Cycle Structure of the DES with Weak and Semi-Weak Keys

Abstract

A s part of a report on cycling experiments with DES, Rivest [ l ] announced at Crypto'85 that a small cycle had been found when alternately encrypting with the all zeroes key and the all ones key. This cycle contained approxlmately 233 points. Later in the same meeting, Coppersmith 1 2 1 explained this phenomenon by noting that if a fixed point occurred ln the cycle, since with these keys encryption is the same as decryptlon, the successive encryptions would actually be decryptlons and would retrace the steps to the mtartlng point. We can plcture this as follows: where x is the starting point, y Is the fixed point and K and represent the keys used. He also argued that since there are 2 such fixed points for each of these keys, the apparently small size of the cycle reported was not actually surprising. Intrigued by these observations, we began an in-depth study of the cycle structure of DES using weak and semi-weak keys. The results presented in this paper outllne the current status of that study. 32-This work performed at Sandia National Laboratorles supported by the U. S. Dept. of Energy under contract no. DE-ACOI-76DP00789.

Constructing Symmetric Ciphers Using the CAST Design Procedure

“…From work done on cycling properties and key scheduling in DES [12,14,25,40], the following definitions have been introduced. A key is weak if it is its own inverse (such keys generate a palindromic set of subkeys 15 and have 2 32 fixed points in DES).…”

“…The ciphers produced, known as CAST ciphers, appear to have good resistance to differential cryptanalysis [8], linear cryptanalysis [33], and related-key cryptanalysis [9]. Furthermore, they can be shown to possess a number of desirable cryptographic properties such as avalanche [18,19], Strict Avalanche Criterion (SAC) [54], Bit Independence Criterion (BIC) [54], and an absence of weak and semi-weak keys [25,12,40]. CAST ciphers are based on the well-understood and extensively-analyzed framework of the Feistel cipher [18,19]-the framework used in DES-but with a number of improvements (compared to DES) in both the round function and the key schedule which provide good cryptographic properties in fewer rounds than DES.…”

Applied cryptography: Protocols, algorithms, and source code in C

“…There is further analysis on weak and semiweak keys in [1116], and additional key patterns have been investigated for weaknesses. None have been found.…”

“…Various cryptographers wrestled with this question [588,427,431,527,723,789]. Cycling experiments gathered "overwhelming evidence" that DES is not a group [807,371,808,1116,809], but it wasn't until 1992 that cryptographers proved that DES is not a group [293]. Coppersmith said that the IBM team knew it all along.…”

A New Class of Weak Keys for Blowfish

“…The notion of fixed points of weak DES keys is well known [9,6,12,13] 1 . These works focus on algebraic properties of DES permutations and their short cycles.…”