🚀 go-pugleaf

Keith Campbell claims that repeated encryption under a single DES key
comes back to the original plaintext in about 2^32 rounds.  This is
not true; it usually takes about 2^64 rounds.

The confusion may have two sources: First, he is treating DES (with a
fixed key) as a random function, when in fact it acts like a random
permutation.  (Different plaintexts must yield different ciphertexts.)
A random permutation will have cycle length on the order of 2^64.
A random function will repeat values in time about 2^32, but will not
return to the starting point in that time; so you cannot use the random
function to discover the original starting point.

"Random functions" and "random permutations" should be in the required
syllabus for any cryptographer.

An exception is when the so-called "weak keys" are used.  These are
sixteen keys with special properties, discovered by Donald Davies.
Using these weak keys we can produce short cycles (about 2^32).
I proposed in 1985 to use the l.c.m. of these cycle lengths as a lower
bound on the size of the group generated by DES, and my recent
experiments showed that this group has size at least 10^277.

Don Coppersmith