Skip to main content

Questions tagged [des]

(or Data Encryption Standard), a (symmetric) block cipher using a 64 bit block size, with keys of size 56 bit, the standard US block cipher from 1976 to 2001.

Filter by
Sorted by
Tagged with
25 votes
2 answers
16k views

Purpose of DES parity bits

DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits". What was the intended purpose of the party bits, and why are they no longer used in modern ...
user avatar
16 votes
1 answer
4k views

Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32GiB of ciphertext) by the method devised by Paul C. van Oorschot and ...
fgrieu's user avatar
  • 142k
21 votes
1 answer
24k views

Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?

Among other sources, this Wikipedia entry states that triple-DES using three separate keys $(k_1, k_2, k_3)$ is vulnerable to meet-in-the-middle-attacks, while triple-DES using only two keys $(k_1, ...
malexmave's user avatar
  • 1,441
41 votes
2 answers
24k views

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

I'm wondering why we use encrypt-decrypt-encrypt (EDE) sequence in 3DES (also known as DES-EDE, TDES or TDEA) with three keys instead of three times encryption (EEE) with three different keys?
alaamub's user avatar
  • 583
6 votes
1 answer
1k views

In the RSA DES challenges, how did the contestants know they had found the right key considering they weren't given any plaintext?

If the contestants were given both the plaintext and ciphertext, it's straightforward. Just bruteforce all 56-bit keys until you find one that maps the given plaintext to the given ciphertext. But ...
Bastien's user avatar
  • 511
5 votes
1 answer
4k views

Is DES secure under CBC?

I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?
Jorge's user avatar
  • 51
50 votes
3 answers
19k views

What are the benefits of the two permutation tables in DES?

Why do we use a permutation table in the first step of DES algorithm and one at the end of the algorithm?
Am1rr3zA's user avatar
  • 755
34 votes
2 answers
18k views

Why is MixColumns omitted from the last round of AES?

All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
Fixee's user avatar
  • 4,168
11 votes
4 answers
38k views

Can I find the encryption key if I know the plain text and the encrypted text (DES and AES)?

If I have the plain text and its output after encryption with a key K1, is it algorithmically feasible to find K1? I am specifically interested in the cases of DES and AES encryption algorithms.
Joezer's user avatar
  • 213
16 votes
1 answer
6k views

Why is double encryption that's equivalent to single encryption no better than single encryption?

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about DES algorithm the authors say that: "if a cryptosystem is such that double encryption is ...
AleWolf's user avatar
  • 461
8 votes
2 answers
5k views

DES — Can I recover the key when I have both ciphertext and the plaintext?

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
GregoryComer's user avatar
6 votes
2 answers
6k views

DES with the bitwise complement of a key

I was reading upon Biham and Shamir's paper and a fact has been presented over there: if $ P_1 = \bar P_2$ and I choose a key $K_1 = \bar K_2$ then in that case $$T_1 = DES(P_1, K_1)$$ $$T_2 = DES(...
codeomnitrix's user avatar
45 votes
3 answers
39k views

Is Triple DES still considered safe to use?

What it says on the tin. Is it still used in things like TLS?
Melab's user avatar
  • 3,655
17 votes
2 answers
31k views

Can you explain “weak keys” for DES?

A weak key for DES is a key $K$ such that $DES_{k_1}(DES_{k_2}(x))=x$ for all $x$. I don't get why are the 4 keys $k_1||k_2$: $1^{112}$, $0^{112}$, $0^{56}||1^{56}$, $1^{56}||0^{56}$ considered as ...
Bush's user avatar
  • 2,140
8 votes
1 answer
1k views

AES and DES - reusing the same round keys

Both DES and AES use key expansion to generate the round keys (for Feistel network or for the AddRoundKey operation). Each round uses a different key. Why do we need that? Why we cannot use the same ...
Ziva's user avatar
  • 235
4 votes
1 answer
9k views

DES Key Schedule Algorithm

Reading through the DES Specification it says that the keys are permuted with PC-1 initially and then shifted left both $C$ and $D$. However, before it gets ...
Dean's user avatar
  • 143
28 votes
2 answers
11k views

How were the DES S-box values determined?

It seems like the S-boxes in DES have essentially random values. How were these chosen?
samoz's user avatar
  • 3,236
19 votes
2 answers
3k views

Can neural cryptanalysis be applied to AES?

In this Wikipedia article about Neural cryptography (section applications) it states: In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how ...
AleksanderCH's user avatar
  • 6,462
5 votes
2 answers
8k views

Attacking 2DES efficiently

Meet in the middle on 2DES uses $2^{56}$ memory. Given the fact that the attacker has only $2^{45}$ memory. How can the attacker adjust the attack so even with this memory limit, it will still be more ...
sara's user avatar
  • 153
22 votes
3 answers
38k views

How long does it take to crack DES and AES?

Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second. How long would it take for to recover a DES key, ...
huyichen's user avatar
  • 773
9 votes
1 answer
14k views

Complement property of DES

I'm supposed to show the complement property of DES ($c=DES(p,k) => \bar c = DES(\bar p, \bar k)$). My idea was to just start the algorithm with $\bar p$ and see what happens (ignoring the initial ...
stefanbschneider's user avatar
7 votes
2 answers
3k views

Meet-in-the-middle with checking complexity

In regards to meet in the middle type attacks, I have been considering the amount of operations in order to successfully find a key given two sets of plaintext / ciphertext pairs. All of the sources I ...
tbs's user avatar
  • 95
7 votes
1 answer
17k views

Brute force attack on DES + property of DES

In a brute force attack on DES, it seems to me that one plaintext-ciphertext pair suffices to launch the attack. (I.e. suppose we are given a message $x$ and a ciphertext $c$ such that $DES_k ( x ) = ...
Hoang Thao Le's user avatar
2 votes
3 answers
1k views

64 DES full example with all the stages

I'm trying to write a code to perform encryption and decryption of 64-bit DES but I'm having a problem in verifying that my code is working correctly. My graduation project is about DES crypt-analysis ...
siba36's user avatar
  • 301
10 votes
1 answer
8k views

What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?

I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key. How serious is this weakness? Also, is AES less effected ...
Vladislav Rastrusny's user avatar
8 votes
2 answers
1k views

How to find fixed points for DES weak keys

Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that: each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
esra's user avatar
  • 869
8 votes
3 answers
542 views

DES f function injective for no fixed subkey?

Let $f$ be the function used in a round of DES, as defined in FIPS 46-3: $$\begin{align} f:\{0,1\}^{32}\times\{0,1\}^{48}&\to\ \{0,1\}^{32}\\ (R,K)\ &\mapsto f(R,K)\underset{\mathsf{def}}=...
fgrieu's user avatar
  • 142k
6 votes
1 answer
49k views

How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
Aria's user avatar
  • 711
6 votes
3 answers
3k views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
fgrieu's user avatar
  • 142k
6 votes
1 answer
3k views

Why does applying 56-bit DES twice only give 57 bits of security? [duplicate]

Given two 56-bit keys, $k_1$ and $k_2$, why does $E_{k_1}(E_{k_2}(M))$ only give 57 bits of security? So basically I'm unsure why it only gives 57 bits of security; I understand that one key will ...
user3411002's user avatar
4 votes
2 answers
985 views

Why is a Feistel Network invertible?

As it is depicted above, the Feistel Network uses random function fi which is not required to be invertible. However, if fi is not invertible, how can fi(Li) == fi(Ri-1)? Furthermore, why Feistel ...
Xinyu Tu's user avatar
4 votes
1 answer
9k views

How is the initial permutation of DES created?

I am creating a program in C language with DES (Data Encryption Standard) functionality, but don't know how to apply the initial permutation. Is it achieved by swapping the values? If "yes", then ...
abcd's user avatar
  • 41
4 votes
1 answer
3k views

Why no swapping block in the last round of DES?

Round 16 on the encryption side, and round 16 on the decryption side of DES have no swapping module. Why is it like this? Can anyone provide any justification? This is my homework question.
Amritha's user avatar
  • 43
3 votes
3 answers
4k views

Is DES slow in hardware or only in software?

I have been reading that DES is slow. Is it only slow in software or slow overall? Also, as far as Triple DES being slow is concerned, is double AES with two 128 bit keys slower than single AES with ...
Bob Larson's user avatar
3 votes
1 answer
375 views

Does the key schedule function need to be a one-way function?

For some key schedule $e_n(e_{n-1}(k))$ (where $e_{n-1}(k)$ is the result of the previous round) , does $e$ need to be a one-way function? In the case of DES or Rijndael the key schedule doesn't ...
rath's user avatar
  • 2,558
3 votes
1 answer
1k views

DES: how does Richard Outerbridge's Initial Permutation operate?

I know how initial permutation works, but I've never heard of this part. People say it's Richard Outerbridge's initial permutation and that it's faster than usual IP (initial permutation) and simple. ...
yogoyogo's user avatar
2 votes
1 answer
964 views

Is timing analysis attack the same as cache timing attack?

I am working on an essay on timing attacks on DES but then i have seen resources mostly about cache timing attacks. so is timing analysis attack the same as cache timing?
johndoe12's user avatar
2 votes
1 answer
7k views

Exercise: Attack on a Two-Round DES Cipher

Working through the exercises in Cryptography Engineering (Schneier, Ferguson & Kohno) I have stalled on the following exercise: Consider a new block cipher, DES2, that consists only of two ...
David Brower's user avatar
2 votes
1 answer
2k views

How does ROTL work?

what does ROTL stand for? I know it does left shifting but what about the acronym? When we do a left shift, do we take the leftmost bit and add it at the end, by making the second bit the first, and ...
tony9099's user avatar
  • 333
2 votes
1 answer
980 views

DES-X , computation load and storage

The passage said that the computational load to attack DES-X can be reduced to approximately $2^{(56+64)}=2^{120}$ steps,and the storage of data sets should be $2^{64}$. But I can't figure why it is ...
C learner's user avatar
0 votes
1 answer
91 views

Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session. First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC ...
Dario Blair's user avatar
0 votes
1 answer
2k views

S-Box and it's linearity

I am trying to figure out why it is necessary S-box's to be nonlinear. I have been searching for some materials but was not able to find out clear proof why it means that if we use S-box in DES, it ...
Nick123's user avatar
  • 23
20 votes
2 answers
5k views

S-box basic question

I'm trying to understand DES and a bunch of other cryptographic systems using S-Boxes. I have now a quite basic question about how Sboxes work in general. For DES, Sboxes are substituting a 6-bits ...
Serge Waechter's user avatar
10 votes
2 answers
4k views

What is an active S-Box?

I don't understand what an active s-box is (in reference of design criteria 8 of the DES). Because according to DES, all 8 s-boxes are used every round. But this is not what active means. So my ...
fjung's user avatar
  • 101
9 votes
1 answer
417 views

Proof that no DES key makes encryption identity

How can we prove that no DES key makes encryption the identity function? That is: $\;\forall K\in\{0,1\}^{56}\quad\exists M\in\{0,1\}^{64}\quad E_K(M)\ne M$ Note: anyone disproving this proposition ...
fgrieu's user avatar
  • 142k
8 votes
2 answers
2k views

What is the definition of Feistel Cipher?

I know how Feistel Network works, but I want to know the exact definition of "Feistel Cipher" to solve several questions below: question 1: Is it correct to say DES (Data Encryption Standard) is ...
Jonghyun Kim's user avatar
8 votes
3 answers
2k views

DES Bruteforce attack and false positive keys

I have read that a bruteforce attack (regardless on which block cipher is used) can lead to a false positive if key space is greater than blocks space. It is pretty clear to me that is due the pigeons ...
Skary's user avatar
  • 371
8 votes
2 answers
4k views

How do we prove that AES, DES etc. are secure?

How do we prove that AES, DES etc. are secure? I've read about them and know the basics on how they work, but I still don't quite understand how we can be sure they are secure? What are the proofs?
evening's user avatar
  • 1,383
8 votes
3 answers
689 views

Why does DES implement so much Cross Wiring?

I've been going through DES, and I find that most of the blocks simply Reshuffle the input, which may be termed as "Cross Wiring". This include IP, IP-1, PC-1, PC-2 and even Expansion (although this ...
Bilal Wasim's user avatar
7 votes
1 answer
822 views

what is the current actual budget - as of 2015 - needed to build a DES breaker machine?

EFF - Electronic Frontier Foundation - built a DES cracker for a budget of 250K$ in July 1998. I assume that as of 2015 - the cost of such a DES breaker would be less, are there any estimations about ...
user avatar