# DES security if used a SHA3 function instead of Normal DES function?

I was practicing some python programming and I decided to implement a simple DES encryption function, so i decided to take some shortcuts so instead of DES expansion boxes and s-Boxes i just used a simple keyed SHA3 hash function the input is: 32-bit right side + key(any length I want but I used 128-bit) The first 32-bit of hash are xor-ed with left side to produce ciphertext. So now ignoring that i designed my own crypto and the fact that I used a very simple key schedule function. what are the security advantages of using this hash function instead of normal one (taking in mind that it takes 128-bit key which is greater than 56-bit key of Normal DES), and how it will differ if I used SHA2 (would SHA2 susceptibility to length extension attacks affect the security). lastly what are the advantages of using this method.

• "I used a very simple key schedule" is an understatement: the round function is the same across all rounds. The question practically boils down to: how does the security of DES compare to that of a 16-round Feistel cipher with the same PRF (determined by a 128-bit key) with 32-bit input and output at each round? – fgrieu Nov 13 '20 at 14:27
• @fgrieu, Thanks fgrieu this is exactly what I mean, I just wanted to be more clear explaining my question. – Khaled Nov 13 '20 at 15:00
• The question of the security of a 16-round 64-bit-block symmetric Feistel cipher with the same PRF is interesting (read: I didn't now, had to think about it). Is there a reason you did not use $\text{SHA3}(\text{right}\mathbin\|\text{key}\mathbin\|\text{round})$ which would be a pure Feistel cipher with ample enough rounds to be safe? – fgrieu Nov 13 '20 at 15:46
• Simple? DES key schedule is already simple. Just wondering how you fit the SHA3 to near to the DES on small devices. What are the requirements of a key schedule?. No low cost – kelalaka Nov 13 '20 at 15:58
• @kelalaka,@fgrieu The key schedule algorithm I use is just right rotating(no permuatation) but My question doesn't depend actually on key schedule. Think of it like that 16 round keys(no matter how I get them) are used to post append the right side of message which will enter the SHA3 function then hash will encrypt left side, So how secure is this approach(and what's it advantages) and how it will differ if I used SHA2 instead. After all the code i wrote is just a proof of concept so I'm interested in the big picture here. – Khaled Nov 13 '20 at 16:17

The question as initially asked essentially considers a 64-bit symmetric Feistel cipher with 16 rounds, a large (128-bit) key, a near-ideal round function, but the same function and key at each round. A slide attack allows at least a distinguisher, I think with in the order of $$2^{31}$$ queries to an encryption oracle. With some more, it might be possible to construct plaintext/ciphertext pairs that where not queried. This is an interesting exercise. That makes the security lower than that of DES from several standpoints.