If some 64-bit message block (e.g. $M = \text{“12345678”}$) was encoded in DES using one key and the encoded message had the same value (i.e. $E_k(M) = \text{“12345678”}$), would it be possible to determine the DES key based on that?

  • $\begingroup$ Encryption is key based permutation, each key creates a unique permutation. existence of fixed point(encryption of input = input) in a good encryption algorithm is less likely. and finding key with such relation is only possible by test and trial $\endgroup$
    – crypt
    Commented Sep 10, 2017 at 20:35

2 Answers 2


I'm not aware of such DES key which $E_k(M)=M$

DES has 4 Weak Keys which allows $E_k(E_k(M))=M$

  • i.e. if you encrypt the encrypted message, you get as result the original message.

page 159-160

Keys before parities drop (64 bits) | Actual key (56 bits)
0101 0101 0101 0101                   0000000 0000000
1F1F 1F1F 0E0E 0E0E                   0000000 FFFFFFF
E0E0 E0E0 F1F1 F1F1                   FFFFFFF 0000000

Example 6.8 Let us try the first weak key in Table 6.18 to encrypt a block two times. After two encryptions with the same key the original plaintext block is created. Note that we have used the encryption algorithm two times, not one encryption followed by another decryption.

Key: 0x0101010101010101
Plaintext: 0x1234567887654321 Ciphertext: 0x814FE938589154F7

Key: 0x0101010101010101
Plaintext: 0x814FE938589154F7 Ciphertext: 0x1234567887654321

One can assume that the $\mathrm{DES}_k$ is a random permutation of the set of $64$-bit numbers (depending on the key $k$). As 64! is quite big, the probability that $\mathrm{DES}_k$ (for a fixed $k$) has a fixed point $x$, (i.e., $\mathrm{DES}_k(x) = x$ for some $x$) is very close to $1-\frac{1}{e}$ (precisely $1-D_{64!, 0}$ in the notation of the wikipedia, where $e$ is Euler's number), which is approximately $63.2\%$.

So if you do not know the value of $x$, i.e., of the plaintext being encrypted to itself under an unknown key $k$, you can expect that more than half of the $2^{56}$ DES-keys fulfill your condition.

If on the other hand you know the value $x_0$ with $\mathrm{DES}_k(x_0) = x_0$, you can use a DES-cracker to find the key(s) that fulfill this equation. As there are $2^{-8}$ times less keys than plain-/ciphertexts, it is relatively unlikely that the DES-cracker will find more than one key (some commercial vendor for cracking single DES even stops its machine after finding the first key). To my knowledge there is no known attack accelerating the breaking of single DES using the fact that the given plaintext equals the given ciphertext. [I think I'd heard of such an attack, and hope that I wouldn't have forgotten it.]


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.