# DES generating the same ciphertext for different plaintexts and identical key

Is it possible to get the same output for DES while the inputs are different while using the same key? The key should not have to be a weak key.

If yes could you give me a hint how to show how to do this? Is there a specific S-BOX to work with? If this cannot be done, then why is it considered impossible?

• I've given an answer, but are you requesting to change the properties of the S-BOX of DES is such a way that it will not be a PRP anymore? In that case it will of course not be DES anymore. – Maarten Bodewes Dec 29 '14 at 13:44
• @MaartenBodewes-owlstead: This "working with a specific S-Box" could be about using a specific "failure" in one s-box to create such a behavior - impossible with the given properties of a block cipher, but a valid question if this was not known. – Nova Dec 29 '14 at 19:22
• I think the current answers do not fully reflect this, you could generate a separate question asking if you can change the S-Box in such a way that DES is not a PRP anymore, now you know a bit more about the nomenclature. – Maarten Bodewes Dec 29 '14 at 20:13

No, that is impossible. The reason is simple: How would you decrypt this? If you input the ciphertext and the key into the decryption function, than you have to get exactly one output, not two. How would you decide which output is the correct one?

The DES encryption and decryption functions are bijective under one given key. This means that for every possible input there is exactly one output. Not more, not less. Every output has only one matching input, not more, not less. You can reverse any transformation made, forward and backward, at least if you have the key. This behavior is assured by the inner Feistel network of DES.

All this has to be the case for every possible key, even weak or semi-weak ones.

This is the case for every "standard" block cipher: DES, AES, Blowfish, Twofish, MARS, Serpent, RC5, RC6, ... They all meet this requirement. Different operating modes can change this, through. Different plaintexts can lead to the same ciphertext with different IVs, for example for CBC. I don't think that the question focuses at this, but I want to include it after reading Maarten Bodewes - owlstead's answer.

• +1 for a good explanation that's missing some terms in my opinion – Maarten Bodewes Dec 29 '14 at 13:34

If you mean DES as block cipher without mode of operation then no, this is impossible. DES is a block cipher, and block ciphers are Pseudorandom Permutations (PRP). As permutations in turn are bijective functions of $\{0,1\}^n$ to $\{0,1\}^n$ there is always a one to one relationship between plaintext and ciphertext. If this wasn't the case then you would not be able to decrypt a ciphertext to a unique plaintext.

The 1:1 relationship of plaintext is actually an issue when a block cipher is used for encryption; if a ciphertext is ever repeated you know that it corresponds to the same plaintext, clearly giving information about the plaintext (other than the size of the plaintext). Hence the use of unique IVs in block cipher modes of operation except ECB - which is considered unsafe for exactly this reason.

• Yes, that's a good answer. I try to not use overly mathematical words because I don't know them and want to have my answers easily understandable for everyone. Your answer still looks simple, so +1. – Nova Dec 29 '14 at 13:43