# DES — Can I recover the key when I have both ciphertext and the plaintext?

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?

• by efficient do you mean faster than brute force? Commented Dec 16, 2013 at 20:23

Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by Junod provides a comprehensive description of the attack for various parameters in Sections 3.1, 3.2. There is a formula of the probability that the correct key is found among the $r$ candidates with the highest score after analysis of $\nu$ (plaintext,ciphertext) pairs. Given only few ciphertexts, all the keys will have almost the same likelihood, and $r$ must be very close to $2^{56}$ to provide the success rate close to 1. Still, the resulting attack must be faster than the brute force, even though only marginally.
However, DES only uses a keyspace of $2^{56}$, so you could theoretically still bruteforce it.