Assuming you only modify the key schedule so that each of a 128-bit key is used at least once, would DES be about as secure as other ciphers such as AES? I am not talking about 2DES/3DES or other drawbacks like performance etc.

  • 4
    $\begingroup$ You should also define the new key schedule. When parameters changed, It usually requires new design and analysis. See AES-128 vs AES-256. $\endgroup$
    – kelalaka
    Commented Feb 18, 2019 at 17:08
  • 1
    $\begingroup$ One could take this question to be about Lucifer, or about Lucifer with the S-boxes as modified by the NSA to make them resist differential cryptanalysis. $\endgroup$ Commented Feb 18, 2019 at 17:32

1 Answer 1


No, DES* (which I'll call your "DES modified to use 128 bit keys") would not be as secure as AES; two reasons spring immediately to mind:

  • Block size; DES* would still have 64 bit blocks; most block cipher modes start to leak information when you get close to the birthday bound; for DES*, that'd be 32Gigabytes, which isn't that long for common use. In contrast, AES (which has a 128 bit block size) has a birthday bound of circa 300Exabytes

  • Linear cryptanalysis; DES is known to be weak against linear cryptanalysis; depending on how you map the 128 bit keys to the DES* subkeys, DES* may very well be as well. Of course, AES is known to be immune to linear cryptanalysis

  • 3
    $\begingroup$ And that's already enough reason not to go for 128 bit DES, ignoring the less serious issues such as parity bits, weak keys and what-not. $\endgroup$
    – Maarten Bodewes
    Commented Feb 18, 2019 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.