The Technical Director of the NSA Information Assurance Directorate gave a less sinister explanation for this in a keynote talk[1]. It was dropped from 64 bits

The Technical Director of the NSA Information Assurance Directorate gave a less sinister explanation for this in a keynote talk[1]. It was dropped from 64 bits to 56 bits for two reasons: 1) they wanted to add 8 parity bits to make it more robust for tactical military use, and 2) they decided that 56 bits would be an acceptable key length to only last for a couple decades before it would have to be replaced. They had no way of knowing in 1976 what advances in cryptanalysis would be made over the next several decades, and wanted to make sure that the public wouldn't be tempted to rely on any one particular algorithm longer than was necessary. This might seem counter-intuitive at first, but remember that the biggest threat to NSA cryptography was from Soviet cryptanalytic work, not from the public sector. Public researchers would publish any advances they made. If the Soviets cracked DES there wouldn't be any public notification - they'd just siphon off sensitive data for years until they were caught. [1] http://vimeo.com/97891042 http://vimeo.com/97891042 (the whole talk is interesting, but jump to 22:50 for the DES part)