This story is kind of true, but is missing some detail. The first differential attack on DES broke up to 15 rounds, that is correct [1]. 2 years later, however,

This story is kind of true, but is missing some detail. The first differential attack on DES broke up to 15 rounds, that is correct [1]. 2 years later, however, the same team broke the full 16 rounds, albeit with a hefty amount of chosen plaintexts [2]. Coppersmith disclosed the DES design choices a year after that, showing that the S-boxes had been changed to increase resistance to differential attacks, in 1994 [3]. Additionally, Matsui's linear cryptanalysis of DES didn't seem to have been taken into account and also broke through the full DES [4]. Another interesting anecdote is the tale of Skipjack, which unlike DES was an entirely NSA-designed block cipher. After it was disclosed in 1998, an impossible differential attack broke exactly 31 out of 32 rounds, and I believe that is still the best known result today [5]. [1] http://link.springer.com/chapter/10.1007%2F3-540-38424-3_1 http://link.springer.com/chapter/10.1007%2F3-540-38424-3_1 [2] http://link.springer.com/chapter/10.1007%2F3-540-48071-4_34 http://link.springer.com/chapter/10.1007%2F3-540-48071-4_34 [3] http://simson.net/ref/1994/coppersmith94.pdf http://simson.net/ref/1994/coppersmith94.pdf [4] http://link.springer.com/chapter/10.1007%2F3-540-48285-7_33 http://link.springer.com/chapter/10.1007%2F3-540-48285-7_33 [5] http://link.springer.com/chapter/10.1007%2F3-540-48910-X_2 http://link.springer.com/chapter/10.1007%2F3-540-48910-X_2