Added DetailsI am studying DES for my Cryptoexam .As far as I understood , the initial plaintext is permuted and then the left half is called L0 and Right half is called R0.

After that for each round the process is as follows

L(i) = R (i-1)

R(i) = L(i-1) XOR f(R(i-1), K(i))

This relation holds till the last round

i..e L(16) = R(15)

and R(16) = L(15) XOR f(R(15),K(16))

After the last round the text is interchanged into R(16)L(16) and the inverse permutation is applied.This is what Stinson Book says.

But When I read the same topic from Forouzan , he says that in the last round there is no swapper i..e L(16) != R(15) and R(16) = R(15) . I searched on net regarding this but didn't find anything useful. Is my understanding wrong? Excerpt here

  • $\begingroup$ You can incorporate the last swap into the final permutation. $\endgroup$ Commented Sep 13, 2014 at 20:49

1 Answer 1


According to the following link (Slide 5) and to what I studied last semester,


During the final round (Round 16) before the inverse permutation, the left and right halves of the bits will be swapped then the inverse permutation will be applied.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.