DES

DES. The Data Encryption Standard is a symmetric-key block cipher that was once a foundational algorithm for computer security. Developed by an IBM team including Horst Feistel and later modified by the National Security Agency (NSA), it was adopted as a Federal Information Processing Standard (FIPS) in the United States for over two decades. Its widespread use in financial transactions and secure communications established it as a critical, though eventually obsolete, component of cryptographic history.

History

The origins of the cipher trace back to the early 1970s, when IBM initiated a project to develop a robust encryption algorithm, building upon earlier work like the Lucifer cipher. In 1973, the National Bureau of Standards (NBS), later renamed NIST, issued a public call for a cryptographic standard, leading to IBM's submission. The design was scrutinized and slightly altered with input from the National Security Agency, sparking early debates about potential backdoors. It was formally published as FIPS PUB 46 in 1977 after public consultation and became mandatory for all sensitive but unclassified U.S. government data. Its adoption was accelerated by the need for security in burgeoning sectors like automated teller machine networks and the Secure Sockets Layer protocol.

Technical description

The algorithm operates on 64-bit blocks of plaintext using a 56-bit key, though the key is input as 64 bits with 8 bits used for parity. Its core structure is a 16-round Feistel network, a design principle pioneered by Horst Feistel. Each round uses a different 48-bit subkey derived from the main key via a key schedule. The central nonlinear component is the S-box (Substitution-box), which provides confusion and diffusion. The round function also employs expansion and permutation steps, alongside an XOR operation. The final step is an initial and final permutation, with the latter being the inverse of the former, framing the Feistel rounds.

Security and cryptanalysis

Concerns about the cipher's security emerged early, particularly regarding the key length and the design of the S-boxes, with some theorists like Whitfield Diffie and Martin Hellman predicting vulnerabilities. The most successful attack is a brute-force attack, made practical by increasing computational power, exemplified by projects like DES Challenges and machines like Deep Crack. More sophisticated analytical methods, including differential cryptanalysis and linear cryptanalysis, were later shown to be effective, though these were arguably known to the National Security Agency during the design phase. It was considered practically broken in 1998 when the Electronic Frontier Foundation built a dedicated machine to crack a key in days.

Applications and legacy

For many years, this algorithm was ubiquitous in commercial and government security, forming the backbone for systems like ATM encryption, the Kerberos authentication protocol, and early versions of Microsoft Windows. Its standardization fostered interoperability and advanced the field of public-key cryptography by creating a clear need for secure key exchange methods. The process of its selection and eventual replacement set important precedents for public evaluation of cryptographic standards, directly leading to the Advanced Encryption Standard (AES) competition. It remains a vital educational tool for understanding block cipher design and cryptanalysis.

Variants and derivatives

To address the short key length, Triple DES (3DES) was developed, which applies the cipher three times with two or three keys, significantly increasing security and remaining in use for some financial services applications. Other modifications include DES-X, which uses key whitening to improve resistance against brute-force attacks, and G-DES, a generalized version intended to increase speed. The cipher's structure also influenced the design of other algorithms, such as the International Data Encryption Algorithm (IDEA) and the Feistel network design seen in later ciphers like Blowfish.

Category:Symmetric-key cryptosystems Category:Computer security standards Category:Block ciphers