On correlation between the order of S-boxes and the strength of DES

  • Mitsuru Matsui
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 950)


This paper introduces a practical algorithm for deriving the best differential characteristic and the best linear expression of DES. Its principle is based on a duality between differential cryptanalysis and linear cryptanalysis, and applicable to various block ciphers. Then using this program, we observe how the order of S-boxes affects the strength of DES. We show that the order of the S-boxes is well-arranged against differential cryptanalysis, though it is not the best choice. On the other hand, our experimental results indicate that it is a very weak choice in regard to linear cryptanalysis. In other words, DES can be strengthened by just rearranging the order of the S-boxes.


  1. 1.
    Biham, E., Shamir, A.: Differential Cryptanalysis of the Data Encryption Standard. Springer-Verlag (1993)Google Scholar
  2. 2.
    Matsui, M.: Linear Cryptanalysis Method of DES Cipher. Advances in Cryptology — Eurocrypt'93, Lecture Notes in Computer Science 765 (1993) 386–397CrossRefGoogle Scholar
  3. 3.
    Biham, B.: On Matsui's Linear Cryptanalysis. Pre-proceedings of Eurocrypt'94 (1994) 349–361Google Scholar
  4. 4.
    Knudsen, L.R.: Iterative Characteristics of DES and s 2-DES. Advances in Cryptology — Crypto'92, Lecture Notes in Computer Science 740 (1992)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 1995

Authors and Affiliations

  • Mitsuru Matsui
    • 1
  1. 1.Computer & Information Systems LaboratoryMitsubishi Electric CorporationKanagawaJapan

Personalised recommendations