6 of 8
replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/

Parity of DES key bytes was introduced on request of US authorities during the design of DES in the late 1970s:

  • it mitigates the risk of accidental key alteration; in particular, any all-zeros or all-ones byte of the key is rejected by the mandatory odd parity check, and any one-bit alteration is caught, which are advantages from a functionality perspective;
  • it makes brute force key search for single DES 256 times easier than if these bits where true key bits, which is an advantage from an attacker's perspective; the NSA wanted something that it could brute-force if necessary, and the additional 256 factor would have made that overly costly for the times (see Matt Nordhoff's comment).

A strong argument about the reality of the second motivation is on page marked 232 of a partially declassified book edited by the NSA: American Cryptology during the Cold War, 1945-1989, in the less redacted version found in page 5 of the PDF in this zip archive obtained by John Young under FOIA request 60251 of late 2009:

NSA worked closely with IBM to strengthen the algorithm against all except brute force attacks and to strengthen substitution tables, called S-boxes. Conversely, NSA tried to convince IBM to reduce the length of the key from 64 to 48 bits. Ultimately, they compromised on a 56-bit key.

Here is the union of said two differently redacted versions of the bottom of that page

American Cryptology during the Cold War, 1945-1989, page 232

  • 110210
  • 9
  • 231
  • 466