Introduction to Modern Cryptography, Exercise # 7
University of Amsterdam, Master of Logic
Lecturer: Christian Schaffner
TA: Joachim Schipper
18 October 2011, updated: 20 October 2011
(to be handed in by Tuesday, 1 November 2011, 9:00)
Complementarity Property of DES
In this exercise, we show that DES has the complementarity property, i.e., that DESk(x) =
DESk(x) for every key kand input x(where zdenotes the bitwise complement of z) and how
we can exploit that property.
1. Let fbe the DES mangler function. Show that for every subkey kand message x, it holds
that f(k, x) = f(k, x).
2. Use the above property to conclude that after every round iin the Feistel network, Li(x, k) =
Li(x, k) and Ri(x, k) = Ri(x, k ). Conclude that DE Sk(x) = DE Sk(x) for every key kand
input x. (Note that for all “permutations” Pin DES, P(x) = P(x).)
3. Use a chosen-plaintext attack with two messages xand xto argue that it is possible to find
the secret key in DES (with probability 1) using 255 local computations of DES.
Feistel Network and mangler function of DES
Image credit: wikimedia.org.
