Is DES secure under CBC?

Question

I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?

Answer 1

No, it will be insecure. There are two reasons;

1. Due to the smaller key size 56-bit; DES was tested for brute-force attack since published.

   1. DES_CHALL, 96 days to find the CES challenge key in 1997.

   2. EFF DES cracker 56 hours to find the CDES challenge key in 1997.

   3. COPACOBANA, an FPGA hardware built for attacking by brute-force for DES, can successfully find the key on average 6.4 days in 2006. 4 . Hashcat; running with two p3.16xlarge instances on AWS, one probably will find the key on average in about 0.9 days. Because that's 46G tries/second per GPU and 16 GPUs.

   4. crack.sh can search the key in ~26 hours with a single machine.

   5. crack.sh also produce a chosen-plaintext attack utilizing a rainbow table to recover DES key in 25 seconds in 2017.

      There is a nice secret message in the DES Challange II-2 about this;

$$\text{The secret message is: It's time for those 128-, 192-, and 256-bit keys.}$$

2. Due to the Small 64-bit block size; DES is not secure under any modes of operation. If the attacker collects blocks encrypted under the same key in total the square root of the possible blocks, there is a %50 chance that the block will be the same. This will leak information even CBC and OFB. For a 64-bit block cipher as DES, $\sqrt{2^{64}} = 2^{32} \times 8 \text{ B} = 32 \text{ GiB}$ space will be enough.

   In our community, there are two nice questions more about the block size;

   1. How does blocksize affect security?
   2. Is a small size block cipher usable?

and a website Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN.