The idea in plain English: DES splits a 64-bit block of data into two halves (left and right, 32 bits each). It runs the data through 16 rounds where each round takes the right half, runs it through a complex mangler function (which mixes in a portion of the secret key), then XORs the result with the left half. The two halves are then swapped before the next round. This Feistel network structure means encryption and decryption use the same algorithm — just feed the subkeys in reverse order.
Why this really exists: DES was the US government's official encryption standard from 1977 to 2001. It was developed at IBM (based on an earlier cipher called Lucifer) and adopted by the National Bureau of Standards (now NIST). Every ATM transaction, every bank wire, and countless government secrets were protected by DES. In 1998, the EFF's Deep Crack machine broke DES in 56 hours by brute-forcing all 256 keys — proving 56-bit keys were no longer enough. DES was officially replaced by AES in 2001, but its 3-key variant (Triple DES / 3DES) is still in use in legacy banking systems.
Every DES round follows the same pattern. For round i with subkey Ki:
💡 The Feistel structure is brilliant because decryption is identical to encryption — you just reverse the subkey order. The F function does not need to be invertible. This is why AES (non-Feistel) has a separate decryption algorithm.
Full DES is complex, but a reduced 8-bit version captures the essence. Instead of a 64-bit block and 48-bit subkeys, we use 8-bit blocks and 10-bit keys:
The simplified S-DES (by Edward Schaefer) uses this exact structure with 2 rounds, 2 S-boxes, and an 8-bit block. It's a common exercise in undergraduate cryptography courses.
DES has eight S-boxes (Substitution boxes), each a 4×16 table mapping 6-bit inputs to 4-bit outputs. S-boxes are the only non-linear element in DES — without them, the entire cipher would be solvable with linear algebra. The S-box design was kept classified by the NSA (sparking conspiracy theories), but was later proven to be resistant to differential cryptanalysis, suggesting IBM/NSA knew about that attack 20 years before it was publicly discovered.
💡 Each S-box is carefully designed so that changing one input bit changes at least two output bits (avalanche effect). The S-box tables were later published in FIPS PUB 46 and are now public.
Let's trace round 1 of DES with a simplified 32-bit halves (actual DES uses 64-bit blocks, but the structure is identical). Say after the initial IP permutation we have:
The process repeats for 16 rounds. After round 16, the left and right halves are concatenated (without a final swap) and passed through the inverse IP permutation to produce the 64-bit ciphertext block.
| Rounds | Security Level | Notes |
|---|---|---|
| 2 | ❌ Trivially breakable | Linear cryptanalysis recovers key in seconds |
| 4 | ❌ Very weak | Differential cryptanalysis succeeds easily |
| 8 | ⚠️ Marginally secure | 232 known plaintexts needed for attack |
| 12 | 🟡 Moderate | Approaching practical security for 1980s threats |
| 16 | ✅ Full DES security | Designed to be optimal — more rounds wouldn't help |
| 24+ | 🟢 Over-engineered | Used in 3DES (3×16 rounds = 48 rounds total) |
💡 DES uses exactly 16 rounds. This was chosen because differential cryptanalysis of DES requires 247 chosen plaintexts at 16 rounds — vs 229 at 12 rounds and 212 at 6 rounds. The 16-round design was the sweet spot for security vs performance in 1977 hardware.
1972: US National Bureau of Standards (NBS) calls for a government encryption standard
1974: IBM submits a modified version of their Lucifer cipher (developed by Horst Feistel)
1975: NSA reviews the design, suggests changes — key reduced from 128 to 56 bits (controversial!), S-boxes modified
1977: DES officially adopted as FIPS PUB 46 — becomes the global standard for 24 years
1990: Differential cryptanalysis discovered publicly by Biham & Shamir — DES S-boxes are actually optimal against it (meaning NSA knew in 1975!)
1993: Linear cryptanalysis published by Matsui — first theoretical attack faster than brute force
1997: DESCHALL project cracks a DES message in 96 days via distributed computing
1998: EFF Deep Crack — a $250,000 custom machine cracks DES in 56 hours
1999: Deep Crack + distributed.net cracks DES in 22 hours 15 minutes
2001: AES replaces DES as the US government standard
The Deep Crack machine is now in the Computer History Museum in Mountain View, CA. It contained 1,856 custom ASIC chips running at 40 MHz and tested 90 billion keys per second.