1
$\begingroup$

I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping that somebody could explain (for example) how much plaintext is required to determine the key in a generic/simple Feistel scheme with mangler function very simply linear in the key and so on?

$\endgroup$

1 Answer 1

2
$\begingroup$

Feistel networks were broken in DES but not triple DES. Some final AES candidates not approved also used Feistel networks $2^{36}$ plain text attacks. Reduction of $2^{16}$ possible keys for single DES: $4^{48/6} = 4^{8} = 2^{16}$.

First for a one round Feistel network: $R_0$ and $f (R_O, k_1) = R_1 \oplus L_0$, $k_1$ becomes known.

For two round Fiestel: Use the same method twice: $$(R_0, f(R_0,l_1)=L_2 \oplus L_0) \ (L_2,f(L_2,K_2)= R_2 \oplus R_0)$$

A nice reference would be CryptoLecture 04 (PDF) from Daniel Boneh's crypto course on Coursera.

$\endgroup$
1
  • $\begingroup$ Two good references icg.isy.liu.se/courses/tsit03/forelasningar/cryptolecture04.pdf Daniel Boneh's crypto course on Coursera – $\endgroup$ Dec 25, 2014 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.