There's a simple way by which _"each round of DES algorithm is its own inverse"_. Consider round $i$ of DES as involving (almsot only) a function $g_i$ with $$g_i(L\mathbin\|R)=\bigl(L\oplus f(R,K_i)\bigr)\mathbin\|R$$ where $K_i$ is the 48-bit subkey for round $i$, and $f$ is the _"cipher function"_ (given in the [definition of DES][1]), and $L$ and $R$ are 32-bit bitsrings forming a 64-bit block. That function $g_i(L\mathbin\|R)$ verifies $g_i(g_i(L\mathbin\|R))=L\mathbin\|R$, as thought in the question; or in other words $g_i$ is an [involution][2]; or in yet other words $g_i\circ g_i$ is the identity function. Proof: $$\begin{align} g_i(g_i(L\mathbin\|R))&=g_i\Bigl(\bigl(L\oplus f(R,K_i)\bigr)\mathbin\|R\Bigr)\\ &=\Bigl(\bigl(L\oplus f(R,K_i)\bigr)\oplus f(R,K_i)\Bigr)\mathbin\|R\\ &=\Bigl(L\oplus\bigl(f(R,K_i)\oplus f(R,K_i)\bigr)\Bigr)\mathbin\|R\\ &=\left(L\oplus0^{32}\right)\mathbin\|R\\ &=L\mathbin\|R \end{align}$$ That proof invokes the definition of $g_i$ (twice), [associativity][3] of $\oplus$, that $f$ is a function, that for all 32-bit $X$ it holds $X\oplus X=0^{32}$ (the bitstring of 32 zero bits), which is the neutral for $\oplus$. ___ DES encryption chains these 33 operations on 64-bit quantities: $$\mathsf{IP}\,,\,g_1\,,\,S\,,\,g_2\,,\,S\,,\,\ldots\,,\,S\,,\,g_{15}\,,\,S\,,\,g_{16}\,,\,\mathsf{IP}^{-1}$$ where $S$ is the involution defined by $S(L\mathbin\|R)=R\mathbin\|L$, function $\mathsf{IP}$ is some permutation of bits, and $\mathsf{IP}^{-1}$ is the inverse permutation. DES decryption chains these 33 operations on 64-bit quantities: $$\mathsf{IP}\,,\,g_{16}\,,\,S\,,\,g_{15}\,,\,S\,,\,\ldots\,,\,S\,,\,g_2\,,\,S\,,\,g_1\,,\,\mathsf{IP}^{-1}$$ We see that DES encryption then decryption is the identity function: the $(34-j)^\text{th}$ operation of decryption cancels the $j^\text{th}$ operation of encryption: - For $j=33$, because $\mathsf{IP}$ cancels $\mathsf{IP}^{-1}$. - For $j=1$, because $\mathsf{IP}^{-1}$ cancels $\mathsf{IP}$. - For other even $j$, because $g_{j/2}$ is an involution. - For other (odd) $j$, because $S$ is involution. Importantly, encryption and decryption use the very same structure, only the indexes (that, is, the order of the subkeys $K_i$) differ. That allow to use identical hardware or code for both encryption and decryption. Note: when it is said that DES has 16 rounds, it is ignored $\mathsf{IP}$ and $\mathsf{IP}^{-1}$; encryption round $i$ is $S\circ g_i$ for $1\le i\le15$ and $g_i$ for $i=16$; decryption round $i$ is $S\circ g_{17-i}$ for $1\le i\le15$ and $g_1$ for $i=16$. Per this definition, for a [Vulcan][4], only the 16<sup>th</sup> round is its own inverse. [1]: https://csrc.nist.gov/csrc/media/publications/fips/46/3/archive/1999-10-25/documents/fips46-3.pdf#page=18 [2]: https://en.wikipedia.org/wiki/Involution_(mathematics) [3]: https://en.wikipedia.org/wiki/Associative_property [4]: https://en.wikipedia.org/wiki/Vulcan_(Star_Trek)