DES and 3DES

DES accepts 64-bit blocks of plaintext and uses a 56-bit key. Its round-key generator derives sixteen 48-bit round keys from that one key, one for each of DES’s 16 rounds. Inside each round, the 64-bit input splits into two 32-bit halves in the Feistel structure covered on the previous page; the right half goes through the round function $F$. $F$ expands the 32-bit half to 48 bits so it matches the round key’s size, XORs it with that round key, splits the 48-bit result into eight 6-bit chunks — one per S-box — and passes the resulting 32 bits through a single P-box before the round’s XOR and swap. Every S-box’s output is spread by that P-box across as many of the next round’s S-boxes as possible, which is what keeps the diffusion going round after round.

Sixteen rounds is not an arbitrary number: it can be shown that 16 rounds is what DES actually needs to reach its intended level of security, even though the round function $F$ on its own is not especially strong. This is the general design principle behind rounds in any block cipher — a higher round count increases the difficulty of cryptanalysis and adds confusion, particularly in a Feistel cipher, even when no individual round is doing very much work by itself. The function $F$ itself is expected to be nonlinear and to satisfy the strict avalanche criterion (SAC) — flipping one input bit should flip each output bit with 50% probability — and the bit independence criterion (BIC), so that output bits change independently of each other when an input bit flips.

3DES was introduced as an intermediate fix once DES’s key length became the obvious weak point, without designing an entirely new cipher. It runs DES three times, but not as three plain encryptions in a row. Given plaintext $p$ and three keys $K_1, K_2, K_3$: $C = E_{K_3}\big(D_{K_2}(E_{K_1}(p))\big).$ First $p$ is encrypted with $K_1$. Then the decryption function, not encryption, is applied with $K_2$ — this does not recover any real plaintext, since $K_2 \neq K_1$, it just runs the DES machinery in reverse with a different key. Finally the result is encrypted again with $K_3$.

The reason for encrypt-decrypt-encrypt rather than encrypt-encrypt-encrypt is backward compatibility. If all three keys are set equal, $D_{K}(E_{K}(p)) = p$, so the middle step cancels out and the whole construction collapses to a single $E_K(p)$ — plain DES. That equivalence only holds because the middle operation is a decryption; three encryptions in a row would not reduce to single DES the same way. This lets 3DES hardware still interoperate with systems that only speak DES.

3DES comes in two variants: two independent keys, reusing $K_1$ as $K_3$, or three fully independent keys. The two options trade off performance against security. The unit teaches the resulting effective key sizes as $56 \times 2 = 112$ bits for the two-key variant and $56 \times 3 = 168$ bits for the three-key variant.