DES (Data Encryption Standard)
The first public, government-standardised cipher — and the cipher that started a generation of academic cryptanalysis.
Why This Matters
DES was the first cipher whose specification was fully public, peer-reviewed, and adopted as a government standard. That openness — controversial at the time — created modern academic cryptanalysis: Biham and Shamir's differential cryptanalysis (1991) and Matsui's linear cryptanalysis (1993) were both invented to attack DES, and both reshaped how every subsequent cipher is designed.
IBM's Horst Feistel led the design of Lucifer in the early 1970s. NBS (now NIST) issued an open call for a standard cipher; IBM submitted a hardened Lucifer derivative; NSA modified the S-boxes and reduced the key from 112 bits to 56 bits. Cryptographers cried foul over the key-length cut and the unexplained S-box changes — until 1991, when Biham and Shamir showed the NSA's S-boxes were specifically hardened against differential cryptanalysis, a technique IBM and NSA both knew about and the public did not.
DES is a 16-round Feistel network. The 64-bit plaintext is split into two 32-bit halves L and R. Each round computes Li+1 = Ri and Ri+1 = Li ⊕ F(Ri, Ki). The round function F expands R to 48 bits, XORs the round subkey, passes the result through eight 6-to-4-bit S-boxes (the heart of DES's non-linearity), and applies a final permutation. Sixteen rounds of this with sixteen subkeys derived from the 56-bit master key produce ciphertext that survives all linear and differential attacks within its key budget — but not exhaustive search.
In 1998 the EFF's $250,000 Deep Crack machine recovered a DES key in 56 hours by brute force. By 2008 a single FPGA cluster could do it in under a day. Differential cryptanalysis requires ~247 chosen plaintexts, linear cryptanalysis ~243 known plaintexts — impractical operationally, but a clear theoretical break. Triple-DES (3DES) extended the effective key to 112 bits and bought DES another two decades, but by 2023 NIST formally retired 3DES because of the small 64-bit block size (the Sweet32 birthday attack) and modern computing capacity.
| Where | How DES is Used |
|---|---|
| Banking (1980s–2010s) | ATM PIN encryption, EMV chip cards (3DES); legacy systems still in slow migration |
| Unix passwd (until 1990s) | crypt(3) used DES iterated 25 times to hash passwords |
| Kerberos v4 | DES was the original Kerberos cipher; v5 added AES support |
| Cryptanalysis education | Every academic cryptography course still teaches DES because Feistel, S-boxes, and the avalanche effect are easiest to demonstrate on it |
| Era | Modern · 1977 |
| Status | Withdrawn 2005; replaced by AES; 3DES deprecated 2023 |
| Origin | IBM (Lucifer, 1971), modified by NSA, standardised by NBS as FIPS 46 |
| Year | 1977 |
| Type | Symmetric block cipher (Feistel network, 64-bit block, 56-bit key) |
| Modern Role | Historical foundation; 3DES still appears in legacy banking and EMV until 2023 sunset |