🚀 go-pugleaf

In <PHR.92Oct15174530@napa.telebit.com>,  phr@telebit.com (Paul Rubin) writes:

    Michael Wiener and I submitted a paper to Crypto '92 entitled "DES is not
    a Group". The principal argument is as follows.

    Consider the closure of DES encryptions under composition.  Our claim is
    that this group must include permutations which are not equivalent to DES
    encryption with any key.  Each of the n_i collected above must divide
    the order of the group.  Compute n = lcm( n_i, i=1..k ).  If n > 2^56 then
    the group must be larger than the set of DES encryptions.

    ...

    I heard that someone in Eastern Germany recently proved a stronger
    result, that DES generates the alternating group on 2^64 letters.
    This had been conjectured a while ago, though I don't know what the
    evidence for it was.  Anyone know more about this?

Here is an abstract of the relevant paper:

 {\bf \noindent R Wernsdorf,}{\em ~Eurocrypt 92\\}
 {\bf `The One-round Functions of DES Generate the Alternating Group'}

 Each round of DES consists of $2^{48}$ permutations. The group which they
 generate is shown to be 3-transitive, and if this were not equal to
 $A_{2^{64}}$, then it would have a unique minimal normal subgroup which is
 Abelian or simple. The former is excluded by displaying a permutation with
 too many fixed points, and the latter by the classification theory of
 simple groups.

With luck we'll have the first issue of `Computer and Communications Security
Abstracts' out shortly: it will contain abstracts like this of current
research papers.

Ross Anderson