on entry of DES, and IP^-1 on exit, only because that allows hardware to load/unload the block register using shift registers; that's very unnatural and quite expensive to emulate in software, and has no cryptographic benefit.
• Similarly, key bytes go thru PC1, for the same reason, some adverse effect on software, and no cryptographic benefit.
• DES use 8 small S-boxes (6-to-4 bit), which are most naturally implemented cheaply and in parallel in hardware, but need separate and typically sequential implementation in software. For a software implementation, we'd want to manipulate wider data on input and output (at least 8 bits, perhaps 16 or 32), and perhaps use formulas rather than tables.
• Further, the most natural way (and the fastest on most architectures at time of design at least) to implement a DES S-boxes in software is a table lookup, but on architectures with a memory cache (already a known concept at time of design) that introduces data-dependent timing variation, which is a serious security risk (it's not clear if that was known to the designers, though; which matters, see final paragraph).
• DES's permutation P is is extremely irregular, which is a non-issue in hardware, but slows and complicates software implementations. While something more regular/easier to software could be less secure to some degree, a few extra rounds would compensate for that and be beneficial for software implementations.

Perhaps most importantly, it was a design goal that DES be breakable by US authorities if needed, see this. In particular, DES has a 56-bit key for that reason. Software implementations would be easily modified for a larger key, and there would be variants intentional or not, both making attack considerably more difficult. Thus software implementation being slow and complex (for the reasons above) was helping towards that design goal of limited security. Also, hardware implementation effectively prevents proliferation.

Answer 2

DES contains certain bit permutations which are difficult to implement in software (the P box, IP and FP, and PC2). These can be done with a pattern of shifts and XORs, but it is substantially more complex and less efficient to implement than in hardware, and as a result, the algorithm tends to be slow when implemented on a general-purpose computer.

Typically, symmetric-key primitives that are designed for software use operations that are easily implementable as general-purpose instructions, such as addition and subtraction, integer multiplication, bitwise operations (including rotations), and table lookups on 8-, 16-, 32-, or 64-bit integers. Most of these can be implemented efficiently on all processors with high performance. People usually will not adopt algorithms which are slow and inefficient, so successful algorithms must work within the constraints of real hardware.

Implementations which are suited for hardware may use constructions such as LFSRs or NLFSRs, bit permutations, or other operations involving combinations of single bits or rearrangements of existing bits. These are not efficient in software because most general-purpose computers don't provide for these operations and thus they must be emulated inefficiently.