No abstract

No abstract

A s part of a report on cycling experiments with DES, Rivest [ l ] announced at Crypto'85 that a small cycle had been found when alternately encrypting with the all zeroes key and the all ones key. This cycle contained approxlmately 233 points. Later in the same meeting, Coppersmith 1 2 1 explained this phenomenon by noting that if a fixed point occurred ln the cycle, since with these keys encryption is the same as decryptlon, the successive encryptions would actually be decryptlons and would retrace the steps to the mtartlng point. We can plcture this as follows: where x is the starting point, y Is the fixed point and K and represent the keys used. He also argued that since there are 2 such fixed points for each of these keys, the apparently small size of the cycle reported was not actually surprising. Intrigued by these observations, we began an in-depth study of the cycle structure of DES using weak and semi-weak keys. The results presented in this paper outllne the current status of that study. 32-This work performed at Sandia National Laboratorles supported by the U. S. Dept. of Energy under contract no. DE-ACOI-76DP00789.

The S-boxes used in the DES are the major cryptographic component of the system. Any structure which they possess can have far reaching implications for the security of the algorithm. Structure m a y exist as a result of design principles intended to strengthen security. Structure could also exist as a "trapdoor" for breaking the system. This paper examines some properties which the S-boxes satisfy and attempts to determine a reason for such structure to exist.will be the 6 input bits into the i'th S-box. Let Then c = ( e l ... ~4 8 ) . d~( i -, ) +~. . . d 4 ( i -~) + 4 be the output bits from the i'th S-box. f ( a , k ) = d . Let d = (dl...d32).

No abstract