I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping that somebody could explain (for example) how much plaintext is required to determine the key in a generic/simple Feistel scheme with mangler function very simply linear in the key and so on?


Feistel networks were broken in DES but not triple DES. Some final AES candidates not approved also used Feistel networks $2^{36}$ plain text attacks. Reduction of $2^{16}$ possible keys for single DES: $4^{48/6} = 4^{8} = 2^{16}$.

First for a one round Feistel network: $R_0$ and $f (R_O, k_1) = R_1 \oplus L_0$, $k_1$ becomes known.

For two round Fiestel: Use the same method twice: $$(R_0, f(R_0,l_1)=L_2 \oplus L_0) \ (L_2,f(L_2,K_2)= R_2 \oplus R_0)$$

A nice reference would be CryptoLecture 04 (PDF) from Daniel Boneh's crypto course on Coursera.

| improve this answer | |
  • $\begingroup$ Two good references icg.isy.liu.se/courses/tsit03/forelasningar/cryptolecture04.pdf Daniel Boneh's crypto course on Coursera – $\endgroup$ – Jacob E Mack Dec 25 '14 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.