# Do DES keys have to be random?

In stream cipher (namely the OTP ) . The pad which the plain text is Xored with has to be random to achieve perfect secrecy , or psudorandom to ensure semantic security

Dose this apply to DES or block ciphers in general ?

Dose the randomness of the DES key effects the security ?

Well, if you are doing plain old single DES, it doesn't matter -- 56-bit DES keys can be easily brute forced. The EFF DES cracker could break a 56-bit DES key in under a day way back in 1999.

Generally, yes its best to have a totally random key for symmetric encryption (block ciphers) as there will be no shortcuts when brute-forcing the key.

In practice, using a key generated by a key-derivation-function that constructs a pseudo-random key from a strong user-chosen password may be perfectly strong, provided you use a strong password. However, the entropy of your pseudo-random derived key really will rest in how complicated the password is. If your password is found in a common list of passwords or has a low inherent complexity, a skilled attacker can quickly recover your key.

So if you want 100-bits of security, you should choose a password with about 100 bits of entropy -- e.g., 17 random characters from A-Z,a-z,0-9; or 15 random characters from all printable ASCII, or about 8 random words chosen a 5000 word dictionary. And say with AES-128 with a 100-bit password this will weaken the security from 2128 to 2100.

Randomness really is: what the attacker does not know. Therefore, encryption keys are precisely a thing where a lot of randomness is needed.

We usually talk of entropy in the following model:

• The key is generated with a process which involves computations (code) and random inputs (harvested from physical elements).
• The attacker is supposed to have perfect knowledge of the computations, but not of the random inputs.
• The attacker will try to recover the keys by trying the possible keys in optimal order, beginning with the most probable.

We say that the key has n bits of entropy if the attacker will hit the right one after, on average, 2n-1 tries. Note that an n-bit key, where all key bits are uniformly and independently random, achieves exactly n bits of entropy, which is the point of the notation.

A consequence is that you cannot have more than n bits of entropy in a key of n bits (so a DES key can never be stronger than 56 bits of entropy, which is too low for comfort as @drJimbob points out); but you can have much less. E.g., if the key generation process is about obtaining a random 32-bit integer, then hashing it with SHA-1 and keeping the first 56 bits of the output, then the entropy will be no more than 32 bits (an attacker could try all possible 32-bit values, hashing each of them: this will hit the right key with an average cost of at most 231).

In general, you use symmetric encryption systems with n-bit keys (e.g. n = 128 for AES) and you want to get your money worth, i.e. n-bit entropy. This is the very reason why you use 128-bit keys: to make room for enough entropy to defeat all Earth-based attackers. Sometimes you accept to use less entropy because your source for the key is a piece of data which cannot be grown arbitrarily: in particular when keys are derived from passwords. Passwords fail to achieve high entropy because human minds are not good at remembering highly entropic passwords (and they are abysmally bad at generating random passwords).

When you process a data element through a deterministic key derivation function, you never increase the entropy, since, by definition of our attack model, the attacker could run the same deterministic key derivation function. You could, though, lower the entropy, if you do it carelessly. Cryptographically strong KDF don't lower the entropy below the limit implied by the key size (a 56-bit key can never contain more than 56 bits of entropy).