DES (Data Encryption Standard)
A landmark public, government-standardised block cipher — and the cipher that started a generation of academic cryptanalysis.
Broken (brute force, 1998)
Why This Matters
DES made a complete modern block-cipher specification widely available as a US federal standard. Its public scrutiny helped establish academic cryptanalysis. Differential and linear cryptanalysis used DES as a major test case and influenced the design of later ciphers.
IBM's Horst Feistel led the design of Lucifer in the early 1970s. NBS (now NIST) issued an open call for a standard cipher; IBM submitted a hardened Lucifer derivative; NSA participated in the review; the resulting DES design used a 56-bit effective key and strengthened S-boxes. Cryptographers cried foul over the key-length cut and the unexplained S-box changes — until 1991, when Biham and Shamir showed the NSA's S-boxes were specifically hardened against differential cryptanalysis, a technique IBM and NSA both knew about and the public did not.
DES is a 16-round Feistel network. The 64-bit plaintext is split into two 32-bit halves L and R. Each round computes Li+1 = Ri and Ri+1 = Li ⊕ F(Ri, Ki). The round function F expands R to 48 bits, XORs the round subkey, passes the result through eight 6-to-4-bit S-boxes (the heart of DES's non-linearity), and applies a final permutation. Sixteen rounds of this with sixteen subkeys derived from the 56-bit master key produce a reversible block cipher. Its 56-bit key is too small to withstand modern exhaustive search.
In 1998 the EFF's Deep Crack machine recovered a DES key in about 56 hours. Differential and linear cryptanalysis also showed important theoretical weaknesses, although their data requirements limit their practical use. Triple-DES extended DES's useful life, but retained its small 64-bit block size. NIST withdrew SP 800-67 Rev. 2 on 1 January 2024: TDEA is disallowed for applying new protection, while processing already protected data remains permitted. This is a NIST transition rule, not a claim that every banking deployment ended on that date.
| Where | How DES is Used |
|---|---|
| Banking (1980s–2010s) | ATM PIN encryption, EMV chip cards (3DES); legacy systems still in slow migration |
| Unix passwd (until 1990s) | crypt(3) used DES iterated 25 times to hash passwords |
| Kerberos v4 | DES was the original Kerberos cipher; v5 added AES support |
| Cryptanalysis education | DES remains a useful teaching example because Feistel, S-boxes, and the avalanche effect are easiest to demonstrate on it |
| Era | Modern · 1977 |
| Status | DES withdrawn in 2005; NIST disallowed new TDEA protection after 2023 |
| Origin | IBM (Lucifer, 1971), modified by NSA, standardised by NBS as FIPS 46 |
| Year | 1977 |
| Type | Symmetric block cipher (Feistel network, 64-bit block, 56-bit key) |
| Modern Role | Historical foundation; legacy TDEA data may still require processing during migration |
Primary Sources
NIST withdrawal notice for TDEA (2023; effective 1 January 2024).