Week 3 · Block ciphers · KL 7.2
Real DES, run twice on inputs that differ in exactly one bit. Flip a plaintext bit to watch diffusion carry it across the block; flip a key bit to watch confusion tie every ciphertext bit to the key through the S-boxes. Within five rounds about half of the 64 bits differ, and they stay that way.
Every row of the grid is the 64-bit state (L‖R) after one round, with a dark square wherever run A and run B disagree. The bar on the right counts those bits; the dashed line is 32, what two unrelated random blocks would give. Click a row to open that round below, or use ← → to step and Space to play.
Inside round 1 · f(R, K) = P( S( E(R) ⊕ K ) ), new R = L ⊕ f
DES is a Feistel network: each round computes f on the right half, XORs it into the left, and swaps. Inside f, E and P spread differences, the round key brings in the key, and the S-boxes make everything depend on it nonlinearly. The swap between rounds keeps both halves moving.
32 → 48 bits. Edge bits of each nibble are copied, so one bit feeds two neighbouring S-boxes.
Ki is 48 of the 56 key bits, chosen by rotations and PC-2. Each key bit shows up in 12–15 of the 16 rounds.
6 → 4 bits, the only nonlinear step. A 1-bit input change always flips at least 2 output bits.
Sends the 4 outputs of each S-box to 4 different S-boxes in the next round.
L ⊕ f becomes the new R, so the half that was just changed is the one mixed next round.