How to make DES more secure without switching from des state to another cryptography system and what are limitations of DES?

Question

How to make DES more secure without switching from des state to another cryptography system and what are limitations of DES? Is there any 3 ways to make des more secure?

Answer 1

Arguably the most serious security issues with DES is it's small key of 8 bytes with only $2^{56}$ effective keys¹, which makes it vulnerable to brute force key search. This is a deliberate design choice.

A standard way to improve on this issue while still using DES is TDEA, also known as 3DES. The key is extended to 2 or 3 keys of 8 bytes $(K_1,K_2)$ or $(K_1,K_2,K_3)$. These modes are designated TDEA with keying option 2 (16-byte key) and keying option 1 (24-byte key). Encryption of an 8-byte plaintext block $P$ or ciphertext block $C$ becomes $$\begin{align} \operatorname{TDEA-ENC}_{(K_1,K_2)}(P)&\underset{\text{def}}=\operatorname{DES-ENC}_{K_1}(\operatorname{DES-DEC}_{K_2}(\operatorname{DES-ENC}_{K_1}(P)))\\ \operatorname{TDEA-DEC}_{(K_1,K_2)}(C)&\underset{\text{def}}=\operatorname{DES-DEC}_{K_1}(\operatorname{DES-ENC}_{K_2}(\operatorname{DES-DEC}_{K_1}(C)))\\ \operatorname{TDEA-ENC}_{(K_1,K_2,K_3)}(P)&\underset{\text{def}}=\operatorname{DES-ENC}_{K_3}(\operatorname{DES-DEC}_{K_2}(\operatorname{DES-ENC}_{K_1}(P)))\\ \operatorname{TDEA-DEC}_{(K_1,K_2,K_3)}(C)&\underset{\text{def}}=\operatorname{DES-DEC}_{K_1}(\operatorname{DES-ENC}_{K_2}(\operatorname{DES-DEC}_{K_3}(C)))\\ \end{align}$$

That largely solves the issue of brute force key search, which becomes economically infeasible for 24-byte keys, and arguably still for 16-byte keys. The next worrying issues become

1. The small 8-byte block size of 64 bit, which is an issue when the amount of data encrypted with the same key is in gigabytes.
2. Low speed, worsened by a factor close to three by using TDEA/3DES.
3. Side channel and fault attacks.
4. The complementation property: $\operatorname{DES-ENC}_{\overline K}(\overline P)=\overline{\operatorname{DES-ENC}_K(P)}$, which also applies to TDEA/3DES.

While there are solutions to 1 and even 4 usign DES as a building block, those that are secure are complex, seriously worsen 2, and are not standardized. I'd recommend to go AES or ChaCha.

---

In order to improve on 2, Ronald Rivest proposed DESX, an alternative to TDEA/3DES. It's studied by Joe Killian and Phillip Rogaway: How to Protect DES Against Exhaustive Key Search, in proceedings of Crypto 1996 then Journal of Cryptology (2001). It's defined by $$\begin{align} \operatorname{DESX-ENC}_{(K,K_1)}(P)&\underset{\text{def}}=K_1\oplus \operatorname{DES-ENC}_K(K_1\oplus P)\\ \operatorname{DESX-DEC}_{(K,K_1)}(C)&\underset{\text{def}}=K_1\oplus \operatorname{DES-DEC}_K(K_1\oplus C)\\ \operatorname{DESX-ENC}_{(K,K_1,K_2)}(P)&\underset{\text{def}}=K_2\oplus \operatorname{DES-ENC}_K(K_1\oplus P)\\ \operatorname{DESX-DEC}_{(K,K_1,K_2)}(C)&\underset{\text{def}}=K_1\oplus \operatorname{DES-DEC}_K(K_2\oplus C)\\ \end{align}$$ It largely has the advantages of TDEA/3DES in term of resistance to strictly brute-force key search, with very little extra cost compared to DES. However some caveats apply, as this construction (now known as the FX construction when generically applied to a block cipher) allows specific time-memory tradeoffs, see Itai Dinur, Cryptanalytic Time-Memory-Data Tradeoffs for FX-Constructions with Applications to PRINCE and PRIDE, in proceedings of Eurocrypt 2015; and it's references.

---

¹ Down to $2^{55}$ when the complementation property applies, which includes chosen plaintext attack.