I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?

  • $\begingroup$ Are you asking about DES-CBC; or/and about 3DES-CBC with 2 or 3 keys (112 or 168-bit key size); or/and generically about an ideal 64-bit cipher in CBC mode? $\endgroup$
    – fgrieu
    Commented Oct 1, 2018 at 6:13
  • 3
    $\begingroup$ secure is a relative term, secure against the NSA is not the same as secure against the nosy neighbor. There is also the security of the mode vs the security of the cipher as per @fgrieu's comment $\endgroup$ Commented Oct 1, 2018 at 9:19

1 Answer 1


No, it will be insecure. There are two reasons;

  1. Due to the smaller key size 56-bit; DES was tested for brute-force attack since published.
    1. DES_CHALL, 96 days to find the CES challenge key in 1997.

    2. EFF DES cracker 56 hours to find the CDES challenge key in 1997.

    3. COPACOBANA, an FPGA hardware built for attacking by brute-force for DES, can successfully find the key on average 6.4 days in 2006. 4 . Hashcat; running with two p3.16xlarge instances on AWS, one probably will find the key on average in about 0.9 days. Because that's 46G tries/second per GPU and 16 GPUs.

    4. crack.sh can search the key in ~26 hours with a single machine.

    5. crack.sh also produce a chosen-plaintext attack utilizing a rainbow table to recover DES key in 25 seconds in 2017.

      There is a nice secret message in the DES Challange II-2 about this;

$$\text{The secret message is: It's time for those 128-, 192-, and 256-bit keys.}$$

  1. Due to the Small 64-bit block size; DES is not secure under any modes of operation. If the attacker collects blocks encrypted under the same key in total the square root of the possible blocks, there is a %50 chance that the block will be the same. This will leak information even CBC and OFB. For a 64-bit block cipher as DES, $\sqrt{2^{64}} = 2^{32} \times 8 \text{ B} = 32 \text{ GiB}$ space will be enough.

    In our community, there are two nice questions more about the block size;

    1. How does blocksize affect security?
    2. Is a small size block cipher usable?

and a website Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN.

  • 2
    $\begingroup$ If you rent two p3.16xlarge instances on AWS, you probably find the key on average in about 0.9 days using hashcat (for a price of about 1200 USD), because that's 46G tries / second per GPU and 16 GPUs. Also currently there's a lack of mention of sweet32. $\endgroup$
    – SEJPM
    Commented Oct 2, 2018 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.