DES — One Feistel Round

Trace the f-function your professor expects on exams

Mission tie-in: DES is the heaviest trace on your exam. Master one full round — expansion, XOR subkey, S-box lookup, P-permutation, Feistel XOR — and the other 15 rounds are identical with different subkeys.

Big picture: 64 bits in, 64 bits out

DES is a block cipher: 64-bit plaintext block, 56-bit effective key (64 bits with parity bits dropped), 16 identical rounds, then inverse initial permutation.

Each round needs a 48-bit subkey Kₙ from the 56-bit master key — see DES Key Schedule for PC-1 → shifts → PC-2 and worked K₁, K₂.

Plaintext M (64 bits) Initial Permutation (IP) L₀ (32 bits) R₀ (32 bits) Round n (repeated 16×) Lₙ = Rₙ₋₁ Rₙ = Lₙ₋₁ ⊕ f(Rₙ₋₁, Kₙ) f-function E → ⊕K → S → P Kₙ Swap → IP⁻¹ → Ciphertext

The f-function — four steps

1Expansion E: 32-bit R → 48 bits (some bits duplicated)
2XOR with subkey Kₙ: 48-bit result split into eight 6-bit chunks
3S-box substitution: each 6 bits → 4 bits via S1…S8 tables
4P-permutation: shuffle the 32 bits output from S-boxes
Feistel update:   Lₙ = Rₙ₋₁   |   Rₙ = Lₙ₋₁ ⊕ f(Rₙ₋₁, Kₙ)

S-box lookup rule (exam-critical)

Given 6 input bits b₁ b₂ b₃ b₄ b₅ b₆:

PartBits usedRange
Rowb₁ b₆0 – 3
Columnb₂ b₃ b₄ b₅0 – 15

Look up S-box[row][col] → 4-bit output. Concatenate all 8 S-box outputs → 32 bits.

Worked example — Round 1 (FIPS DES)

Plaintext M = 0123456789ABCDEF, Key K = 133457799BBCDFF1. Trace computed in browser — not hand-copied.

After 16 rounds + final swap + IP⁻¹ → ciphertext 85E813540F0AB405 (full block encrypt; round 1 above is the exam drill).

Key schedule (sketch)

  1. PC-1 — 64-bit key → 56 bits (drop bits 8,16,…,64)
  2. Split into C₀ ‖ D₀ (28 + 28 bits)
  3. Left-shift C and D each round (1 or 2 positions)
  4. PC-2 — compress CₙDₙ → 48-bit subkey Kₙ

S-box drill

6-bit input to S1 is 011000. What is the row number?

Feistel drill

After round n, which half becomes Lₙ?

Stuck? Ask: "Walk me through S-box lookup for 101101" or "Generate K₂ from this key."