The DES Algorithm: The Cipher That Built Modern Cryptography

Introduction

The Data Encryption Standard (DES) was the U.S. government’s official encryption algorithm from 1977 until it was formally retired in favor of AES in 2001. For over two decades, it was the most widely used encryption algorithm in the world, securing everything from banking transactions to government communications. Today, DES is thoroughly broken — its 56-bit key can be brute-forced in hours on modern hardware — but understanding how it works is essential, because its core design, the Feistel network, shaped the architecture of dozens of ciphers that followed it, including 3DES, Blowfish, and Twofish.

Table of Contents

• History and Origins
• The Feistel Network Structure
• How DES Works
• A Worked Example
• Why DES Is Broken
• DES’s Legacy
• FAQ
• References

History and Origins

DES traces back to an IBM-developed cipher called Lucifer, created in the early 1970s. In 1973, the U.S. National Bureau of Standards (now NIST) issued a public call for a standardized encryption algorithm, and IBM’s submission — a refined version of Lucifer — was selected and published as the Data Encryption Standard in 1977 (FIPS PUB 46).

The standardization process wasn’t without controversy: the NSA was involved in reviewing the design and shortened the original Lucifer key from 128 bits to just 56 bits, a decision that fueled decades of suspicion about a deliberately weakened algorithm. Interestingly, the NSA also modified the cipher’s internal S-boxes in ways that, decades later, were shown to strengthen DES against a then-undisclosed attack technique called differential cryptanalysis — an early example of a standards body being ahead of publicly known cryptanalysis.

The Feistel Network Structure

DES is built around a Feistel network, an elegant construction named after Horst Feistel, who developed the technique at IBM. The core idea: split the data block in half (Left and Right), and in each round, run the right half through a “round function” combined with a round key, then XOR the result into the left half — and swap the halves for the next round.

The beauty of a Feistel network is that the round function doesn’t need to be reversible at all — decryption simply runs the exact same rounds in reverse order with the same round keys, regardless of how complicated the round function is internally. This structural elegance is why Feistel networks became the template for so many ciphers that followed DES.

How DES Works

1. Initial Permutation (IP): The 64-bit plaintext block is rearranged according to a fixed, publicly known bit permutation table. This step provides no cryptographic strength on its own — it exists mostly for historical hardware-implementation reasons.
2. 16 Feistel rounds: The permuted block is split into two 32-bit halves, L and R. In each of 16 rounds:
   • R is expanded from 32 to 48 bits (the E expansion table) and XORed with that round’s 48-bit subkey.
   • The result passes through eight S-boxes, each mapping 6 input bits to 4 output bits — the only non-linear step in DES, and the source of most of its cryptographic strength.
   • The 32-bit S-box output is permuted again (the P permutation) and XORed into L.
   • L and R swap for the next round.
3. Key schedule: The original 64-bit key (56 effective bits plus 8 parity bits) is permuted (PC-1), split into two 28-bit halves, and rotated left by 1 or 2 bits each round (following a fixed schedule) to produce sixteen distinct 48-bit round keys via a second permutation (PC-2).
4. Final Permutation (FP): After 16 rounds (with no swap after the final round), the block passes through the inverse of the initial permutation to produce the 64-bit ciphertext.

Interactive Visualizer

Watch DES’s Feistel network in action above — the L and R halves updating each of the 16 rounds as the round function scrambles the block, using the exact S-boxes, permutation tables, and key schedule defined in the original 1977 standard.

A Worked Example

The visualizer defaults to the classic textbook DES test vector, reproduced in nearly every cryptography course:

• Key: 133457799BBCDFF1
• Plaintext: 0123456789ABCDEF
• Ciphertext: 85E813540F0AB405

Every correct DES implementation — including the one powering the visualizer above — must reproduce this exact ciphertext.

Why DES Is Broken

DES’s fatal weakness was never its Feistel structure or S-box design — those have held up remarkably well against decades of cryptanalysis. Its weakness is simply key size. A 56-bit key means 2⁵⁶ possible keys — roughly 72 quadrillion. That sounded impossibly large in 1977, but computing power caught up:

• In 1998, the Electronic Frontier Foundation’s purpose-built “Deep Crack” hardware brute-forced a DES key in under three days.
• Modern GPU clusters or cloud computing can exhaust the DES keyspace in a matter of hours.
• DES’s relatively small 64-bit block size also creates practical vulnerabilities (like the Sweet32 attack) in modes that encrypt large volumes of data under one key.

NIST officially withdrew DES as a federal standard in 2005, though “single DES” had been considered inadequate for new systems since the 1990s.

DES’s Legacy

Rather than disappearing, DES’s core idea was reinforced rather than replaced at first: 3DES simply applies the DES algorithm three times with (typically) two or three different keys, extending the effective key strength while reusing every bit of DES’s original, well-analyzed internal structure. The Feistel network pattern DES popularized also directly inspired Blowfish, Twofish, and many other ciphers. Even AES, which uses a different (substitution-permutation) structure rather than a Feistel network, was evaluated and standardized using the same rigorous, open, public-competition process that DES’s development helped establish as the norm.

FAQ

Is DES still safe to use?

No. Single DES’s 56-bit key can be brute-forced in hours with modern hardware. It should never be used for new systems — use AES instead.

What’s the difference between DES and 3DES?

3DES applies the DES algorithm three times in sequence (typically encrypt-decrypt-encrypt, “EDE”) with two or three different keys, extending the effective security well beyond single DES while reusing the same underlying, well-studied cipher.

Why does DES use exactly 16 rounds?

Sixteen rounds was determined empirically during DES’s design to provide adequate diffusion and resistance to the cryptanalysis techniques known at the time, while keeping the cipher fast enough for 1970s hardware. Fewer rounds are known to be breakable by differential cryptanalysis; more rounds would have been more secure but slower.

What is a Feistel network, and why was it so influential?

A Feistel network splits data into two halves and repeatedly applies a round function to one half, XORing the result into the other half, then swapping. It’s influential because decryption is guaranteed to work using the exact same structure in reverse, regardless of how complex the round function is — a huge design convenience that many later ciphers (3DES, Blowfish, Twofish, and more) adopted directly.

Why did the NSA shorten the key from Lucifer’s original 128 bits to 56 bits?

The official reasoning at the time was balancing security with the hardware performance and export-control constraints of the era. It remains one of the most debated decisions in cryptographic history, especially since it left DES far more vulnerable to brute force than it needed to be.

References

1. NIST. “FIPS PUB 46-3: Data Encryption Standard (DES).” Available at: https://csrc.nist.gov/csrc/media/publications/fips/46/3/archive/1999-10-25/documents/fips46-3.pdf

2. Wikipedia. “Data Encryption Standard.” Available at: https://en.wikipedia.org/wiki/Data_Encryption_Standard

3. Electronic Frontier Foundation. “Cracking DES: Secrets of Encryption Research, Wiretap Politics and Chip Design.” 1998.

4. Wikipedia. “Feistel cipher.” Available at: https://en.wikipedia.org/wiki/Feistel_cipher

5. Coppersmith, D. “The Data Encryption Standard (DES) and its strength against attacks.” IBM Journal of Research and Development, 1994.