From where is a DES key generated? [closed]

Question

GOing over a lecture on DES
I got most of it except WHERE DOES DES KEY COME FROM?
Does an authority give you the key or what?
Simple language please

Answer 1

The simple answer is that the key is and must be picked at random. You grab a bunch of bits from wherever, and hope that they are random enough to resist attacks on the key generation algorithm. (It's worth noting that many real-world attacks on cryptographic software have focused on the particulars of the key generation, rather than the cryptographic algorithm itself.) There is no central authority involved; in fact, having such a central authority would largely defeat the whole purpose of encryption (which is to transform a large secret - the plaintext - into a small secret - the encryption, or more accurately the decryption, key).

DES is a symmetric encryption algorithm, which means that to decrypt the data you must have the same key that was used to encrypt it. That leads to key distribution problems, but it's much easier to securely distribute and store a small key than a large plaintext, and keys can be distributed ahead of time provided that you can store them securely.

Asymmetric, or public/private key, algorithms solve the key distribution problem by using different keys for encryption and decryption - the mathematics that makes that possible is rather involved and varies between algorithms, but the general approach is that the encryption and decryption keys have nontrivial mathematical relationships - but have other issues of their own. Security is always a trade-off between different considerations. The most well-known such algorithm is probably RSA.

The only provably secure encryption algorithm is a properly used OTP (one-time pad), but that requires a properly random key the length of the message to be encrypted and the key must never be re-used, so is not very useful in practice for anything beyond short messages between parties who already have some sort of secure communications channel that just isn't "good enough" for sending the messages involved. For example, a trusted courier might be used to distribute key material; the courier is slow, whereas the OTP-encrypted message can be transmitted over a satellite link or Internet e-mail with no risk of being understood if it is intercepted, as long as the key can be trusted to be secure.

Specific usage scenarios might involve a central key distribution facility of some kind even for symmetric-key encryption algorithms, but I really think that those are truly the exception in that case.

Also, like @delnan touched at, what other encryption algorithms are you familiar with? It's worth keeping in mind that DES is trivially easy to break these days, even with consumer-class hardware and a naïve brute-force attack on the key.

Answer 2

The cryptographic key is just a series of bits.

At the simplest level, the key is generated from a hashed version of a password. The key (ie the specific series of bits) must be re-creatable otherwise you will not be able to decrypt the encrypted object.

Technically, you could just use the password without hashing for the key, but it makes me shudder to think of doing it that way. NOT secure.

DES has some funkiness with its key length being either 56 bits or 48 bits. I don't know of any other ciphers with a similar key length characteristic, so I would ignore that aspect. The 48 bit key is not just a subset of a 56 bit key, they're different.

DES has nothing to do with public / private key pairs. DES is a symmetric encryption algorithm, whereas public / private keys indicates an asymmetric algorithm.