DES isn't widely believed to contain a backdoor. There were (a long time ago) questions about the changes the NSA made to the S-boxes, but it has since become

DES isn't widely believed to contain a backdoor. There were (a long time ago) questions about the changes the NSA made to the S-boxes, but it has since become apparent that these changes actually strengthened the cipher against differential cryptanalysis. DES was weakened in a much more prosaic manner: the effective key size was reduced to 56 bits.