# What is the Data Encryption Standard (DES), and why DES and RC4 are no longer safe URL: https://webvpn.org/encryption/des-rc4-legacy-encryption/ Updated: 2026-09-06 What the Data Encryption Standard was, how DES worked, why its 56-bit key failed, what Triple DES and RC4 are, and why all three are retired in favour of AES. The Data Encryption Standard, DES, is a symmetric block cipher standardised in the 1970s that encrypts 64-bit blocks with a 56-bit key through sixteen rounds; it protected government and financial data for decades until its short key became brute-forceable, and it has been withdrawn in favour of AES. RC4 is a stream cipher from the late 1980s that encrypted much of the early web and Wi-Fi before statistical weaknesses in its keystream made it unsafe; it is now prohibited in TLS. Both survive only in legacy systems, and neither should protect anything today. Understanding DES and RC4 is not nostalgia. They appear in old systems you may still meet, their failures explain the design choices behind AES and modern protocols, and the phrase "military-grade encryption" attached to products is sometimes covering one of them. This guide explains what DES was and how it worked, why it failed, how Triple DES prolonged it, what RC4 is and how it broke, and what replaced them. ## What DES is DES emerged from a design submitted by IBM in the early 1970s and was adopted as a United States federal standard in 1977 for protecting sensitive unclassified data. It became the first cipher to be widely deployed in commerce, forming the basis of banking networks, ATM PIN protection, and countless software products. For roughly twenty-five years, DES was what encryption meant in practice. The algorithm is a block cipher operating on 64-bit blocks. The key is nominally 64 bits, but eight of those are parity bits, leaving 56 bits of actual key. That number is the whole story of DES's downfall. ## How DES works DES uses a structure called a Feistel network, which splits each block into two 32-bit halves and processes them over sixteen rounds. - An initial fixed permutation rearranges the 64 input bits. - In each round, the right half is expanded to 48 bits, XORed with a 48-bit round key derived from the main key, passed through eight substitution boxes that compress it back to 32 bits, permuted, and XORed into the left half. - The halves are swapped and the next round begins with a new round key. - After sixteen rounds, a final permutation produces the ciphertext. The Feistel structure has an elegant property: decryption uses the same operations with the round keys in reverse order, so one circuit does both. The S-boxes provide the non-linearity, and their design was the subject of suspicion at the time because the criteria were not published; later analysis showed they were chosen to resist an attack technique that was then secret and became public years afterward. The AES algorithm guide on this site describes how the later cipher approached the same goals differently. ## Why DES failed The weakness was never in the rounds or the S-boxes; the best analytic attacks on DES are only modestly better than brute force. The weakness was the 56-bit key. It permits about 72 quadrillion keys, a number that seemed unassailable in 1977 and was already criticised as too small by academic cryptographers who suspected the key had been shortened deliberately. By the late 1990s a purpose-built machine costing under a quarter of a million dollars recovered a DES key by brute force in days, and public distributed efforts did the same. Today, commodity hardware and cloud computing exhaust the DES keyspace in hours or less. The standard was formally withdrawn in the mid-2000s. DES has a second problem that outlives the key: its 64-bit block. With blocks that small, encrypting a few gigabytes of data under one key produces repeated ciphertext blocks by the birthday paradox, leaking information regardless of key length. This affects Triple DES equally and is part of why it too has been retired. ## Triple DES: extending the life Rather than replace DES immediately, industry adopted Triple DES, or 3DES, which encrypts each block three times, typically encrypt with key one, decrypt with key two, encrypt with key three. With three independent keys the nominal length is 168 bits, though an attack reduces the effective security to about 112 bits, which is still far beyond brute force. 3DES bought two decades for systems that could not change quickly, especially payment cards and banking hardware. It is three times slower than DES and many times slower than AES, keeps the 64-bit block and its data-volume limits, and has been formally deprecated, with standards bodies setting deadlines after which it may not be used for new data. It still runs inside some payment terminals and mainframe systems and is the reason "DES" appears in specifications long after its retirement. ## What RC4 is RC4 is a stream cipher designed in 1987, kept as a trade secret until the algorithm leaked in 1994 and then adopted almost everywhere because it was tiny, fast in software and free of the block-size and padding complications of block ciphers. It works by initialising a 256-byte state from the key and then generating a pseudo-random keystream one byte at a time, which is XORed with the plaintext. Decryption is the same operation. RC4 encrypted a large share of SSL and TLS connections through the 2000s, protected Wi-Fi under WEP and then TKIP, and was embedded in Microsoft authentication and remote desktop protocols, PDF encryption and many other places. ## How RC4 broke RC4's keystream is not uniformly random. The first bytes it produces are biased toward particular values, and there are subtler correlations throughout. Individually the biases are small; over millions of encryptions of the same plaintext, such as a web cookie sent on every request, they allow the plaintext to be recovered statistically without the key. Researchers demonstrated exactly that against TLS, and earlier work exploited RC4's weak key scheduling to break WEP in minutes, making Wi-Fi encryption trivially defeatable for years. Browsers and servers removed RC4 in the mid-2010s and it is prohibited in TLS by standard. Where it persists, in old Windows authentication configurations, legacy devices and some file formats, it should be regarded as providing no confidentiality. ## What replaced them AES replaced DES and 3DES as the block cipher standard after an open international competition, with 128-bit blocks and keys of 128 to 256 bits that address both of DES's problems; the AES-256 guide on this site covers it. For stream encryption, ChaCha20, usually paired with the Poly1305 authenticator, replaced RC4, offering speed in software with a keystream that has no known biases. Modern protocols use AES-GCM or ChaCha20-Poly1305 exclusively, and HTTPS, as the guide on this site explains, negotiates one of them on every connection. ## Lessons the failures taught - Key length must anticipate decades of hardware improvement, which is why 128 bits is the modern minimum and 256 is common. - Block size matters as much as key size, which is why AES uses 128-bit blocks. - Ciphers must be designed and analysed in public; secrecy around DES's S-boxes and RC4's algorithm bred distrust and delayed the discovery of weaknesses. - Speed and simplicity are not enough; RC4's popularity spread a flawed cipher into everything. - Retirement takes decades once a cipher is embedded in hardware, so choosing conservatively at the start is cheaper than migrating later. ## What standards bodies and cryptographers say The history above follows the public record and the assessments of the bodies that set and withdrew these standards. The United States standards body that adopted DES later withdrew it, deprecated Triple DES with a defined sunset, and selected AES through an open competition, documenting the key-length and block-size reasons for each decision. The internet standards community prohibited RC4 in TLS after published attacks demonstrated practical plaintext recovery, and browser makers removed support, citing the same research. Cryptographers who analysed DES describe its design as remarkably strong for its era and its key length as its single fatal flaw, and describe RC4's failure as a warning against deploying ciphers whose statistical properties had not been thoroughly examined. ## Check for them and move on If a device, protocol setting or product you rely on still lists DES, 3DES or RC4, treat that as a finding and upgrade the configuration to AES-GCM or ChaCha20-Poly1305. Then keep the lesson: the cipher that seems unbreakable today is judged by the hardware of thirty years from now, and the modern standards were chosen with that in mind. ## FAQ Q: What is the Data Encryption Standard? A: DES is a symmetric block cipher standardised in the 1970s by the United States government for protecting unclassified data. It encrypts 64-bit blocks with a 56-bit key through 16 rounds of a Feistel network. It was the dominant cipher for decades and was withdrawn after its key became brute-forceable. Q: Why is DES no longer secure? A: Its 56-bit key allows only about 72 quadrillion possibilities, which specialised hardware could exhaust in days by the late 1990s and which modern hardware exhausts far faster. Its 64-bit block size also leaks information on large volumes of data. The algorithm's structure was sound; the key was simply too short. Q: What is Triple DES? A: 3DES applies DES three times with two or three keys, raising the effective key length to 112 bits. It extended DES's life in banking and payment systems but is slow, keeps the small 64-bit block, and has been deprecated in favour of AES, with standards bodies setting deadlines to stop using it. Q: What is RC4 encryption? A: RC4 is a stream cipher designed in 1987 that generates a keystream XORed with plaintext. It was fast and simple and became ubiquitous in SSL, TLS, WEP Wi-Fi and Microsoft protocols. Statistical biases in its keystream led to practical attacks, and it has been prohibited in TLS and removed from browsers. Q: Could I still encounter DES or RC4 today? A: Yes, in legacy systems: old payment terminals, embedded devices, ancient VPN configurations, WEP networks and some enterprise authentication protocols. Anything still offering them should be treated as unencrypted and upgraded to AES or ChaCha20.