Iterative characteristics of DES and s2-DES

Abstract

In this paper we show that we are close at the proof that the type of characteristics used by Biham and Shamir in their differential attack on DES [3] are in fact the best characteristics we can find for DES. Furthermore we show that the criteria for the construction of DES-like S-boxes proposed by Kim [6] are insufficient to assure resistance against differentid attacks. We show several good iterative characteristics for these S-boxes to be used in differential attacks. Finally we examine the probabhties of the two characteristics used by Biharn and Shamir in [3]. We found that for some keys we do not get the probabilities used in the attack. We suggest the use of 5 characteristics instead of two in the attack on DES.