Iterative Characteristics of DES ands 2 -

In this paper we show that we are close at the proof that the type of characteristics used by Biham and Shamir in their diierential attack on DES 3] are in fact the best characteristics we can nd for DES. Furthermore we show that the criteria for the construction of DES-like S-boxes proposed by Kim 6] are insuucient to assure resistance against diierential attacks. We show several good iterative characteristics for these S-boxes to be used in diierential attacks. Finally we examine the probabilities of the two characteristics used by Biham and Shamir in 3]. We found that for some keys we do not get the probabilities used in the attack. We suggest the use of 5 characteristics instead of two in the attack on DES.