🚀 go-pugleaf

heathh@cco.caltech.edu (Heath Ian Hunnicutt) writes:
> From what I understand, that's not totally true.  While the _specs_ 
> might be the same, IBM also submitted a rationale for the DES method.  
> This rationale document remains classified, and some wonder if it 
> contains information that severely weakens DES. 

Actually, on this very newsgroup some time back there was a posting from a 
person at IBM which explained that the DES design team knew about 
differential cryptanalysis at the time, and designed DES to be resistant to 
it.  However, this crytanalytic technique was not public knowledge, and so 
this rationale was kept secret.

Some 20 years later, when differential cryptanalysis was discovered in the 
academic world, researchers (notably Shamir, I believe) were annoyed to 
discover that the particular S-boxes in DES "just happened" to render the 
technique useless from a pragmatic standpoint in the cryptanalysis of DES.

Ironically enough, it seems that IBM and the NSA secretly *strengthened* DES 
rather than weakening it.

The key size, however, remains an open issue, as do allegations of key 
clustering.  Remember also that it was never aimed at more than a reasonable 
amount of security, which it still provides.



Amanda Walker
InterCon Systems Corporation