Critical Review of DES and AES: A Comparative Analysis of Encryption Standards

This paper provides a critical review of the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES), two widely used symmetric block ciphers. It explores their historical context, working principles, strengths, weaknesses, and vulnerabilities to various attacks. The paper analyzes the evolution of encryption standards, highlighting the limitations of DES and the advancements offered by AES. It also discusses the impact of these algorithms on data security and the importance of choosing appropriate encryption methods for different applications. The paper concludes with recommendations for future research and development in the field of cryptography.

CSC8419 - CRYPTOGRAPHY AND SECURITY -
ASSIGNMENT 3
Topic: Critically Reviewing DES and AES

Table of Contents
Introduction...........................................................................................................................................2
What is DES??........................................................................................................................................2
What is AES??........................................................................................................................................4
AES features:.....................................................................................................................................4
Security:.........................................................................................................................................5
Cost:...............................................................................................................................................5
Security..........................................................................................................................................5
Attacks:..................................................................................................................................................8
Solution (How Cryptography technology is used to provide the security).............................................9
Conclusion:..........................................................................................................................................11
Recommendations:..............................................................................................................................11
References:..........................................................................................................................................12
1

Introduction
Communication has always been the only medium to be connected in this world. The
communication can take place through various methods like the phone to phone calls or by sending
messages or emails containing the useful information. But due to the advancement in technology,
this important information can easily be hacked by the experts and can be misused. When it comes
to the transfer of very highly secured messages, especially by the government organisations and
defense sectors utmost care is needed as a little information leak in the wrong hands can have
several major effects not only on the organisation but as a whole country. Therefore to protect the
data sent between the user and receiver one needs to encrypt the data, so no one is allowed to
access the data without permission and a specific password or a key. For this various method were
adopted such as DES and AES which will be discussed here in this text. We will have a look at how
they work, which is better than the other and how it can be improved to a certain extent (Mankotia,
2015).
What is DES??
DES stands for data encryption standard which is a block cipher that describes a cryptographic key
and a certain algorithm is put on the documents or the block. This can be done simultaneously too
many bits at a time instead of a single bit. To encrypt a plain text message, it makes a group of 64-bit
blocks a piece. Now each block is encoded by a secret key into a 64-bit ciphertext with the help of
substitution and permutation. This procedure includes 16 rounds and could execute in four diverse
modes. This can either work individually or can make the block codes to depend on the previous
block. And this way a successful encrypted message is directed to the receiver. Now at the receiver
end, the text needs to be decrypted before it can be read. The decryption process is a complete
inverse process of the encoding technique. It monitors the equivalent steps just the direction of the
steps is reversed in which a key is used (Olaleye, 2017).
For any figure, the primary and the maximum critical or easy method to assault is the animal
electricity which includes the hit and trial method with the aid of trying every key until the point that
the right key is found. The length of the important thing comes to a decision the amount of doable
keys and as a consequence the safety and easy manner to cope with this attack. DES uses a 64 bit
key in its encryption process but out of this eight of these is already booked for parity checks and so
we have limited our bits of the key only to fifty-six bits. Hence the maximum number of trials to find
the correct key are 2^56, that is 72057594037927936 attempts.
2

In the early 1970s, the researchers of IBM designed this DES system and the U.S. government
adopted this as an authorized federal info n processing standard (FIPS) in 1977 for the confidential
and profitable classified computer data of government. This became the first encryption process to
be accepted and the U.S. government approved this procedure for public disclosure. Due to this step
many companies in which high encryption required adopted DES quickly and such as the financial
services. Its simplicity increased its uses in the embedded systems like the SIM cards, smart cards,
and many system devices which require encryption like the setup boxes, modems, and router
(Mankotia, 2015).
This technique was widely used at that time but due to the upcoming technologies, it became easier
to crack these encrypted messages. Many felt that 56 bit was inadequate even before its standard
adoption. They also believed that interference from the NSA side has weakened the codes and
algorithm originally written by the IBM. But this was still widely used and the most trusted
encryption till the 1990s. But in 1998, a computer constructed through the electronic frontier
foundation was capable to crash the encrypted message within 56 hours. Which created a problem
for the users? Later by binding the control of the thousands of interacted computers, the decryption
time was reduced from 56 hours to 22 hours only.
Due to its way of cracking and backward compatibility in many cases, trusting today on DES for
information confidentially is a thoughtful security fault in every computer system and must be
evaded. With the advancement, there is much new secure algorithm are accessible now, and people
do not need to rely on these previously build algorithms. DES is more like a cheap suitcase box,
which can keep the data or content safe just by the honest people but cannot stop the determined
thief. So our problem of security remains the same and we would look for some other options in
order to keep our data safe and protect it from being hacked by the malfunctions. One such
algorithm is AES which we will further discuss in our report here (Chandrasekar, 2017).
Despite being reached at the end of the usability and usefulness of its life, The access of DES
dependably served to boost the research of cryptography and the improvement of latest encryption
calculations. Until the point that DES wasn't presented, cryptography was the stupid craftsmanship
restrained to the domain names of the military and authorities perception institutions as it had
been. Because of the open concept of DES, it gave numerous open doorways, as an example, in
scholastics, for mathematicians or all of us intrigued by way of protection. As they could
contemplate how the calculations functioned and could endeavour to split them. Basically in terms
of a new puzzle or some craze. A whole new industry was born and opened the chances for more
and more development (Prajapati, 2014).
3

The encryption strength was tied to the size of 56-bit key length only which became relatively too
small for the modern computers. They could easily process the data and could decode the
algorithms. So in 1997, the National Institute and Technology (NIST) broadcasted an enterprise
towards the beneficiary of the DES and in 2001 AES was nominated as its replacement, and the data
encryption standard (FIPS-46-3) was formally reserved in May 2005. A technology that is triple DES
(3DES) has been approved for the sensitive encryption purpose for the government organisations by
2030. This triple DES executes three repetitions of the single DES algorithm that is if keying selection
number one is selected, some diverse key is used all time, this helps in increasing the key length
from 56 bit to 168 bits. Because of the possibility of the central attack effectiveness, it is able to
provide with only 112 bit of length for the key. Also, the 3DES encryption method is much slower
than the plain DES method. We will further have a look at AES encryption (Zhang, 2014).
What is AES??
The original name of AES is Rijndael which is an encryption of electronic data and it stands for
advanced encryption standard. Two cryptographers which gave a name to this were Vincent Rijmen
and Joan Daemen. US government choose AES which is a symmetric block cipher to protect
information and data. To encrypt the sensitive data, AES can be implemented in software as well as
hardware to all over the world. Some institutes such as The National Institute of Standard and
Technology (NIST) underway preparation in late1997 when it is declared that other alternative
algorithm required rather than DES(data encryption standard) as it had started becoming vulnerable
to many attackers and by the method of brute force attack, it could easily be cracked.
Conferring to the NIST statement of the procedure for the growth of AES ensures that this algorithm
would be classified and would be able to protect the sensitive information well, also until the next
century. It was made to overcome all the previous drawbacks we faced in the Des system and
therefore, it was easy to execute it in software as well as hardware and even in the limited
environments such as in smart cards. It also offers very good defense mechanism against the various
attack techniques (Chandrasekar, 2017).
AES features:
The desire system for the brand new symmetric key calculation changed into made definitely open
for the overall populace research and statement which assured a sincere and a extra précised and
exhaustive exam of the plans which were submitted.
4

NIST proclaimed the determinations of the brand new propelled encryption general calculation to be
a chunk determine that's in shape for managing 128-piece squares and several other criteria had
been remembered while selecting it as the following propelled encryption well-known like the
protection, price, execution and so forth.
Security:
While competing for different encryption methods which were submitted, it was necessary to judge
their ability to resist various types of attacks. Also, the security strength was considered as the most
important factor in judging the designs in the competition.
Cost:
On the off threat that the encryption changed into proposed to be discharged universally, with non-
selective and eminence unfastened premise it was vital to hold the costs low by the competitor
displaying the calculations and had been to be measured on memory and computational
productiveness.
Security
This integrated the calculation characteristics to be evaluated based on the flexibility of the
calculation, and moreover the reasonableness of the control to be realized in equipment and
programming and trendy relative truthfulness and effortlessness in executing and executing such
calculations.
There were in all out fifteen symmetric key calculations plans which had been submitted and were
subjected to preparatory exam of the world cryptographic institution, together with the National
Security Agency (NSA). In August 1999, simply 5 calculations were chosen by using the NIST for huge
research, they had been (Prajapati, 2014)
MARS by means of IBM scientists, RC6 put together with the aid of RSA safety, Rijndael, Serpent and
the two fish which changed into provided with the aid of an intensive group of specialists from the
counterpane web safety. These usages have been all absolutely attempted in ANSI, java and C
dialects for pace and dependability in encryption and unscrambling. Additionally, the important
thing and calculation setup time and the adaptability to modify with device and programming driven
frameworks were likewise checked. Before the execution of safety specific assaults changed into
additionally guaranteed. Individuals from the worldwide cryptographic institution directed a point by
way of point examination of everything. After all the technique, and the grievance and stage headed
discussion and examination, the Rijndael determine was chosen as a consequence and become
5

proposed as the AES calculation in 2000 and become moreover allotted by using NIST as U.S. FIPS
PUB 197. In 2002 the AES ended up effective inside the countrywide government well-known. Global
International Organization for Standardization (ISO) and Electro technical Commission in which AES
become integrated for information category by using making use of piece figures. It became
declared that AES quickly turned into the default encryption calculation by way of America
government in 2003 for protecting the sensitive information. It became the principle publically to be
had and open figure affirmed with the aid of the NSA for top mystery facts. It turned into picked
because the standout among the maximum secured cryptographic calculation to be utilized
(Prabhakar, 2014). Its request expanded inside the private element after correctly utilized by US
authorities which made it the prominent calculation in symmetric key cryptography. The trustworthy
and an impartial dedication process precipitated the formation of an unusual nation of consider in
AES among safety and cryptography experts. AES is more copy and progressed than its forerunners
which can be DES and 3DES in light of the reality that the calculation utilized is more grounded and
uses longer key lengths. This additionally had the upside of faster encryption and unscrambling when
contrasted with the past ones which make it an ideal one for the product programs, likewise in
numerous firmware and equipment wherein we require better safety, or both low dormancy and
excessive throughput like in firewalls and switches. It can likewise be utilized as a part of several
conventions, for instance, copy attachments layer. This may be observed in maximum current
improvements and applications and devices that want encryption usefulness (Dinur, 2015).
6

Experiment Analysis and Working:
AES contains three specific block ciphers which are AES (128,192 and256). Each cipher is responsible
for encrypting and decrypting information in the sets of 128 bits using cryptographic variant keys
ranging from 128, 192 and 256) bits specifically , respectively. In the beginning Rijndael was
developed to approve the extra and key dimensions but this methodology remained unapproved for
AES. Symmetric is a known cipher which adopts the same key for decrypting and encrypting data.
Therefore the receiver and sender both need to be aware of identical secret key. Keys are provided
with sufficient protection of information to the Secret level but for high priority of information we
require 192- and 256- keys with 12 rounds for 192- bit keys and 14 rounds with 256- bit keys. Almost
every round contains of symmetrical handling levels which comprises of transposition of
information, intercourse of a input plain text and modify it according to cipher output and
substitution (Ji, 2015).
This AES algorithm requires several of transformations which can be implemented on information to
store information to an array. The very first step is to put the information to an array and then
various continuous modifications are performed for encryption. These round numbers are identified
with key lengths:
10 rounds require-> 128-bit keys
12 rounds require-> 192-bit keys
14 rounds require-> 256-bit keys
The first modification involves the substitution in the AES encryption cipher from replacement table.
Then the next transformation involves the shifting of data rows, and third one is to mix the given
columns. The end transformation is to simply implement (XOR) operations on each column of a table
using a variant part of the key which does encryption. Longer will be the key length greater will the
rounds (Gupta, 2017)
7

Attacks:
Research on the attacks has continued since it was standardized and finalized in 2000. As attacks are
the loopholes of the system and can destroy the purpose of sending these messages and can use the
data in a wrong manner. Various researchers were successful in publishing the attacks against the
comparatively less round version of the advanced encryption standard.
In 2005, Cache-timing attacks on AES were published by a researcher and a cryptographer which
shows a control attack on AES was proficient of successfully retrieving AES key from another
computer with same. A research paper came into existence in 2011 which depicted biclique attack
technique; it became possible to retrieve AES keys faster as compared to brute force attack. But due
to its high calculation complexity, this could not affect the AES algorithm (Hu, 2016).
AES has always been a reliable cipher. The only attack against AES which has a great consequence
was the side channel attack which affected the weakness found in the implementation of AES. Side
channel attacks have the greater consequence effect in comparison to brute force attack or
theoretically calculated weakness. AES has been used by TLs to encrypt the information, in line for
the type of data that TLS contains, attacks helped to calculate the initialization vector set which is
used in initial processes of encryption.
8

Solution (How Cryptography technology is used to provide the
security)
As we know that the cryptography technology is used to provide the security too for the network
and data or information of the organization. The cryptography is the technology that works to
scramble data with readable and unreadable data. The cryptography algorithm is based on the
public key and secret key which is used to hide the data and secure the data. Cryptography helps in
assuring secrecy. The earlier methods used for this purpose were seals, signatures, etc. to maintain
the reliability and authenticity of the sender. Cryptography has proved to be a safe and secure
means that helped to provide the basis of electronic cash transfer and use of credit cards and debit
cards. Cryptography helps in the protection of data and information in all applications (Gallagher,
2017).
The various ways in which cryptology helps in security are:
 Transmission- A private key system is used for transmission in the secrecy systems these
days. There can be two situations, if the number of parties being communicated is small or if
the number is large. If the number is small then there is periodical key distribution with the
help of courier service and if the number is large then electronic key distribution is
preferred.
 Storage- One key system is used for the purpose of security in storage. In this, the key is
provided by the user to the computer system at the start of the session only and then the
throughout the course the encryption and decryption are taken care of by the system. The
key must be supplied by the user to the encryption hardware when the user starts the
computer (Cruz, 2017).
 Integrity in Transmission- Integrity in transmission is a very important implementation of
cryptography. It helps in restricting any modification or tempering of the information being
transmitted. One of the most suitable methods for assuring integrity is performing a
checksum on the information that is being transmitted and then transmitting it in the
encrypted form. And then when the information in the encrypted form reaches the receiver
end then it is checksummed again and compassion is done between this information and
checksum transmitted after decryption (Cross, 2015).
 Integrity in Storage- Cryptography helps in the integrity of storage. It helps in the protection
of information in the storage against intentional attacks and threats. It assures security by
access controls such as guards, systems of lock and key, etc. (Cruz, 2017)
9

 Identity Authentication- Identity authentication has been a major problem of individuals as
well as systems for a long time. Cryptography helps in identity authentication. It gives
trustworthy authentication to identity with the help of strong passwords and identification
techniques. Strong passwords are achieved by key selection. A password may be considered
as a key to the cryptosystem which allows decryption and encryption of each and everything
that is allowed by the password to access (Gibson, 2016).
 Credentialing Systems- A document that introduces one party to the other with the help a
common trustworthy party is called a credential. The credential of a person is often done
with the help of his credit cards so that he could attain more credit cards. For the
verification purpose electronically, electronic credentials are being designed to verify the
claim for credit electronically. In making electronic credentials the security of the system is
the utmost priority which is achieved by cryptography. Cryptography helps in securing the
information and data in the electronic credentials (Durumeric, 2013).
10

Conclusion:
As we have seen both the encrypting code blocks, their history and how they work, we can conclude
that AES is far much better than the DES blocks. As it nullifies the errors present in the DES system
which can invade the personal information and can be a risk to security. Also, AES provided better
encryption speed, lesser cost, and more advanced versions of key algorithms which have flexible and
multiple uses. It can be used in hardware as well as the software applications. Using this we can
entirely ensure the safety of our data from the hackers and various attacks.
Recommendations:
Although we have seen that AES is a better option to ensure encryption of the data but further
studies can be made and a more secure environment for the electronic data can be created so that
no attacks can invade the privacy and better communication is possible. As our studies showed that
some attacks could also have an impact on AES systems, therefore, researchers should focus more
on these minute details and create a more advanced technology and applications. So that no
attacker even thinks to attack stored data (Alahmadi, 2014).
11

References:
 Alahmadi, A., Abdelhakim, M., Ren, J., and Li, T., 2014. Defense against primary user
emulation attacks in cognitive radio networks using advanced encryption standard. IEEE
transactions on information forensics and security, 9(5), pp.772-781.
 Chandrasekar, B., Ramesh, B., Prabhu, V., Sajeev, S., Mohanty, P. K., & Shobha, G. (2017,
March). Development of Intelligent Digital Certificate Fuzzer Tool. In Proceedings of the 2017
International Conference on Cryptography, Security and Privacy (pp. 126-130). ACM.
 Cross, T.J., Dewey, D.B. and Takahashi, T., International Business Machines Corp, 2015. Using
the information in a digital certificate to authenticate a network of a wireless access point.
U.S. Patent 9,197,420.
 Cruz, B.F., Domingo, K.N., De Guzman, F.E., Cotiangco, J.B. and Hilario, C.B., 2017. Expanded
128-bit Data Encryption Standard.
 Dinur, I., Dunkelman, O., Keller, N. and Shamir, A., 2015, August. New attacks on Feistel
structures with improved memory complexities. In Annual Cryptology Conference (pp. 433-
454). Springer, Berlin, Heidelberg.
 Durumeric, Z., Kasten, J., Bailey, M., & Halderman, J. A. (2013, October). Analysis of the
HTTPS certificate ecosystem. In Proceedings of the 2013 conference on Internet
measurement conference (pp. 291-304). ACM.
 Gallagher, S.J., Red Hat Inc, 2017. Creating a digital certificate for a service using a local
certificate authority. U.S. Patent Application 15/275,102.
 Gibson, R. A., Neergaard, J. P., & O'donnell, W. J. (2016). U.S. Patent Application No.
14/464,777.
 Güler, Z., Özkaynak, F., and Çınar, A., 2017, September. CUDA Implementation of DES
Algorithm for Lightweight Platforms. In Proceedings of the 2017 International Conference on
Biomedical Engineering and Bioinformatics(pp. 49-52). ACM.
 Gupta, A. and Kaushik, S., 2017. A Review: RSA and AES Algorithm. IITM Journal of
Management and IT, 8(1), pp.82-85.
 Hu, Y., Tie, M., Tong, W., Zhang, B., Huang, Z., Jian, L. and Yuan, P., China Iwncomm Co Ltd,
2016. Digital certificate automatic application method, device, and system. U.S. Patent
9,397,840.
 Ji, B., Wang, L. and Yang, Q., 2015. New Version of AES-ECC Encryption System Based on
FPGA in WSNs. Journal of Software Engineering, 9(1), pp.87-95.
12

 Mankotia, S. and Sood, M., 2015. A Critical Analysis of Some Symmetric Key Block Cipher
Algorithms. International Journal of Computer Science and Information Technologies, 6.
 Olaleye, S.B. and Ojha, S., 2017. A compact software implementation of AES on atomic
smartphones architecture. International Journal of Innovative Science, Engineering, and
Technology, 4(2), pp.102-112.
 Pancholi, V.R., and Patel, B.P., 2016. Enhancement of cloud computing security with secure
data storage using AES. International Journal for Innovative Research in Science and
Technology, 2(9), pp.18-21.
 Prabhakar, S., Swamy, C. and Kumar, S.R., 2015. A Hybrid Encryption Algorithm Based on DES
and RSA in Bluetooth Communication. International Journal Of Engineering And Computer
Science, 4(05).
 Prajapati, P., Patel, N., MacEwan, R., Kachhiya, N. and Shah, P., 2014. Comparative analysis
of DES, AES, RSA encryption algorithms. International Journal of Engineering and
Management Research, 4(1), pp.292-294.
 Zhang, T., Van Den Berg, E., Burnette, A., Di Crescenzo, G., Ferrer, R., Pietrowicz, S., & White,
R. G. (2014). U.S. Patent No. 8,635,681. Washington, DC: U.S. Patent and Trademark Office.
13