by D.

Coppersmith
I he Data
Encryption
Standard
(DES) and
its strength
against attacks

The Data Encryption Standard (DES) was During the early 1970s, it became apparent that the
developed by an IBM team around 1974 and commercial sector also has a legitimate need for
adopted as a national standard in 1977.Since cryptography. Corporate secrets must be transmitted
that time, many cryptanalysts have attempted between distant sites, without the possibility of
to find shortcuts for breaking the system. In eavesdropping by industrial spies. Personal data on
this paper, we examine one such attempt, the databases need to be protected against espionage and
method of differential cryptanalysis, published alteration.
by Blham and Shamir. We show some of the A familiar example is the communication between an
safeguards against differential cryptanalysis automatic teller machine (ATM) and a central computer.
that were built into the system from the The user inserts a magnetic card and types a few numbers.
beginning, with the result that more than 1015 The ATM sends messages to the computer. The computer
bytes of chosen plaintext are required for this checks the account balance and returns a message
attack to succeed. authorizing the ATM to dispense funds. Obviously, if these
messages are unprotected, a thief can tap the wires, find
the message authorizing the dispensing of funds, and send
Introduction multiple copies of that message to the ATM, thereby
Cryptography has long been in use by governments, cleaning out the supply of cash from the ATM.
particularly in the realms of military and diplomatic In the early 1970s, a banking customer asked IBM to
communication. It is hard to imagine military develop a system for encrypting ATM data. With this
communication without cryptography; cryptanalysis, or problem as a starting point, a team was formed from
secretly deciphering the opponents messages, is perhaps
Disclaimer
of even greater value. Much has been written about The present author participated in the design and test of DES, particularly in the
cryptography in the military; see reference [l]for design of the S-boxes and in strengthening them against differential cryptanalysis.
Naturally, this author has strong opinions about DES and its history. Any opinions
example. in this paper are those of the author and are not necessarily shared by IBM.

0Copyrlght 1994 by International Business Machines Corporation. Copying in printed form for private use is permitted without payment of royalty provided that (1) each
reproduction is done without alteration and (2) the Journal reference and IBM copyright notice are included on the first page. The title and abstract, but no other portions, of
this paper may be copied or distributed royalty free without further permission by computer-based and other information-servicesystems. Permission to republish any other
portion of this paper must be obtained from the Editor. 243

IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994 D. COPPERSMITH

 people at two IBM sites (Kingston and Yorktown Heights, m,, , mI7are then created in sixteen rounds, according
New York). Developers included Roy Adler, Don to the procedure described below. Finally, the 64-bit
Coppersmith, Horst Feistel, Edna Grossman, Alan ciphertext c is generated by applying the inverse
Konheim, Carl Meyer, Bill Notz, Lynn Smith, Walt permutation IP to the two message halves m,,, m16.
Tuchman, and Bryant Tuckerman. This team, along with (Notice the inversion: ml,, mI6rather than the natural
several consultants, developed a cryptographic algorithm. order. This is to allow decryption and encryption to use
This algorithm was then submitted to the National Bureau the same hardware.)
of Standards (NBS, which later became the National The plaintext message halves and intermediate message
Institute of Standards and Technology, or NIST) and halves m,, m,, m,, * , mI7are related as follows:
was adopted in 1977 as a national standard: the Data
Encryption Standard, or DES. The National Security mi+l = mi-l 0 f(k,,, mi) i = 1, 2, , 16.
Agency (NSA) also provided technical advice to IBM. Here k is the secret 56-bit key, and i is the number of the
The entire algorithm was published in the Federal round (from 1 through 16). Also, k p )is a selection of48
Register [2], but the design considerations, which we bits from the 56 bits of k ; this selection, or key schedule
present here, were not published at that time. The design (described in [2]), depends on the round number, i . The
took advantage of knowledge of certain cryptanalytic symbol 0denotes bit-by-bit exclusive OR (addition
techniques, most prominently the technique of differential modulo 2), which we call XOR in the text.
cryptanalysis, which were not known in the published Now we describe the function f. There are eight
literature. After discussions with NSA, it was decided that S-boxes, SI, , S,, described in the standard. Each
disclosure of the design considerations would reveal the S-box is a table lookup, using six bits as input and
technique of differential cryptanalysis, a powerful
providing four bits as output. For each S-box, say S,,
technique that can be used against many ciphers. This in
six consecutive bits are selected from the 48 bits of
turn would weaken the competitive advantage the United
namely bits 6j - 5, 6j - 4, * * , 6j. Also, six
States enjoyed over other countries in the field of
consecutive bits are selected from mi, namely bits
cryptography.
Many people speculated, however, that the lack of
4j - 4, 4j - 3, +
, 4j 1 (mod32).Themod32is
shorthand for the convention that for j = 1 the bits are
disclosure was due to some trap door or hidden
32, 1, 2, 3, 4, 5, and for j = 8 the bits are 28, 29, 30, 31,
weakness in the DES. One of the purposes of the present
32, 1. Two adjacent S-boxes share two message bits; for
paper is to dispel this notion and to indicate that, in fact,
instance, SIuses message bits 32, 1, 2, 3, 4, 5, while S,
the reason for not publishing the criteria lay in the hidden
strengths of the algorithm, not hidden weaknesses. uses message bits 4, 5, 6, 7, 8, 9, and they share bits 4 and
5. (Key bits are not shared among S-boxes on one round.)
Contents of this paper S, and S, are considered to be adjacent because they
We begin by describing DES, giving enough detail to share message bits 32 and 1.
understand what follows. We then describe the attack The six key bits and the six message bits are XORed
based on differential cryptanalysis. We continue with a together bitwise, and the resulting six bits are used as
disclosure of the design criteria of the S-boxes and input for a table lookup. That is, the six inputs to S-box Sj
permutation, and a discussion of the role of these criteria at round i are
in defeating differential cryptanalysis.

Description of DES
We give here a brief description of DES, primarily to ...
establish terminology. We do not provide the various
tables that are necessary for a full description of the mi[4j + 11 0 +,[6jl,
standard; for those, see [2] or [3]. or, written another way,
We wish to encipher a 64-bit plaintext message block m
under the 56-bit key k, to produce a 64-bit ciphertext m1[4j- 4, 4j - 3, 4j - 2, 4j - 1, 4j, 4j + 13
message block c = E,(m). (The sizes of message blocks 0 k(J6j - 5, 6j - 4, 6j - 3, 6j - 2, 6j - 1, 6jl.
and keys, 64 bits and 56 bits respectively, are specified in
the standard.) Decipherment, or recovering plaintext from Each of the eight S-boxes implements a different table,
ciphertext, is denoted m = D k ( c ) . each with 26 entries of four bits each. These tables are
The plaintext message block m is subjected to an initial described in the standard.
permutation IP, and the result is broken into two 32-bit The eight S-boxes together put out 8 X 4 = 32 bits.
244 message halves, m, and m,. Intermediate message halves These bits are permuted according to a permutation P that

D. COPPERSMITH IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994

is fixed for all rounds i. The resulting 32-bit quantity is the That is,
value off(k(,,, m,).
Am = m @ m.
In summary, the 64-bit message undergoes a
permutation ZP to produce two 32-bit message halves m, He considers the difference between the intermediate
and m,. Then we compute the 32-bit quantityf(k(,,, m,), message halves:
and XOR that quantity with m, to produce m2. We use this
Am, = mi @ m:.
new quantity m2 to compute f(k(,,, mJ, and XOR that
quantity with m, to produce m3. We continue in a like The input to S-box S,, for example, at round i of the
fashion until m16and m,, have been computed. These two encipherment of message m is
message halves are interchanged and then subjected to the
permutation ZP-, to produce the ciphertext c. mi[32,1,2,3,4,51 0 k,,[1,2,3,4,5,61,
Decryption is easily accomplished by a user in and the input to SIat round i of the encipherment of
possession of the same key k . First, one applies the message m is
permutation ZP to c to produce the message halves
m,[32,1,2,3,4,51 0 kiiJ1,2,3,4,5,61.
m17, m16. Next, one computesf(k(,,,, m16)and XORs
that quantity with m,, to recover mIj. Recalling that From the identity ( a @ c ) 0 (b@c) = a a b , we see that
the XOR of these two inputs is
m17 = m1.5 0 flk(16), m16)>

we have
(mi[32,1,2,3,4,51 0 k,,1[l,2,3,4,5,61)
0 (mJ32,1,2,3,4,51 0 k,,[1,2,3,4,5,61)
m17 flk(16) m16)
= m,[32,1,2,3,4,5] @ m([32,1,2,3,4,5]
= Km1j @ 0 flk(16) m16) = ml,
flk(16)7 m16)l 3

= Ami[32,1,2,3,4,5].
because of the identity (A 0B ) 0B = A . Similarly, one
computes m,4 = mI6@ f ( k , , , , , mlj) and continues in like The dependence on k has disappeared.
fashion until one has computed m, and m,. Applying ZP to Now suppose that there is a relation between input
the pair (m,,, m,), one recovers the plaintext message m. differences and output differences for some S-box. That is,
Any function could be used in place off, and we would the 64 possible 6-bit inputs to S, can be divided into 32
still have a reversible encryption method. Different choices pairs, so that the XOR of the two inputs in each pair is the
off, however, yield different levels of security in the given nonzero value Ami[32,1,2,3,4,5]. We call this
overall algorithm. The function f used in DES was difference AZi,,, because this is the change of inputs on the
designed to provide a high level of security. ith round for SI.For each such pair of inputs, consider the
pair of 4-bit outputs, and consider their XOR, called AO,,,.
Differential cryptanalysis Differential cryptanalysis depends on the fact that many
We present here an overview of the cryptanalytic attack input pairs with a given input difference AZi,j give rise to
known as differential cryptanalysis. The terminology the same output difference AOi,,. For example, if AZi,l is
and notation are as presented byBiham and Shamir [4] 110100, only eight of the 16 possible values of AO;,, can
(within IBM, the attack was formerly known as the occur, and one value of AOi,, (0010) occurs for eight of the
T attack). Our purpose in presenting this is to show 32 input pairs sharing the difference AZi,, = 110100. (This
how the criteria for the S-boxes and the permutation were example is from Table 27 of [4].)
developed to thwart such attacks. The quantitiesf(k(,,, mi) andf(ko, mc!)are the permuted
A cryptanalyst trying to break the system may bein outputs of the S-boxes. Recall that
possession of large amounts of plaintext and corresponding
ciphertext, but not the secret key under which the text was m,+, = mi-1 0 f(k(,), mi),
enciphered. He knows the complete specification of the
system (ZP, S-boxes, P, key schedule); he would like to
m;+, = m;-, 0 f(k,l,,m;).
deduce the key. Taking the XOR of these two equations, we find
As one can imagine, if he starts with a known plaintext
m and unknown key k and tries to trace the encipherment h i + , = @ mt+1
through 16 rounds of DES encryption, he soon becomes = b - 1 0f(k(,,, m,)l 0 [mL,0f(k,,, m;)l
hopelessly entangled, because bits of the unknown key k
are XORed with the message at the input of every S-box.
= A,-, 0 [f(k(,, mi) 0f(k(L),
mJ1.
In differential cryptanalysis, however, he starts with two So if Ami-, and Ami are known with high probability, and
messages, m and m, differing by a known difference Am. if Am, gives rise to any difference,f(k(,,, mL)@f(k(,,,m,), 245

IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994 D. COPPERSMITH

 with high probability, we know Ami+,with high on all 12 or 16 rounds. (In doing so, we are treating the
probability. events at different S-boxes on different rounds as being
In differential cryptanalysis, we begin with two statistically independent, while they are in fact dependent;
plaintext messages m and m' with a specified difference this makes the analysis easier without materially affecting
Am = (Am,,, Am,) (known with certainty). We trace the outcome.) As the number of rounds increases, the total
through a probable pattern of round-by-round differences number of active S-boxes on these rounds also increases,
Am,,Am,, * , Am,,,Am,,. If the ciphertexts and the probability decreases exponentially.
Ek(m)= ZP-'(rnl7, m,,)and E,(m') = ZP-'(rni7, mi,)
exhibit the difference of our probable pattern History and discussion
Differential cryptanalysis was not known in the open
literature until quite recently. Some of the ideas were
we suspect that this probable pattern is in fact the pattern present in Bert Den Boer's 1988 cryptanalysis [6] of the
of round-by-round differences. Assuming this probable four-round FEAL cryptographic scheme proposed by
pattern to be correct, we can then make deductions about NTT. This cryptanalysis examined the difference between
the key bits on the basis of this one plaintext-ciphertext encryptions of two related chosen plaintext messages. At
pair, and eventually discover the key. The reader is the Securicom meeting in 1989, Adi Shamir demonstrated
referred to [4] for further discussion. an attack against an eight-round, shortened version of
Notice that, under the "chosen plaintext" assumption, DES, but without making the techniques known; he and
we can choose the plaintexts m and m' to exhibit a desired Eli Biham had been investigating differential cryptanalysis
difference Am, chosen to optimize the cryptanalytic since 1988. In 1990, Sean Murphy published the method
process, and we can observe their ciphertexts [7], as used in his cryptanalysis of NTT's newer, eight-
E,(m) = ZP-'(m17, m,,)and Ek(m')= ZP-'(mi7, mi6) round version of FEAL. This was soon followed by
and their difference ZP-'(AmI7, Am,,),and compare this several papers of Biham and Shamir, among them
difference with the difference predicted by the pattern. [4, 5, 8, 91.
We cannot observe the intermediate results, mi and mi, Differential cryptanalysis was well known, however,
or their differences, Am, (2 Ii I15). to the IBM team that designed DES, as early as
Differential cryptanalysis will succeed if one of these 1974. Knowledge of this technique, and the necessity to
probable patterns, extending over the 16 rounds of the strengthen DES against attacks using it, played a large part
encipherment, has a high enough probability that it will be in the design of the S-boxes and the permutation P . We
observed among the ciphertext resulting from the corpus list the relevant design criteria employed during the design
of chosen plaintext that the cryptanalyst is able to have of the S-boxes and the permutation, and show how they
encrypted on his behalf. In fact, a given probable pattern contributed to the defense of DES against differential
has only a very low probability of matching a given pair of cryptanalysis. (Many of these criteria have been noted in
messages for the entire 16 rounds, so that an enormous the open literature; see for example [lo], where several of
number of plaintext messages (more than mustbe the criteria were discovered by reverse engineering.)
enciphered in order to have a reasonable probability of Because of this careful design, a differential cryptanalysis
success. attack against DES requires enormous amounts of chosen
Biham and Shamir [5] show ways to bypass the plaintext. Biham and Shamir [5] estimate the amount of
requirements of matching the probable pattern on the first plaintext necessary for their attack as 247.2= 1.6 x 1014
one or two rounds and the last one or two rounds of the chosen plaintext messages (of eight bytes each), or more
encipherment, so that the probable pattern need only be than 1.2 X lo1' bytes of chosen plaintext.
matched during twelve rounds of encipherment, rather It is important to notice that these messages are chosen
than sixteen. This is significant, because the probability plaintext. The attacker must arrange for this much
of existence of a given pattern decreases roughly plaintext to be enciphered by a target machine, namely, a
exponentially with the length of the pattern. machine in possession of the secret key. In general, this is
With a particular probable pattern in mind, we say that much more difficult to arrange than computations on one's
S-box Siis active on round i if AZi,j (the set of six bits of own machine. Biham and Shamir's attack aroused much
Am, that are input to S,) is not all zero. For each active interest because the number of chosen plaintext messages,
S-box on each round, we can calculate the probability that 247.2,was less than the number of encipherments,
the predicted value arises from the input AZ,,j, given 256= 7.2 x lo',, required for "key exhaustion," or
that all input pairs resulting in AZi,, are equally likely. To a trying all possible keys until one finds the correct one. But
first approximation, we can estimate the probability of the the comparison is between chosen plaintext messages
entire probable pattern as the multiplicative product of (encipherments on the target machine) and computations
246 these individual probabilities over all of the active S-boxes on one's own machine, so that a direct one-for-one

D. (30PPERSMITH IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994

comparison is misleading. At any rate, the amount of (S-5) If two inputs to an S-box differ in the two middle
necessary chosen plaintext is so enormous as to render the bits exactly, the outputs must differ in at least two
attack infeasible. bits. (If AZi,j = 001100, then IAO,,,I 2 2.)
We remark that iterated encryption enhances the
(S-6) If two inputs to an S-box differ in their first two bits
strength of DES against both key exhaustion and
and are identical in their last two bits, the two
differential cryptanalysis. Some installations use triple
outputs mustnot be the same. (If = llxy00,
encryption under two independent keys (encipher under
where x and y are arbitrary bits, then AO,,j f 0.)
the first key, decipher the result under the second key, and
re-encipher the result under the first key). This raises the (S-7) For any nonzero 6-bit difference between inputs,
cost of key exhaustion to 211*= 5 X encipherments AZj,,, no more than eight of the 32 pairs of inputs
(but see [ll] for a decrease in this estimate when a large exhibiting AZi,, may result in the same output
corpus of known plaintext and corresponding ciphertext is difference AO,,,.
available), while the cost of differential cryptanalysis
suffers an exponential growth to something exceeding (S-8) Similar to (S-7), but with stronger restrictions in the
chosen plaintexts and corresponding ciphertexts. At this case AOi,, = 0, for the case of three active S-boxes
point the size of message space (2@= 1.8 X 1019 possible on round i . See the discussion below.
messages of 64 bits) becomes the limiting factor in
security. Other criteria dealt with ease of implementation; those
The IBM team knew about differential cryptanalysis but presented above are the only cryptographically relevant
did not publish any reference to it. That was because the criteria.
tool can be a very powerful cryptanalytic tool, useful The criteria for the permutation P are the following:
against many schemes, and there was concern that placing
such information in the public domain could adversely (P-1) The four output bits from each S-box at round i are
affect national security. distributed so that two of them affect (provide input
+
for) middle bits of S-boxes at round i 1 (the
two middle bits of input to an S-box, not shared
Design criteria with adjacent S-boxes), and the other two affect
We list here the criteria tor the S-boxes and the
end bits (the two left-hand bits or the two right-
permutation P,which were used in the original
hand bits, which are shared with adjacent S-boxes).
specifications, and which are satisfied by the
design of DES. (P-2) The four output bits from each S-box affect six
The relevant criteria for the S-boxes are as different S-boxes; no two affect the same S-box.
follows: (Remember that each end bit affects two adjacent
S-boxes.)
(S-1) Each S-box has six bits of input and four bits of
(P-3) For two S-boxes j , k , ifan output bit from S,
output. (This was the largest size that we could
affects a middle bit of S,, then an output bit from S,
accommodate and still fit all of DES onto a single
cannot affect a middle bit of S,. This implies that in
chip in 1974 technology.)
the case j = k , an output bit from S, must not
(S-2) No output bit of an S-box should be too close to a affect a middle bit of S,.
linear function of the input bits. (That is, if we
select any output bit position and any subset of the Discussion of criteria
six input bit positions, the fraction of inputs for (S-2) was needed because the S-boxes constitute the only
which this output bit equals the XOR of these input nonlinear part of DES. If they were linear [each output bit
bits should not be close to 0 or 1, but rather should being a linear combination of the input bits in the finite
be near 1/2.) field GF(2)], the entire algorithm would be linear and thus
trivially broken; if they were close to being linear, the
(S-3) If we fix the leftmost and rightmost input bits of the
entire algorithm would be too close to linearity, and thus
S-box and vary the four middle bits, each possible
susceptible to attacks based on near-linearity.
4-bit output is attained exactly once as the middle
Most of the criteria are aimed at increasing the number
four input bits range over their 16 possibilities.
of active S-boxes involved over the 12 or 16 rounds of the
(S-4) If two inputs to an S-box differ in exactly one bit, probable pattern. If this total number is n, then (S-7),
the outputs must differ in at least two bits. (That is, along with the simplifying assumption of independence,
if IAZj,jl = 1, then IAOi,jl 2 2, where 1x1 is the puts an upper bound of (1/4) on the overall probability of
number of 1-bits in the quantityx.) this probable pattern. 247

IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994 D. COPPERSMITH

 At least one of any two consecutive rounds i , i + 1 know that the two left-hand bits of AZi,, are zero; because
must have a nonzero number of active S-boxes; otherwise S,,, is inactive on this round, the two right-hand bits of
the pattern is the trivial one of all 0s over all rounds. AZi,, are zero. Now either (S-4) (if only one of the middle
Suppose that round i has at least one active S-box. We bits of AZi,, is 1) or (S-5) (if they are both 1) implies that
break our analysis into cases, based on the number of IAOi,,I 2 2. As stated before, AOi,, is part of
active S-boxes on round i . In each case, we show that if
round i has a small nonzero number of active S-boxes, Amit, 0 Ami-, 7

then either round i - 1 or round i + 1 has at least one and each of the (at least two) nonzero bits of AOi,i forces
active S-box as well. The goal is to show that, summing an active S-box either in round i - 1 or in round i + 1.
over the 12 or 16 rounds of the pattern, there will be a Because of (P-2), there are at least two different active
large number of active S-boxes, on average at least 1.6 +
S-boxes included in rounds i - 1 and i 1 together.
per round. As before, this helps assure us that there will be a large
number of active S-boxes over the course of the 12-round
Two active S-boxes or 16-round pattern.
Suppose first that round i has exactly two active S-boxes Consider the possibility of exactly one active S-box per
and that they are adjacent, Siand Sit,. (The nonadjacent round. Suppose lAOi,,l = 2, its minimum possible value.
case is similar to the case of one active S-box, which is Of the two 1-bits in AOi,,, one cancels the 1-bit that had
treated below.) Because Sj-, is inactive on this round, we activated some S-box, say Sa, on round i - 1, and the
know that the two left-hand bits of AZi,, are zero; because other activates S, on round i + 1. Because only one box
S,,, is inactive on this round, the two right-hand bits is activated by each bit, the bit must be one of the two
of AZi,j+l are zero. We claim that either AOi,, f 0 or middle inputs to the S-box in each instance. That is, an
AOi,,+, f 0 (or both); the proof is by contradiction. If output bit from Si affects a middle input bit of Sa, and an
do,,,= 0, then (S-3) and the fact that the left-hand two bits output bit from Sa affects a middle input bit of S-boxj .
of AZiJ are 0 together imply that the rightmost bit of NiJis 1. But (P-3) outlaws this situation, so a pattern of exactly one
[We know that the leftmost bit is0. If the rightmost bitwere active S-box per round is impossible.
also 0, this would implythat for the two inputs to S, on By these and similar arguments, we find a lower bound
round i in the two encipherments, m and m, the leftmost on the average number of active S-boxes per round.
and rightmost input bitsof Sj would be fixed. Some of the Except in the case of three active S-boxes (see below),
other four bits are vaned, however. (S-3) implies that this lower bound works out to an average of 1.6 active
the two outputs must be different, so AOiJ f 0. This S-boxes per round. By (S-7) and the simplifymg
contradicts our assumption, so we conclude the rightmost assumptions of statistical independence, each active S-box
bit is 1.1 Because of the sharing of message bits, the contributes a multiplicative factor of at most 1/4 to the
rightmost bit of gJis also the second bit from the leftof probability of a given probable pattern. Thus, we have
AZiJtl. Similarly, if AOijtl = 0, then (S-3) and the fact effectively constrained the probability of such a probable
that the two right-hand bits of AZ,Jtl are 0 imply that the pattern to be less than some minuscule upper bound, of
leftmost bit of AZiJtl is 1. Combining these facts: if the order of
AOiJ = AOi,jtl = 0, then MiJtlis of the form 11xyoO. In
this case, (S-6) implies thatAOiJtl f 0. The conclusion is Three active S-boxes
that we cannot have AOiJ = AOiJ+l= 0. The most promising case for the cryptanalyst (thus the
Remembering that the bits of AOi,i, AOi,j+l are part of most difficult case for the designers of the system) turns
out to be three adjacent active S-boxes S,, Sjtl, and S,,,
f(k,,, m,) 0 f(k(,, m:) = Amitl 0 Ami-, ,
on one round i , and no active S-boxes on adjacent rounds
we see that each of the nonzero bits of AOi,,, AOij+, i - 1 and i + 1. Extending this pattern, we have three
(there is at least one such nonzero bit) forces the adjacent active S-boxes on even-numbered rounds and
corresponding bit of either Ami-, or Ami,, to be nonzero. none on odd-numbered rounds.
Thus, either round i - 1 or round i + 1 (or both) has at A feature of this type of pattern is that, for i even, we
least one active S-box. have Amitl = 0, so that AOitl,, = 0 for allj, and
This contributes to our conclusion that there will be a
large number of active S-boxes over the course of the f(k,,,), mjtJ 0 f(k(itl)9m;+J = h i 0 h i t , = 0.
12-round or 16-round pattern. This implies that

One active S-box

Ami = Amit2 = Ami+4= * .
Suppose next that round i has only one active S-box, We need only examine one nonzero value of Ami, and the
248 namely S,. Because Si-,is inactive on this round, we same analysis holds for rounds i + 2, i + 4, .

D. COPPERSMITH IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994

 The analysis is similar to the case of two active S-boxes
previously discussed. The three S-boxes have a total of 14 b

input bits, which we label as in Figure l(a). The labeled

bits such as a and b are understood to be XORs of input ',+I

bits, i.e., part of Ami. Since Ami-1 = Ami+l = 0, we must

have AOi,k = 0 for all k . Since j - 1 is inactive, the a b c d e f g h i j k m n p
&
leftmost two bits of AZ,,j are 0. That fact, together with
'1 +2
AOi,j = 0 and criterion (S-3), enable us to conclude (as we
did in the case of two active S-boxes) that the rightmost
bit of A4,j is 1. Similarly, the rightmost two bits of A Z i , j + z
are 0, and the leftmost bit is 1. So far, our knowledge of
the input bits is as summarized in Figure l(b).
Applying (S-6) to Sj+2,we find that j = 0. Then,
applying (S-3) to Sj+l,we find that e = 1, so our
information is as in Figure l(c). That is,
= 0 0 c d 1 1,

AZi,J+, = 1 1 g h 10,
A4,j+2 = 1 0 k m 0 0.
The unknown bits (c, d, g, h, k, m) are the middle two bits
of each S-box, not shared with adjacent S-boxes. This
simplifies the subsequent analysis.
To find the attack with the highest probability of
success, we choose bits c, d so as to maximize the r- I
probability that AOi,j = 0 given that AZi,j = 0 0 c d 1 1.
Making similar choices of bits g, h and k, m, we can
estimate the probability that "0, = 0, given the choice of
I ' j +I
I
location of the S-boxes S,, SJ+l, and Sj+,. We maximize
this over the eight choices of j = 1, 2, , 8 (S, and SI
are considered to be adjacent) to find the most likely
pattern of this form, which occurs when j = 1 and
Ami = 19600000 (hex). This choice leads to the following (C)
probabilities:
for A4,1 = 0 0 0 0 1 1, prob(AOi,, = 0) = 7/32,
for AZi,2 = 1 1 0 0 1 0, prob(AOi,2= 0) = 4/32, f Three stages of knowledge about inputs to three S-boxes: (a) ini-
for A4,3 = 1 0 1 1 0 0, prob(AOi,3= 0) = 5/32.
1 tially; (b) partial knowledge; (c) with eight bits determined.

Thus,
prob[AO, = OIAmi = 19600000 (hex)]
(S-8) Define
7 4 5 3 5
=-)(-x-=- qo,j= max prob(AOt,, = OIA(,j = 0 0 c d 1 l),
8192
323232 c.d

= 0.004272. ql,j = max prob(AOi,j= O(A4,j = 1 1 g h IO),

0
This is the pattern investigated in [4, 51.
Because this situation (three active S-boxes on even- q2,j= max prob(AUi,j = 01A4,j = 1 0 k m 0 0 ).
numbered rounds, alternating with 0 active S-boxes on lqn

odd-numbered rounds) is so attractive to the cryptanalyst,

Arrange S-boxes so as to minimize
the design team instituted condition (S-8) to lower the
probability of success with such a pattern. With this
background, we can now state (S-8): 249

IBM J. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994 D. COPPERSMITH

 As stated above, the objective function we achieved cryptanalysis; we have shown here the relationship
was between these criteria and these attacks.
A measure of the success of IBMs approach to the
7 4 5 3 5 design of S-boxes and permutation is the enormous amount
-x-x-=-
32 32 8192
32 of chosen plaintext (in excess of 1015bytes) required by
obtained when j = 1. Riham and Shamirs attack.

Linear cryptanalysis References

1. D. Kahn, The Codebreakers, MacMillan Publishing Co.,
Very recently, Mitsuru Matsui has developed a New York, 1972.
related attack (not yet published), known as linear 2. Data Encryption Standard, Federal Information
cryptanalysis. This attack is stronger than differential Processing Standards Publication No. 46, National Bureau
of Standards, January 15, 1977.
cryptanalysis on two counts: It uses less text (about 3. C. H. Meyer and S. M. Matyas, Cryptography:A New
1014 rather than 1015 characters), and it requires known Dimension in Computer Data Security, John Wiley &
plaintext and corresponding ciphertext, rather than chosen Sons, Inc., New York, 1982.
4. E. Biham and A. Shamir, Differential Cryptanalysis of
plaintext. Text must still be enciphered on a machine DES-like Cryptosystems, J. Cryptol. 4, 3-72 (1991).
containing the secret key, but the cryptanalyst can use 5 . E. Biham and A. Shamir, Differential Cryptanalysis of
any such text, without needing to specify it himself. Of the Full 16-round DES, Lecture Notes in Computer
Science: Advances in Cryptology-Proceedings of
course, collecting this amount of known plaintext and CRYPTO 92, Springer-Verlag, pp. 487-496. See also
corresponding ciphertext from the attacked machine is E. Biham and A. Shamir, Differential Cryptanalysis of
the Data Encryption Standard, Springer-Verlag, 1993.
still a huge logistical problem, and this attack does not 6 . B. Den Boer, Cryptanalysis of F.E.A.L., Lecture
represent a viable threat against DES; it is still much more Notes in Computer Science: Advances in Cryptology-
difficult than simple key exhaustion. Proceedings of EUROCRYPT 88,Springer-Verlag, pp.
293-299.
The design criterion related to this attack is (S-2). The 7. S. Murphy, The Cryptanalysis of FEAL-4 with 20
following stronger criterion (S-2)would be more useful, Chosen Plaintexts, J. Cryptol. 2, 145-154 (1990).
but to the best of my recollection it was not part of the 8. E. Biham and A. Shamir, Differential Cryptanalysis of
DES-like Cryptosystems, Lecture Notes in Computer
design criteria: Science: Advances in Cryptology-Proceedings of
CRYPTO 90, Springer-Verlag, 1990, pp. 2-21.
(S-2) No linear combination of output bits of an S-box 9. E. Biham and A. Shamir, Differential Cryptanalysis of
FEAL and N-Hash, Lecture Notes in Computer Science:
should be too close to a linear function of the input Advances in Cryptology-Proceedings of EUROCRYPT
bits. (That is, if we select any subset of the four 91, Springer-Verlag, 1991, pp. 1-16.
10. M.Hellman, R. Merkle, R. Schroeppel, L. Washington,
output bit positions and any subset of the six input W. Diffie, S. Pohlig, and P. Schweitzer, Results of an
bit positions, the fraction of inputs for which the Initial Attempt to Cryptanalyze the NBS Data Encryption
XOR of these output bits equals the XOR of these Standard, Information Systems Laboratory Report,
Stanford University (September 9, 1976) (revised
input bits should not be close to 0 or 1, but rather November 10, 1976).
should be near 1/2.) 11. P. C. van Oorschot and M. J. Wiener, A Known-
Plaintext Attack on Two-Key Triple Encryption, Lecture
Notes in Computer Science: Advances in Cryptology-
Neither (S-2) nor (S-2) can be achieved perfectly, with all Proceedings of EUROCRYPT 90, Springer-Verlag, 1990,
probabilities being exactly equal to 1/2. However, the fact pp. 318-325.
that (S-2) was a design criterion and was almost achieved
helped DES to resist this new attack. Even higher Received March 11, 1993; accepted for publication
resistance could have been achieved by including (S-2). February 14, 1994
One could achieve tighter controls [probabilities much
closer to 1/2 for both (S-2) and (S-2)] by using larger Don Coppersmith IBM Research Division, Thomas J.
S-boxes. Using a larger number of rounds would also Watson Research Center, P. 0. Box 218, Yorktown
Heights, New York 10598 (COPPER at Y m ,
blunt this attack. Future cryptographic systems should [email protected]). Dr. Coppersmith received
take these modifications into consideration. his B.S. in mathematics from the Massachusetts Institute of
Technology in 1972 and his M.S. and Ph.D. in mathematics
from Harvard University in 1975 and 1977. Since that time he
Summary: Design criteria and differential has been a Research Staff Member at the IBM Thomas J.
cryptanalysis Watson Research Center. His current research interests
We have summarized Biham and Shamirs attack. We have include cryptography and computational complexity. Dr.
Coppersmith is a Fellow of the Institute of Electrical and
outlined the criteria that IBM used to design the S-boxes Electronics Engineers.
and permutation. These criteria were developed
250 specifically to thwart attacks based on differential

IBM .I. RES. DEVELOP. VOL. 38 NO. 3 MAY 1994