Static site. Every demo computes in your browser, and nothing you type is sent anywhere.
25%
Count the subkeys a key produces, meet the sixteen keys that fail that count, then check one equation that every DES key satisfies.
Sixteen rounds need sixteen subkeys, and the key schedule is what produces them. A healthy key produces sixteen different ones. That count is a test you can run on any key, so run it first.
reads as 13 34 57 79 9B BC DF F1
What this key produces
This table lists the key, its parity, the two halves of the key register after PC-1, and the number of different subkeys the schedule produces.
Measurement
Value
Reading
Key
13 34 57 79 9B BC DF F1
64 bits as stored
Parity
odd in every byte
PC-1 drops these 8 bits
C after PC-1
1111 0000 1100 1100 1010 1010 1111
no pattern
D after PC-1
0101 0101 0110 0110 0111 1000 1111
no pattern
Distinct subkeys
16 of 16
every round differs
verdict
Ordinary key
16 different subkeys
The first chip reads the published list of weak keys, which is written with odd parity in every byte. The second chip counts what this key produces. The two can disagree. PC-1 drops the parity bits, so a key with the same 56 remaining bits and even parity is not on the list and still produces one subkey. The button labelled A key of zero bytes is that case.
Four keys drive each half of the register to all zeros or to all ones. Rotating a constant register returns the same register. Every round therefore works from the same 56 bits, and PC-2 selects the same 48 bits every time. The sixteen subkeys are one subkey.
The four weak keys
The first five columns are read from the key schedule and cost nothing. The last column is measured, and it encrypts 8 random blocks twice under each of the four keys, so it runs only when you press the button.
This table lists the four weak keys, the register pattern each one produces, the single subkey it repeats, and the result of encrypting a block twice under it.
Key
C after PC-1
D after PC-1
Distinct subkeys
The subkey it repeats
Encrypt twice
Field
0101010101010101
all zeros
all zeros
1 of 16
000000000000
not measured yet
FEFEFEFEFEFEFEFE
all ones
all ones
1 of 16
FFFFFFFFFFFF
not measured yet
E0E0E0E0F1F1F1F1
all ones
all zeros
1 of 16
FFFFFF000000
not measured yet
1F1F1F1F0E0E0E0E
all zeros
all ones
1 of 16
000000FFFFFF
not measured yet
Decryption applies the subkeys in reverse order. When all sixteen subkeys are equal, the reverse order is the forward order. Decryption and encryption are then the same operation, so encryption under a weak key is its own inverse. The last column is that claim, measured on 8 random blocks per key.
This key is not weak, so the second encryption produces a different value. Press one of the four buttons above and read these lines again.
Twelve more keys fail the count in a milder way. Each half of the register holds an alternating pattern or a constant one. A rotation by one place exchanges the two alternating values. A rotation by two places returns each value to itself. The register therefore only ever holds two states, and the sixteen subkeys take two values.
Each of these keys has a partner. The partner produces the same two subkeys in the opposite order, and the opposite order is exactly what decryption uses. Encrypting under one key therefore undoes encrypting under the other.
The six semi-weak pairs
The order column is read from the two key schedules and costs nothing. The last column is measured, and it encrypts 8 random blocks under each pair, so it runs only when you press the button.
This table lists the six semi-weak pairs, the number of distinct subkeys each key produces, whether the second schedule is the first one reversed, and the result of encrypting a block under both keys in turn.
Pair
First key
Second key
Distinct subkeys
Order
Second undoes first
Detail
1
01FE01FE01FE01FE
FE01FE01FE01FE01
2 and 2
reversed
not measured yet
2
1FE01FE00EF10EF1
E01FE01FF10EF10E
2 and 2
reversed
not measured yet
3
01E001E001F101F1
E001E001F101F101
2 and 2
reversed
not measured yet
4
1FFE1FFE0EFE0EFE
FE1FFE1FFE0EFE0E
2 and 2
reversed
not measured yet
5
011F011F010E010E
1F011F010E010E01
2 and 2
reversed
not measured yet
6
E0FEE0FEF1FEF1FE
FEE0FEE0FEF1FEF1
2 and 2
reversed
not measured yet
The order column compares the two schedules subkey by subkey. The last column encrypts 8 random blocks under the first key and then under the second, then checks that the block returns.
Pair 1, round by round
round 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
K1 01FE01FE01FE01FE A B B B B B B B A A A A A A A B
K2 FE01FE01FE01FE01 B A A A A A A A B B B B B B B A
A = 9153E54319BD
B = 6EAC1ABCE642
Read the K2 line from right to left and it is the K1 line. That is the whole property. The second key produces the subkeys of the first key in the order decryption asks for.
Four weak keys and twelve semi-weak keys is sixteen keys out of 2^56, about one key in 2^52. A key drawn at random is almost certainly not one of them, so refusing all sixteen costs no measurable key space. Keys are not always drawn at random, and a key of repeated bytes is a common mistake, so an implementation should still test for them.
The last property is not about unlucky keys. It holds for every key, including the key you typed in the first step. Complement the block and complement the key, and the ciphertext complements with them.
E(not P, not K) = not E(P, K)
Checked on your own block and key
P 0123456789ABCDEF not P FEDCBA9876543210
K 133457799BBCDFF1 not K ECCBA8866443200E
E(P, K) 85E813540F0AB405 not E(P, K) 7A17ECABF0F54BFA
E(not P, not K) 7A17ECABF0F54BFA
The two sides are the same 64 bits
the same equation on random values
One pair of values is one example. The button draws 20 random plaintext and key pairs and checks the equation on each of them. It costs two encryptions per pair, so it runs only when you press it.
The value at the right of the third line and the value on the fourth line are the same. The reason is local to one round. Complementing the key complements every subkey, because PC-1 and PC-2 only select bits. Complementing the block complements both halves, and the expansion only copies bits. The XOR that feeds the S-boxes therefore sees both of its inputs complemented, and it produces the same 48 bits. The round function returns the same value, and the complement moves into the next round.
What the property saves an attacker
This table compares the number of keys a chosen-plaintext search must test with and without the complementation property, as a count and as a power of two.
Search
Keys to test
Power of two
One plaintext and its ciphertext
72,057,594,037,927,936
2^56
Also the complement of that plaintext
36,028,797,018,963,968
2^55
The attacker asks for the encryption of one block P and of its complement, both under the unknown key. Testing a candidate key k costs one encryption. The property says what that same key produces on the complemented block, so the one encryption also tests the key not k. Each trial covers two keys, so the search is half as long.
That is one bit. It is a real structural weakness, it is specific to DES, and it is worth knowing. It is not what made DES breakable. A 56-bit key was already short enough to search with enough hardware and enough time, and this property removed one bit from a search that was going to succeed anyway.
The code behind this page is a teaching implementation of DES. It is written to be read, it is not constant time, and it is not for production use.