3 ms·

My crypto prof in uni commented on this. (This is from memory). Apparently, the number of rounds (16) seemed to have been chosen arbitrarily. Many years later,

My crypto prof in uni commented on this. (This is from memory). Apparently, the number of rounds (16) seemed to have been chosen arbitrarily. Many years later, when attacks on Feistel(?) ciphers (of which DES is one) became public, it turned out that these attacks only worked up to .... 15 rounds! So the speculation was that the NSA knew about the attack, and chose to set the round number just out of reach...

tptacek 11y ago
My understanding is that NSA's changes to DES were all in the s-boxes, and that it was the s-box changes that hardened it against differential cryptanalysis. I think there's even a story that tries to explain how they did it (randomly generating s-boxes selecting the ones least vulnerable to the attack).
- Nelson69 11y ago
  Don Coppersmith wrote an article in the IBM system's journal that said as much.
pbsd 11y ago
This story is kind of true, but is missing some detail. The first differential attack on DES broke up to 15 rounds, that is correct [1]. 2 years later, however, the same team broke the full 16 rounds, albeit with a hefty amount of chosen plaintexts [2]. Coppersmith disclosed the DES design choices a year after that, showing that the S-boxes had been changed to increase resistance to differential attacks, in 1994 [3]. Additionally, Matsui's linear cryptanalysis of DES didn't seem to have been taken into account and also broke through the full DES [4]. Another interesting anecdote is the tale of Skipjack, which unlike DES was an entirely NSA-designed block cipher. After it was disclosed in 1998, an impossible differential attack broke exactly 31 out of 32 rounds, and I believe that is still the best known result today [5]. [1] http://link.springer.com/chapter/10.1007%2F3-540-38424-3_1 http://link.springer.com/chapter/10.1007%2F3-540-38424-3_1 [2] http://link.springer.com/chapter/10.1007%2F3-540-48071-4_34 http://link.springer.com/chapter/10.1007%2F3-540-48071-4_34 [3] http://simson.net/ref/1994/coppersmith94.pdf http://simson.net/ref/1994/coppersmith94.pdf [4] http://link.springer.com/chapter/10.1007%2F3-540-48285-7_33 http://link.springer.com/chapter/10.1007%2F3-540-48285-7_33 [5] http://link.springer.com/chapter/10.1007%2F3-540-48910-X_2 http://link.springer.com/chapter/10.1007%2F3-540-48910-X_2

tptacek 11y ago

My understanding is that NSA's changes to DES were all in the s-boxes, and that it was the s-box changes that hardened it against differential cryptanalysis. I think there's even a story that tries to explain how they did it (randomly generating s-boxes selecting the ones least vulnerable to the attack).

Nelson69 11y ago
Don Coppersmith wrote an article in the IBM system's journal that said as much.

pbsd 11y ago

This story is kind of true, but is missing some detail. The first differential attack on DES broke up to 15 rounds, that is correct [1]. 2 years later, however, the same team broke the full 16 rounds, albeit with a hefty amount of chosen plaintexts [2]. Coppersmith disclosed the DES design choices a year after that, showing that the S-boxes had been changed to increase resistance to differential attacks, in 1994 [3]. Additionally, Matsui's linear cryptanalysis of DES didn't seem to have been taken into account and also broke through the full DES [4]. Another interesting anecdote is the tale of Skipjack, which unlike DES was an entirely NSA-designed block cipher. After it was disclosed in 1998, an impossible differential attack broke exactly 31 out of 32 rounds, and I believe that is still the best known result today [5]. [1] http://link.springer.com/chapter/10.1007%2F3-540-38424-3_1 http://link.springer.com/chapter/10.1007%2F3-540-38424-3_1 [2] http://link.springer.com/chapter/10.1007%2F3-540-48071-4_34 http://link.springer.com/chapter/10.1007%2F3-540-48071-4_34 [3] http://simson.net/ref/1994/coppersmith94.pdf http://simson.net/ref/1994/coppersmith94.pdf [4] http://link.springer.com/chapter/10.1007%2F3-540-48285-7_33 http://link.springer.com/chapter/10.1007%2F3-540-48285-7_33 [5] http://link.springer.com/chapter/10.1007%2F3-540-48910-X_2 http://link.springer.com/chapter/10.1007%2F3-540-48910-X_2