A general purpose technique for locating key scheduling weaknesses in DES-like cryptosystems

Abstract

The security of DES-style block ciphers rests largely upon their nonlinear S-boxes. If different pairs of input data and key can produce identical inputs to all of a cipher's S-boxes, then for those pairs the system is weakened. A technique is described here which enables a cryptanalyst to find how many of these pairs, if any, exist for a given cryptosystem, and how to exploit those pairs under a chosen plaintext attack.