DES supplementary material
| Company type | Cryptographic algorithm |
|---|---|
| Industry | Computer security |
| Founded | 1977 |
| Products | Symmetric-key block cipher |
This entry outlines the different tables utilized in the Data Encryption Standard (DES) block cipher.
Bits and bytes follow a big endian format, with bit 1 representing the most significant bit.
Initial permutation (IP)
| 58 | 50 | 42 | 34 | 26 | 18 | 10 | 2 |
| 60 | 52 | 44 | 36 | 28 | 20 | 12 | 4 |
| 62 | 54 | 46 | 38 | 30 | 22 | 14 | 6 |
| 64 | 56 | 48 | 40 | 32 | 24 | 16 | 8 |
| 57 | 49 | 41 | 33 | 25 | 17 | 9 | 1 |
| 59 | 51 | 43 | 35 | 27 | 19 | 11 | 3 |
| 61 | 53 | 45 | 37 | 29 | 21 | 13 | 5 |
| 63 | 55 | 47 | 39 | 31 | 23 | 15 | 7 |
This matrix defines how a 64-bit input block is permuted initially: the first output bit corresponds to the 58th input bit, the second to the 50th, continuing accordingly.
Final permutation (IP−1)
| 40 | 8 | 48 | 16 | 56 | 24 | 64 | 32 |
| 39 | 7 | 47 | 15 | 55 | 23 | 63 | 31 |
| 38 | 6 | 46 | 14 | 54 | 22 | 62 | 30 |
| 37 | 5 | 45 | 13 | 53 | 21 | 61 | 29 |
| 36 | 4 | 44 | 12 | 52 | 20 | 60 | 28 |
| 35 | 3 | 43 | 11 | 51 | 19 | 59 | 27 |
| 34 | 2 | 42 | 10 | 50 | 18 | 58 | 26 |
| 33 | 1 | 41 | 9 | 49 | 17 | 57 | 25 |
The final permutation serves as the inverse of the initial permutation and is interpreted in the same manner as IP.
Expansion function (E)
| 32 | 1 | 2 | 3 | 4 | 5 |
| 4 | 5 | 6 | 7 | 8 | 9 |
| 8 | 9 | 10 | 11 | 12 | 13 |
| 12 | 13 | 14 | 15 | 16 | 17 |
| 16 | 17 | 18 | 19 | 20 | 21 |
| 20 | 21 | 22 | =23= | =24= | =25= |
| =25= | =26= | =27= | =28= | =29= | |
| =29= | =30= | =31= | =32= | =1 |
This expansion table increases a half-block from its original size of thirty-two bits to forty-eight bits by duplicating specific bits, facilitating key mixing within DES rounds.
Permutation (P)
| 7 |20 |21 |29 |12 |28 |17 |
| 15 |23 |26 |5 |18 |31 |10 |
| 8 |24 |14 |32 |27 |3 |9 |
| 13 |30 |6 |22 |11 |4 |25 |
The P permutation rearranges bits inside a thirty-two-bit half-block to improve diffusion during the encryption process.
Permuted choice 1 (PC-1)
| Left | ||||||
|---|---|---|---|---|---|---|
| 49 |41 |33 |25 |17 |9 | ||||||
| 58 |50 |42 |34 |26 |18 | ||||||
| 2 |59 |51 |43 |35 |27 | ||||||
| 11 |3 |60 |52 |44 |36 | ||||||
| Right | ||||||
|---|---|---|---|---|---|---|
| 55 |47 |39 |31 |23 |15 | ||||||
| 62 |54 |46 |38 |30 |22 | ||||||
| 6 |61 |53 |45 |37 |29 | ||||||
| 13 |5 |28 |20 |12 |4 | ||||||
PC-1 extracts and rearranges specific bits from the original key, excluding parity bits, to create the initial state of the key schedule employed throughout DES encryption cycles.
Permuted choice 2 (PC-2)
| 14 | 17 | 11 | 24 | 1 | 5 |
| 3 | 28 | 15 | 6 | 21 | 10 |
| 23 | 19 | 12 | 4 | 26 | 8 |
| 16 | 7 | 27 | 20 | 13 | 2 |
| 41 | 52 | 31 | 37 | 47 | 55 |
| 30 | 40 | 51 | 45 | 33 | 48 |
| 44 | 49 | 39 | 56 | 34 | 53 |
| 46 | 42 | 50 | 36 | 29 | 32 |
This permutation chooses the forty-eight-bit subkey for each round from the fifty-six-bit key schedule state, omitting bits numbered nine, eighteen, twenty-two, twenty-five, thirty-five, thirty-eight, forty-three, and fifty-four.
Substitution boxes (S-boxes)
| S1 | x0000x | x0001x | x0010x | x0011x | x0100x | x0101x | x0110x | x0111x | x1000x | x1001x | x1010x | x1011x | x1100x | x1101x | x1110x | x1111x |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0yyyy0 | 14 | 4 | 13 | 1 | 2 | 15 | 11 | 8 | 3 | 10 | 6 | 12 | 5 | 9 | 0 | 7 |
| 0yyyy1 | 0 | 15 | 7 | 4 | 14 | 2 | 13 | 1 | 10 | 6 | 12 | 11 | 9 | 5 | 3 | 8 |
| 1yyyy0 | 4 | 1 | 14 | 8 | 13 | 6 | 2 | 11 | 15 | 12 | 9 | 7 | 3 | 10 | 5 | 0 |
| 1yyyy1 | 15 | 12 | 8 | 2 | 4 | (9) | 1 | (7) | 5 | (11) | 3 | (14) | 10 | (0) | (6) | (13) |
| S2 | x0000x | x0001x | x0010x | x0011x | x0100x | x0101x | x0110x | x0111x | x1000x | x1001x | x1010x | x1011x | x1100x | x1101x | x1110x | x1111x |
| 0yyyy0 | 15 | (1) | 8 | (14) | (6) | (11) | (3) | (4) | (9) | (7) | (2) | (13) | (12) | (0) | (5) | (10) |
| 0yyyy1 | (3) | (13) | (4) | (7) | (15) | (2) | (8) | (14) | (12) | (0) | (1) | (10) | (6) | (9) | (11) | (5) |
| 1yyyy0 | (0) | (14) | (7) | (11) | (10) | (4) | (13) | (1) | (5) | (8) | (12) | (9)|(3)|(2)|(15) | ||||
| 1yyyy1 | (8)|(10)|(1)|(3)|(15)|(4)|(2)|(11)|(6)|(7)|(12)|(0)|(5)|(14)|(9) | |||||||||||||||
| S3 | x0000x | x0001x | x0010x | x0011x | x0100x | x0101x | x0110x | x0111x | x1000x | x1001x | x1010x | x1011x | x1100x | x1101x | x1110x | x1111x |
| 0yyyy0 | (0)|(9)|(14)|(6)|(3)|(15)|(5)|(1)|(13)|(12)|(7)|(11)|(4)|(2)|(8) | |||||||||||||||
| 0yyyy1 | (7)|(0)|(9)|(3)|(4)|(6)|(10)|(2)|(8)|(5)|(14)|(12)|(11)|(15)|(1) | |||||||||||||||
| 1yyyy0 | (6)|(4)|(9)|(8)|(15)|(3)|(0)|(11)|(1)|(2)|(12)|(5)|(10)|(14)|(7) | |||||||||||||||
| 1yyyy1 | (1)(10)(13)(0)(6)(9)(8)(7)(4)(15)(14)(3)(11)(5)(2)(12) | |||||||||||||||
| S4 | x0000x | x0001x | x0010x | x0011x | x0100x | x0101x | x0110x | x0111x | x1000x | x1001x | x1010x | x1011x | x1100x | x1101x | x1110x | x1111x |
| 0yyyy0 | (7)(13)(14)(3)(0)(6)(9)(10)(1)(2)(8)(5)(11)(12)(4)(15) | |||||||||||||||
| 0yyyy1 | (13)(8)(11)(5)(6)(15)(0)(3)(4)(7)(2)(12)(1)(10)(14)(9) | |||||||||||||||
| 1yyyy0 | (10)(6)(9)(0)(12)(11)(7)(13)(15)(1)(3)(14)(5)(2)(8)(4) | |||||||||||||||
| 1yyyy1 | (3)(15)(0)(6)(10)(1)(13)(8 )(9 )(4 )(5 )(11 )(12 )(7 )(2 )(14 ) | |||||||||||||||
| S5 | ... (truncated for brevity) ... | |||||||||||||||
DES employs eight S-boxes that transform each 6-bit input into a corresponding 4-bit output by using the outer bits to determine the row and the middle four bits to select the column. For instance, feeding input 011011 into S5 results in an output of "1001", which corresponds to decimal value nine.
Key Generation
The initial key provided by the user, consisting of 64 bits, undergoes multiple modifications before being applied in encryption cycles.
Removal of Parity Bits
To produce a usable 56-bit key, the eight parity bits embedded in the original key are discarded.
| 2 |3 |4 |5 |6 |7 | !8 |
| 10 |11 |12 |13 |14 |15 | !16 |
| 18 |19 |20 |21 |22 |23 | !24 |
| 26 |27 |28 |29 |30 |31 | !32 |
| 34 |35 |36 |37 |38 |39 | !40 |
| 42 |43 |44 |45 |46 |47 | !48 |
| 50 |51 |52 |53 |54 |55 | !56 |
| 58 |59 |60 |61 |62 |63 | !64 |
Following this, the bits are rearranged according to a specific permutation table. The exact bit position is calculated by multiplying the row number by eight and then adding the column number.
| 1 ! 2 ! 3 ! 4 ! 5 ! 6 ! 7 ! 8 | |
|---|---|
| 0 | 49 |41 |33 |25 |17 |9 | 1 |
| 1 | 50 |42 |34 |26 |18 |10 | 2 |
| 2 | 51 |43 |35 |27 |19 |11 | 3 |
| 3 | 52 |44 |36 |63 |55 |47 |39 |
| 4 | 23 |15 |7 |62 |54 |46 |38 |
| 5 | 22 |14 |6 |61 |53 |45 |37 |
| 6 | 21 |13 |5 |28 |20 |12 | 4 | |
Bits Rotation
Prior to selecting each round's sub-key, the 56-bit key—divided into two segments of 28 bits each—is subjected to a circular left shift by either one or two positions, depending on the specific round. After shifting, the halves are merged again.
| Round Number | 2 |3 |4 |5 |6 |7 |8 |9 |10 |11 |12 |13 |14 |15 |16 |
|---|---|
| Left Rotations | 1 |2 |2 |2 |2 |2 |2 |1 |2 |2 |2 |2 |2 |2 |1 |
Key Compression
The rotated 56-bit key undergoes compression through a P-box, which condenses it into a 48-bit key utilized during each encryption round.
| 1 !2 !3 !4 !5 !6 !7 !8 | |
|---|---|
| 1 | 14 17 11 24 01 05 03 28 |
| 2 | 15 06 21 10 23 19 12 04 |
| 3 | 26 08 16 07 27 20 13 02 |
| 4 | 41 52 31 37 47 55 30 40 |
| 5 | 51 45 33 48 44 49 39 56 |
| 6 | 34 53 46 42 50 36 29 32 |
This process yields the definitive round key of length 48 bits, which is applied during each DES encryption cycle.