# Why does the DES crypto algorithm NOT use 2 rounds?

Now, if we were to go round by round, you could give a distinct reason for not using a single round since after just one round, the right half of the text comes directly, as-is, to form the left half of the new text after the one round. In this way, if an observer were to notice this, he/she could deduce that DES may be the algorithm being implemented. But is there a way of figuring out that DES is being used after performing TWO rounds?

• What you are looking for a is '2-round distinguisher' Feb 2, 2015 at 4:24
• Rule #1 of security: The attacker knows the system. Don't try to use "an attacker doesn't know how we're encrypting this message" to provide any amount of security; even if you don't in fact publish the system you're using, any security analysis assumes the attacker has already figured it out. Feb 3, 2015 at 1:50

Let's say we begin with both halves before the first round, $l_0$ and $r_0$. The calculated values for the next round are, with $DES()$ as the encryption function, this:
$$l_1 = r_0$$ $$r_1 = DES(r_0) \oplus l_0$$