DES-X
| Company type | Cryptographic algorithm |
|---|---|
| Industry | Cryptography |
| Founded | May 1984 |
| Founder | Ron Rivest |
| Products | Symmetric-key block cipher |
In the field of cryptography, DES-X (also known as DESX) represents a modified form of the DES symmetric-key block cipher that aims to bolster defense against brute-force attacks by implementing key whitening techniques.
The DES algorithm, introduced in 1976, employs a 56-bit key, which sparked concerns regarding its susceptibility to exhaustive key search by powerful organizations such as the United States' National Security Agency (NSA). To strengthen security without extensively altering DES, DES-X was introduced by Ron Rivest in May 1984.
Since the late 1980s, DES-X has been integrated into RSA Security's cryptographic toolkit, particularly within the BSAFE library.
This variant enhances DES by applying an XOR operation with an extra 64-bit key (K1) to the plaintext prior to encryption, and then XORing the result with another 64-bit key (K2) following encryption:
<math>\mbox{DES-X}(M) = K_2 \oplus \mbox{DES}_K(M \oplus K_1)</math>
Consequently, the aggregate nominal key length extends to 184 bits (56 plus two times 64). Nevertheless, the practical security level is roughly 119 bits, contingent on how many chosen plaintext/ciphertext pairs an adversary can acquire, and it can decrease to about 88 bits when subjected to sophisticated slide attacks utilizing 232.5 known plaintexts.
Additionally, DES-X offers improved resistance against differential cryptanalysis and linear cryptanalysis, demanding substantially more plaintext data than standard DES for successful exploitation—estimated at around 261 chosen plaintexts for differential attacks and approximately 260 known plaintexts for linear cryptanalysis. Despite these enhancements, any block cipher with a block size of 64 bits, including DES-X, becomes vulnerable once exposed to 264 plaintexts due to the possibility of reconstructing the entire codebook.
The most effective known attack on DES-X is a known-plaintext slide attack devised by Biryukov and Wagner, requiring about 232.5 known plaintexts and computational effort on the order of 287.5. This approach can be transformed into a ciphertext-only attack with comparable data needs but increased offline processing time estimated at 295.
See also
References
- Advances in Cryptology — CRYPTO '96, Lecture Notes in Computer Science, 1996, Kilian & Rogaway, "How to Protect DES Against Exhaustive Key Search," vol. 1109, pp. 252–267.
- P. Rogaway, "The security of DESX," CryptoBytes 2(2), Summer 1996.