DES - Data Encryption Standard History: Developed by US government during 1970s to address need for secure communication of unclassified data both within the government and in the private sector. NBS - National Bureau of Standards (now NIST) was responsible for identifying and instituting appropriate standard. Put out public request for proposals in 1973, 1974. DES eventually was adapted from IBM algorithm called "Lucifer", developed by a research team in the early 1970s (Roy Adler, Don Cppersmith, Horst Feistel, Edna Grossman, Alan Konheim, Carl Meyer, Bill Notz, Lynn Smith, Walt Tuchman, Bryant Tuckermann - ref. Schneier, Applied Cryptography) NSA (National Security Agency, No Such Agency) evaluated method, and certified a modified version as secure. IBM team evaluated modified version and thought it was OK aside from slightly worrisome issue of shortened key length (originally 128 bits reduced to 56) In final design, IBM wanted 64, NSA wanted 48, and they compromised at 56. Adopted as government standard in 1976, as private sector standard in 1981. Recertified in 1987, 1993, though by that time it was clear that a brute force attack would be not only possible, but practical by the late 1990s. In 1998, the Electronic Frontier Foundation spent $100K and actually built a machine that could crack DES by brute force in about a day. By 2008, a machine costing less than $10,000 could break DES in a day. In 2017, a chosen plaintext attack using the string 1122334455667788 was demonstrated that could recover a key in about 30 seconds. Superseded in 2002 by the "Advanced Encryption Standard" (AES). Basic DES was decertified as a government standard in 2005. "Triple DES" which encrypts three times with three different keys is still considered secure, except for possible attacks against the relatively short (64 bit) block size. There is a "meet-in-the-middle" attack that makes double DES no more secure than single DES. It is reasonable to assume that government agencies, and possibly corporations, with access to much greater resources had built DES crackers considerably earlier, and there are almost certainly techniques that reduce the expected work by at least a few orders of magnitude. (e.g. try word-based and ASCII printable keys first). Despite this, and despite extensive public scrutiny over 40 years, no serious, unexpected weaknesses have been discovered in DES. Many of the peculiar features that were thought "suspicious" have been explained by recent research in the public domain, and suspicion of an NSA inserted "back door" is somewhat decreased. Changes made to the "S-boxes" turned out to actually enhance security against a technique known as differential cryptanalysis. Increasing the key size turned out to add far less security than originally thought. Not that the government would put out a standard they couldn't crack, just they had the resources to make a smart brute-force assault all along, and knew they were too costly for individuals and most companies to build and operate, and any organization mounting such an assault would need to make very visible purchases. At least, that is one story... As of 2017, DES still provides some minimal security. Your spouse, friends, family, and neighbors are not going to be able to crack DES-encrypted messages (with a decent key) without going to a LOT of trouble. Your employer, unless it is a large tech company, would also need to expend non-trivial effort. Government resources can crack any particular message easily enough, and have been able to for some time (probably from the beginning), but there are no publicly known or suspected methods that would have allowed the government to routinely decrypt all the tens of millions of DES-encrypted messages that were sent over the internet every day for decades. --------------------------------------------------- Description: Top Level * DES is a symmetric block cipher, operating on blocks of 64 bits (8-16 characters, depending on encoding) * Key is any 56 bit value, generally expressed as a 64 bit number, with every 8th bit acting as a parity bit. * Encryption is accomplished by alternating substitutions and and permutations, performed in a series of "rounds" where each round employs a different subkey derived from the original key. Outline: * Algorithm is based on the idea of a "Feistel Network", which provides a basis for generating mapping functions that are guaranteed to be invertable, and their own inverses. * Basically, a bit string is split into two halves (L, R), some function f is applied to the right half to obtain f(R), and a new string (L XOR f(R), R) is produced. Clearly, if this operation is applied twice, we get the original string back (L XOR f(R) XOR f(R), R) = (L, R). * DES employs a series of functions f1, f2 ... f16, and swaps the the L and R halves after each application except the last one. So (L, R) goes to (R, L XOR f(R)). This ensures that both left and right halves get mixed up. The particular functions depend on the key. Each such operation is called a round, so DES uses 16 rounds. This can be inverted by repeating the process with the functions in reverse order. In more detail: A. The 64 bit block is sent through an initial permutation P B. The block is broken into left and right 32-bit sections and run through 16 encryption rounds. At each round: 1. The 56 key bits are shifted, in two halves, by one or two bits, and 48 bits selected by a "compression permutation", to form a sub-key for the round. 2. The right half of the text is expanded to 48 bits using an "expansion permutation", and XORed with the subkey for the round. 3. The result is sent through a set of 8 fixed "S-boxes", which map 6-bit substrings to 4-bit outputs. These are concatenated to obtain a new 32 bit string. The S-boxes efectively implement a variable substitution operation on a 4-bit (16 character) alphabet. 4. The new string is permuted using a fixed permutation. This completes the application of the f function to the right half. 5. The new 32 bit string f(R) is XORed with the old left half, and the new 64 bit string (R, L XOR f(R)) is sent to the next round, except for after the last stage, when the swap is not performed, and (L XOR f(R), R) is sent to the last step. C. The output of the final round is sent through a final permutation, which is the inverse of the initial permutation. This is the final result of encrypting the block. * Initial Permutation: Very ordered operation - bits separated by 8 are made ajacent. No effect on security. Seems to have been aimed at optimizing early harware implementations. 58 50 42 34 26 18 10 02 60 52 44 36 28 20 12 04 62 54 46 38 30 22 14 06 64 56 48 40 32 24 16 08 57 49 41 33 25 17 09 01 59 51 43 35 27 19 11 03 61 53 45 37 29 21 13 05 63 55 47 39 31 23 15 07 * Key transformation: An 8-character (64-bit key) is reduced to 56 bits by a permutation that ignores every 8th bit, and reorders the remaining ones in the same sort of regular fashion as the initial permutation on the data. The 56 bit key is split into 2 28-bit halves. Each half is rotated left by 1 or 2 bits depending on the round. 1 1 2 2 2 2 2 2 1 2 2 2 2 2 2 1. A fixed, but rather non-regular compression permutation, is then used to select 48 bits out of the 56 as the subkey for the round. Each bit is used in about 14 of the 16 subkeys, but ot all are used the same number of times. (The irregularities in the shift pattern are there to provide resistance against a technique called related key cryptanalysis) * Expansion permuation: The 32 bit right half of the data is expanded to 48 bits by a highly regular operation. Basically every 4-bit substring is expanded to 6 bits by prepending the last bit of the previous 4-bit substring, and appending the first bit of the next 4-bit substring. This creates an "avalanche effect" in the next stage by making bits in 4-bit substrings effect the subsitution in neighboring substrings. The effect of local changes thus propagate faster to the entire 64 bit enciphered result. * S-box subsitution: This is applied after the 48-bit compressed key is XORed with the 48-bit expanded right half. There are 8 "S-boxes", each of which effectively implements 4 different 16-character substitution permutations. The first and last bits of each 6-character substring (which depend on neighboring 4-bit substrings in the original) determine which of the 4 permutations is used. The S-boxes are carefully designed to resist "differential cryptanalysis". Random sets of permutations are vulnerable to this technique, which was not publicly known when DES was introduced (hence much of the secrecy surrounding the initial design). This became clear in the 1990s when the technique was rediscovered and published in the public domain. Changing even a single bit of the S-boxes, or changing their order can significantly weaken DES with respect to differential cryptanalysis. * P-box permutation: This scrambles around the 32 bit string that comes out of the S-box substitution. It is highly non-regular, and carefully designed to increase the rate at which local changes propagate to the entire block. * Decrypting: Same algorithm is used to decrypt, except that keys are used in reverse order. This is due to the Feistel network nature of the algorithm. Security: * Has always been questioned due to NSA involvement. However, despite intense study of fully described algorithm, no trap door has been discovered, nor have opportunities to install such a trap door been reported. * There are a few weak keys, for example first and last halves both all 0 or 1. These do not produce multiple different subkeys, and the algorithm is easier to break. There are 4 of these. There are also 12 "semiweak" keys that produce only two different subkeys, and 48 "possibly weak" keys that produce only 4 distinct subkeys. All are easily avoidable. * In 1992 it was shown in public literature that DES is not a group. This means that multiple applications of DES provide increased security. In particular, "triple DES" with three separate keys is commonly used. (Double DES is known to vulnerable to a "meet in the middle" sort of attack, and is not significantly more secure than single DES) * Key length: It was always clear that the key length provided a potential vulnerability. 2^56 is about 72 quadrillion, large, but low enough to make brute-force attacks conceivable. A parallel engine with 1,000,000 chips running 1,000,000 blocks per second could find a key in about 20 hours. With current chips running above 100,000,000 blocks per second, you only need 10,000 of them. EFF built such a machine in 1998 for $100,000, and broke DES in just over a day. By 2008, such hardware cost only $10,000. Results from linear cryptanalsysis revealed that longer keys did not result in encryptions that were significantly harder to break using that technique, and the existing key schedule would take about as much effort to break using linear cryptanalysis as with a brute force method. These methods do require a very large amount of either chosen or known plaintext, so in some sense, they are much less likely than a brute-force attack on the keyspace. * Number of rounds: DES with few than 16 rounds can be broken by differential cryptanalsis with less effort than a brute force attack. The original designers apparently knew this well before results in the public domain confirmed it in the early 1990s