This document summarizes the Data Encryption Standard (DES): its history, structure, key schedule, S-boxes, Triple DES, known weaknesses, and practical guidance for engineers. The goal is a compact, practical reference that explains the algorithm clearly without reproducing formal specifications verbatim.
- Block size: 64 bits
- Key material: 64 bits (8 parity bits) → effective key length 56 bits
- Structure: 16-round Feistel network
- Input/output permutations: Initial Permutation (IP) and Final Permutation (IP^{-1})
- Status: widely implemented historically, but considered obsolete for new systems
DES was published in the 1970s as a federal encryption standard. It became one of the most-studied block ciphers and influenced later cipher designs. Over time, advances in computing power and cryptanalysis exposed the small key size and other limitations. Modern designs use AES or more recent authenticated ciphers; DES is retained only for legacy compatibility (often via Triple DES).
DES encrypts a 64-bit input block using a 56-bit key through 16 Feistel rounds with fixed substitution and permutation steps.
High-level steps for one 64-bit block:
- Apply Initial Permutation (IP) to the 64-bit plaintext.
- Split result into two 32-bit halves (L_0, R_0).
- For round i = 1..16:
- L_i = R_{i-1}
- R_i = L_{i-1} XOR F(R_{i-1}, K_i) where F is the round function and K_i is the 48-bit round subkey.
- After round 16, swap the halves (R_16, L_16).
- Apply the Final Permutation (IP^{-1}) to produce the 64-bit ciphertext.
Decryption uses the same structure with the round subkeys applied in reverse order.
The round function F(R, K) maps a 32-bit input R and a 48-bit subkey K to a 32-bit output:
- Expansion: Expand 32-bit R to 48 bits using the fixed expansion permutation E (repeats some bits).
- Key mixing: XOR the expanded R with the 48-bit subkey K.
- Substitution: Break the 48-bit result into eight 6-bit pieces; feed each to a corresponding S-box (nonlinear substitution) which outputs 4 bits, producing 32 bits in total.
- Permutation: Apply a fixed 32-bit permutation P to the concatenated S-box outputs.
The S-boxes are the only nonlinear components and are critical for the cipher's security.
DES derives sixteen 48-bit round subkeys from the 64-bit key (including parity bits) as follows:
- Parity drop (PC-1): discard the eight parity bits to produce a 56-bit key (C_0 || D_0).
- For each round i = 1..16:
- Left-rotate C_{i-1} and D_{i-1} by 1 or 2 bits depending on the round number (the rotation schedule is fixed).
- Apply compression permutation PC-2 to the concatenated C_i || D_i to select 48 bits — this is K_i.
Notes:
- Parity bits: every byte of the original 64-bit key includes one parity bit (historical requirement). Implementations should accept and handle parity bits but must not treat them as security material.
- Weak keys and semi-weak keys: a small set of keys produce weak or related subkeys; implementations should either detect and avoid these keys or rely on higher-level key management to prevent their use.
This pseudocode is intended to show the control flow and main operations; it omits low-level bit-indexing details and the exact permutation tables.
function DES_Encrypt_Block(block64, key64): state = InitialPermutation(block64) (L, R) = split32(state) subkeys = KeySchedule(key64) # array of 16 48-bit values for i in 1..16: tmp = R R = L XOR FEistelF(R, subkeys[i]) L = tmp preoutput = concat(R, L) # note swap after last round return FinalPermutation(preoutput)
Decryption uses subkeys in reverse: for i = 16..1.
- Modes: As a block cipher, DES must be used with a secure mode of operation (CBC, CTR, etc.) and with authenticated encryption (AEAD) or Encrypt-then-MAC when integrity is needed.
- 2DES vs 3DES: Using DES twice (two-key 2DES) is vulnerable to meet-in-the-middle attacks that significantly reduce effective key strength. Triple DES (3DES) applies DES three times and is commonly used in two variants:
- 2-key 3DES (K1, K2, K1): better than single DES but weaker than full 3-key 3DES and subject to some restrictions.
- 3-key 3DES (K1, K2, K3): provides higher security but is slower and has been phased out for many applications.
Practical guidance: prefer AES for new applications. If you must support legacy systems, prefer 3-key 3DES only for compatibility and follow current regulatory guidance (NIST recommendations have progressively limited DES/3DES use).
- Key length: the 56-bit effective key length is too short against modern brute-force attacks; exhaustive key search is feasible with moderately resourced attackers.
- Meet-in-the-middle: double encryption (2DES) can be attacked faster than brute force by meet-in-the-middle techniques, reducing its effective security.
- Advanced cryptanalysis: differential and linear cryptanalysis techniques, developed after DES was standardized, can exploit structural properties; DES's design includes some resistance, but the small key size remains the primary concern.
- Implementation risks: side-channel attacks (timing, power analysis) — implementations must mitigate these (constant-time operations, masking, hardware protections) where high assurance is required.
Because of these weaknesses, DES should not be used for new systems; use AES or modern authenticated ciphers instead.
- Bit and byte ordering: many descriptions of DES index bits in a particular order; be careful when implementing permutations and expansion functions — test against known test vectors.
- Parity bits: some implementations validate parity bytes; upstream key management typically ignores parity for entropy calculations.
- Constant-time: avoid table lookups indexed by secret data when implementing S-box lookups in software unless mitigations are in place.
- Libraries: use a well-reviewed cryptographic library whenever possible rather than implementing DES yourself.
- Legacy protocols and devices (old payment systems, legacy hardware) may use DES or 3DES.
- Interoperability requirements: you may need DES to communicate with legacy peers; isolate and compartmentalize such uses, apply strict monitoring, and migrate away where possible.
- If you control both ends: migrate to AES-GCM or ChaCha20-Poly1305 (AEAD) as the first choice.
- If you must interoperate with DES-only endpoints: prefer 3-key 3DES and limit the scope, duration, and privilege of that data path.
- Never use single DES for new confidential data.
- Original DES standard and FIPS publications (historical).
- Cryptanalysis literature on differential and linear attacks; meet-in-the-middle analysis for multiple encryption.
- Current cryptographic standards and NIST guidance for algorithm transitions and legacy deprecatio