If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?


1 Answer 1


DES is based on a Feistel construction - while the one-way function used is.. well.. one-way, you don't need to reverse it at all to "decrypt" (otherwise you are correct we would have a problem). Look at this diagram, specifically the decryption one:

enter image description here

As you can see, even though one half of the ciphertext is passed through the one-way function, there's always a copy of it remaining. In this case, $L_{n + 1}$ goes through the one-way function to mask $R_{n + 1}$, but still becomes one half of the ciphertext, which lets you use it again during decryption to undo the XOR operation you used to mask the other half of the ciphertext.

Then you keep doing that for each round (using the round keys in reverse) and you end up with the plaintext. No information is lost during the encryption process, the one-way function is simply used to mask each half in turn in an interleaved fashion (which can be done again during decryption in the opposite direction, but only if you have the key).

Ultimately decryption is very similar to encryption, a common feature of Feistel ciphers in general. In fact with some arrangements the only difference is the order of the subkeys, which is (or at least was) a big advantage as it makes implementation easier on limited devices, as you can mostly reuse the encryption code for decryption.

  • $\begingroup$ That schematic does not directly apply to DES: it is missing the final swap, IP, FP; and shows decryption with L and R reversed; whereas in DES, thanks to the final swap, encryption and decryption are identical except for the order of subkeys. $\endgroup$
    – fgrieu
    Aug 11, 2013 at 14:09
  • $\begingroup$ @fgrieu No, it does not apply directly to DES, but it applies directly to the question at hand, which is "why is it not necessary to invert the one-way function to invert a DES round". $\endgroup$
    – Thomas
    Aug 11, 2013 at 14:13
  • $\begingroup$ @Thomas (I know this a old question) So, for decryption in DES you would start with the cipher text, and apply IP, shift the keys, apply PC-2 to create them but apply these keys from K16 to K0. Then apply the XOR function, use the S-Boxes then at round 0 you would apply the FP? I'm currently learning DES and am bit confused on the decryption part. Thanks! $\endgroup$
    – orange
    Nov 8, 2014 at 18:30
  • $\begingroup$ @orange DES decryption works the same way as encryption, just with the round key order reversed (IP -> 16 rounds with $k_{16} .. k_1$ -> FP). Note that in DES, after the last (or before the first) round $L_i$ and $R_i$ are not swapped, making the entire structure easily reversible. The key scheduling algorithm can also be easily reversed. $\endgroup$
    – Lukas
    Dec 4, 2014 at 8:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.