🚀 go-pugleaf

    Michael Wiener and I submitted a paper to Crypto '92 entitled "DES is not
    a Group". The principal argument is as follows.

    Consider the closure of DES encryptions under composition.  Our claim is
    that this group must include permutations which are not equivalent to DES
    encryption with any key.  Each of the n_i collected above must divide
    the order of the group.  Compute n = lcm( n_i, i=1..k ).  If n > 2^56 then
    the group must be larger than the set of DES encryptions.

    The paper includes the lengths of several hundred cycles of DES.
    The lcm of those lengths exceeds 10^2499.  It is clearly not practical
    to use E^n(x) to recover x for such large n.

I heard that someone in Eastern Germany recently proved a stronger
result, that DES generates the alternating group on 2^64 letters.
This had been conjectured a while ago, though I don't know what the
evidence for it was.  Anyone know more about this?