What is DES with Independent Subkeys?

The DES algorithm derives sixteen 48-bit subkeys, for use in each of the 16 rounds, from the 56-bit secret key supplied by the user. It is interesting to consider the effect of using a 768-bit key (divided into 16 48-bit subkeys) in place of the 16 related 48-bit keys that are generated by the key schedule in the DES algorithm.

While the use of independent subkeys would obviously vastly increase the effort required for exhaustive key search, such a change to the cipher would make it only moderately more secure against differential and linear cryptanalytic attack (see Question 58 and Question 59) than ordinary DES. It is estimated by Biham [Bih95] that 2⁶¹ chosen plaintexts are required for a differential attack on DES with independent subkeys, while 2⁶⁰ known plaintexts are required for linear cryptanalysis.

| Question 72|