Static site. Every demo computes in your browser, and nothing you type is sent anywhere.
25%
Sixty-four stored bits become sixteen 48-bit subkeys. Eight of those stored bits reach nothing.
C(0) || D(0) = PC1(K), 56 bits chosen from 64 C(i) = rotl(C(i-1), s(i)) and D(i) = rotl(D(i-1), s(i)) K(i) = PC2(C(i) || D(i)), 48 bits chosen from 56
A DES key is stored as 64 bits, and only 56 of them enter the cipher. Bit 8 of every byte is a parity bit. FIPS 46-3 asks each byte to hold an odd number of ones. That was a transmission check for the hardware of 1977. Type any key below and every number on this page follows it.
The caret marks each of the eight parity positions, 8, 16, 24, 32, 40, 48, 56, 64. Positions are numbered from 1 at the most significant bit, which is the convention every FIPS table uses.
parity of each byte
Each row gives one stored byte of the key, the positions it spans, the eight bits it holds, its parity bit, how many of those bits are ones, and whether that count is odd as the standard asks.
Byte
Positions
Bits
Parity bit
Ones
Parity
1
1 to 8
00010011
1
3
odd, as required
2
9 to 16
00110100
0
3
odd, as required
3
17 to 24
01010111
1
5
odd, as required
4
25 to 32
01111001
1
5
odd, as required
5
33 to 40
10011011
1
5
odd, as required
6
41 to 48
10111100
0
5
odd, as required
7
49 to 56
11011111
1
7
odd, as required
8
57 to 64
11110001
1
5
odd, as required
A key with the wrong parity still encrypts. Nothing in this implementation rejects it, and nothing below changes when you press Clear the parity bits. That is the first hint that the key length is 56 and not 64. The next step turns the hint into a measurement.
Permuted choice 1 reads 56 of the 64 positions and writes them in a new order. The 56 bits are then split in half. The left 28 bits are the register C, and the right 28 bits are the register D.
Each row gives one half of the permuted key before any round has run, written in binary and in hexadecimal.
Register
Binary, 28 bits
Hex
C(0)
1111000 0110011 0010101 0101111
F0CCAAF
D(0)
0101010 1011001 1001111 0001111
556678F
The eight positions PC-1 never names
8 16 24 32 40 48 56 64
the named list: 8 16 24 32 40 48 56 64
The two lists are identical
The first list is computed: every position from 1 to 64 is tested against the PC-1 table and kept when the table names it nowhere. The second list is the parity positions. They agree, so the eight bits PC-1 discards are exactly the eight parity bits. That is a property of the table, not an assumption about it.
Each round rotates both registers to the left, then PC-2 selects 48 of the 56 register bits as the subkey of that round. The rotation is cumulative: round i works on the registers round i-1 produced, never on C(0) and D(0). Move the slider to see any round of the schedule.
Round
1
Round 1, one rotation and one selection
Each row gives one register before or after the rotation of this round, written in binary and in hexadecimal.
Register
Binary, 28 bits
Hex
C(0)
1111000 0110011 0010101 0101111
F0CCAAF
C(1)
1110000 1100110 0101010 1011111
E19955F
D(0)
0101010 1011001 1001111 0001111
556678F
D(1)
1010101 0110011 0011110 0011110
AACCF1E
Both registers were rotated left by 1 place this round. The rotation is circular inside 28 bits, so nothing is lost and nothing is added.
the subkey PC-2 selects, in the six-bit groups the round function uses
As hexadecimal that is 1B02EFFC7072. The eight groups above are what the eight S-boxes receive, one group each, once the round function has expanded its half of the block.
Every round of the schedule
Each row gives one round of the key schedule, the rotation that round applied, both registers after that rotation, and the subkey PC-2 selected from them.
Round
Left shift
C, hex
D, hex
Subkey, hex
1
1
E19955F
AACCF1E
1B02EFFC7072
2
1
C332ABF
5599E3D
79AED9DBC9E5
3
2
0CCAAFF
56678F5
55FC8A42CF99
4
2
332ABFC
599E3D5
72ADD6DB351D
5
2
CCAAFF0
6678F55
7CEC07EB53A8
6
2
32ABFC3
99E3D55
63A53E507B2F
7
2
CAAFF0C
678F556
EC84B7F618BC
8
2
2ABFC33
9E3D559
F78A3AC13BFB
9
1
557F866
3C7AAB3
E0DBEBEDE781
10
2
55FE199
F1EAACC
B1F347BA464F
11
2
57F8665
C7AAB33
215FD3DED386
12
2
5FE1995
1EAACCF
7571F59467E9
13
2
7F86655
7AAB33C
97C5D1FABA41
14
2
FE19955
EAACCF1
5F43B7F2E73A
15
2
F866557
AAB33C7
BF918D3D3F0A
16
1
F0CCAAF
556678F
CB3D8B0E17F5
PC-2 keeps 48 of the 56 register bits, so it discards eight of them every round. Counted over the register, the discarded positions are always 9, 18, 22, 25, 35, 38, 43, 54. The rotation is what makes this interesting: those fixed positions hold different original key bits in each round, so the schedule does not discard the same eight key bits sixteen times.
Two facts finish the schedule. The first is arithmetic on the shift table. The second is a count of how much of the key each subkey carries.
The rotations total 28 places
left shifts, round 1 to round 16
1 1 2 2 2 2 2 2 1 2 2 2 2 2 2 1
total 28
The shifts sum to 28, which is the width of each register. A 28-bit register rotated left by 28 places in total returns to its starting value, so C(16) has to equal C(0) and D(16) has to equal D(0).
the registers before the first round and after the last
Each row compares one register before the first round against the same register after the sixteenth round.
Register
Before round 1
After round 16
C
F0CCAAF
F0CCAAF
D
556678F
556678F
The registers return to their starting value
Decryption uses the same sixteen subkeys in reverse order. Because the registers return to C(0) and D(0) after round 16, an implementation can start from C(0) and D(0), produce K(16) first, and then rotate to the right by the same amounts to produce K(15) down to K(1). No second table is needed and no subkey has to be stored. That is a hardware saving, and it is the reason the shift table sums to the register width instead of to some other number.
One row per stored byte, one column per position inside that byte. A dot is a parity bit: PC-1 names no such position, so it appears in none of the 16 subkeys. The count is over positions rather than over one particular key, so it holds for every key you can type.
the same counts, gathered
Each row gives a number of subkeys, how many of the sixty-four stored key bits appear in exactly that many subkeys, and which bits those are.
Subkeys the bit appears in
Key bits
Share
Which bits
0
8
the eight parity bits
12
4
bits PC-1 keeps
13
20
bits PC-1 keeps
14
20
bits PC-1 keeps
15
12
bits PC-1 keeps
The 16 subkeys hold 16 times 48, or 768, bit positions in total. Spread over the 56 key bits PC-1 keeps, that is a mean of 13.71 subkeys per key bit. The real counts run from 12 to 15, so the schedule is close to even without being exactly even.
No kept bit is missing from the schedule, and no kept bit is in all 16 subkeys, because PC-2 discards eight register positions every round. An attacker who learns one subkey therefore learns 48 bits of the 56, and the remaining eight are a search of 2^8. That is the shape of every attack that recovers a round key first, and it is why the round subkeys are not treated as independent secrets.