DES watch: an examination of the sufficiency of the data encryption standard for financial institution information security in the 1990s
Gilles Garon, Richard Outerbridge · ACM SIGSAC Review · 1991
DES is used almost universally by financial institutions (Fls) around the world. For the foreseeable future there are no alternatives to its continued use. Within ten years unmodified single-key DES will be breakable for a cost of about $3,500 per solution in under one day. Many financial systems which currently rely on single-key DES are therefore becoming vulnerable to attack.Despite the impact of breaking DES, the misconception that an FI's exposure is limited to the dollar values of particular short-lived transactions may make users unwilling to undertake urgent remedial measures. They may be prepared to tolerate risks they perceive as limited and unrealistic. This view ignores the danger that a breach of key management security poses to the system as a whole.Until a new encryption standard emerges, the exposure and consequences can be avoided by the adoption of double-length keys for DES. This is technically and economically feasible. Double-length keys and unique keys per transaction should be implemented in financial systems as soon as possible.