DES (Data Encryption Standard).

DES is a symmetric block cipher built on a 16-round Feistel network operating on 64-bit blocks with a 56-bit effective key (the 64-bit key includes 8 parity bits). It grew out of IBM's Lucifer cipher and was standardized as FIPS PUB 46 in 1977 by the National Bureau of Standards, becoming the workhorse of commercial cryptography for two decades. Its design notably strengthened the S-boxes against differential cryptanalysis — a technique the NSA and IBM knew about years before it was publicly rediscovered by Biham and Shamir in the late 1980s.

The fatal weakness is key length. A 56-bit space contains only ~7.2×10¹⁶ keys. In 1998 the EFF's purpose-built Deep Crack machine (cost ~$250,000) recovered a DES key in about 56 hours; in 1999 it teamed with distributed.net to do so in 22 hours. Today a modest GPU or FPGA cluster, or a cloud rental, brute-forces DES in hours. Cryptanalytic shortcuts (differential and linear cryptanalysis) exist but remain slower than exhaustion in practice.

DES is therefore considered broken and is disallowed by NIST (SP 800-131A), PCI DSS, and virtually every modern standard. Triple DES (3DES) — applying DES three times for ~112-bit strength — served as a bridge but is itself vulnerable to the Sweet32 birthday attack (CVE-2016-2183) on its 64-bit block, and NIST deprecated 3DES with a hard disallow after 2023. AES is the mandated replacement. DES survives only in legacy systems (early Kerberos v4, older payment hardware).

flowchart TD
  P[64-bit plaintext block] --> IP[Initial permutation]
  IP --> S[Split into L0 and R0]
  S --> F[16 Feistel rounds<br/>each: expansion, XOR subkey,<br/>S-box substitution, permutation]
  K[56-bit key] --> KS[Key schedule<br/>16 round subkeys]
  KS --> F
  F --> FP[Final permutation]
  FP --> C[64-bit ciphertext]
  C -.->|56-bit key too short| B[Brute force<br/>Deep Crack: ~56h 1998]
  B --> R[Broken - replaced by AES;<br/>3DES bridge deprecated 2023]