I im taking cryptography classes and learned that the key size of DES is 64 bits. So if the key is array of Alphabetic char, and 1 char takes 8 bits then 64/8 = 8 . So the key can be only 8 char long maximum. Example : aaaaaaaa or acacacac

But when i used openssl to encrypt data using DES it accepts keys more then 8 char long.

root@io:~# openssl enc -des -in data -out data.enc
enter des-cbc encryption password: aseaxsasceaceasxaeaxsaceac
Verifying - enter des-cbc encryption password:aseaxsasceaceasxaeaxsaceac
root@io:~# openssl enc -d -des -in data.enc -out data.plain
enter des-cbc decryption password:aseaxsasceaceasxaeaxsaceac

And it accepts even more long keys then i posted here.

1) So my question is what does key size (64 bit) in DES means what point im missing . And
2)If key can be just 64 bit long really then how much time does it takes to crack a 64 bit key if plain text and cipher text is known

  • Hi, please check with Cryptography Stack Exchange for this question. If you can't find the answer there, please post your question there. crypto.stackexchange.com
    – one
    Nov 7, 2016 at 8:09
  • 2
    I think you need to read the manual for openssl. The password is not the key. The key is derived from the password.
    – schroeder
    Nov 7, 2016 at 8:14
  • seems like i dont have patience and got an answer from the irc
    – Danny Rock
    Nov 7, 2016 at 8:40

1 Answer 1


First, just to get this out of the way: the key size of DES is not 64 bits in any meaningful sense; only 56 bits are actually used in the encryption or decryption (see Wikipedia). The other 8 bits are for parity (error checking). In practice, they are usually ignored.

The openssl utility's enc operation (or, simply, the enc command itself) expects a passphrase, not a key (unless you use the -K option). The passphrase is turned into a key (of the appropriate length) using a key derivation function. This happens internally; you the user don't really control the process.

Breaking DES is actually pretty easy, due to its 56-bit key length being short enough to brute-force search (trying every key until one works). Modern personal computers will still take months (possibly only weeks for the fastest) in a typical-case scenario. However, dedicated hardware designed for the purpose, or a distributed network of computers, can break a DES key in under a day. Bear in mind that those machines are now a few years old, and Moore's Law is extremely applicable to this kind of brute-force operation; what took tens of thousands of dollars and a day of work eight years ago would today take under a thousand dollars to build, or only a few hours per key.

  • The password mechanism is EVP_BytesToKey with a single iteration of a hash function. Brute-forcing the password would probably be easier (although a 64 bit salt makes rainbow table attacks infeasible). Nov 9, 2016 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.