Introduction
Simplified
DES is an algorithm explained in Section 4.2 of [4],
is an algorithm that has many features of the DES, but is much simpler then DES. Like DES, this
algorithm is also a bock cipher.
Block
Size: In Simplified DES, encryption/decryption is done on blocks of
12 bits. The plaintext/ciphertext is divided into blocks of 12 bits and the
algorithm is applied to each block.
Key:
 The key has 9 bits. The key, K_{i}, for the i^{th}
round of encryption is obtained by using 8 bits of K, starting with
the i^{th} bit.
Example: If K = 111000111
Then K_{1} = 11100011 and K_{3} =
10001111 and K_{10} = K_{1} = 11100011
Algorithm:
The block of 12 bits is written in the form L_{0}R_{0},
where L_{0} consists of the first 6 bits and R_{0}
consists of the last 6 bits. The i^{th} round of the algorithm
transforms an input L_{i1}R_{i1} to the
output L_{i}R_{i} using an 8bit K_{i}
derived from K.
One
Round of a Feistel System
The
output for the i^{th} round is found as follows.
L_{i} = R_{i1} and R_{i}
= L_{i1} Å
f (R_{i1}, K_{i})
This
operation is performed for a certain number of rounds, say n,
and produces L_{n}R_{n}. The ciphertext will
be R_{n}L_{n}. Encryption and decryption are
done the same way except the keys are selected in the reverse order. The
keys for encryption will be K_{1}_{},
K_{2} …… K_{n} and for decryption will
be K_{n}, K_{n1} …… K_{1}.
Function
f(R_{i1},K_{i}):  The function f(R_{i1},K_{i}),
depicted in the Figure below, is described in following steps.
The
Function f (R_{i1}, Ki)

The
6bits are expanded using the following expansion function. The
expansion function takes 6bit input and produces an 8bit output.
This output is the input for the two Sboxes
The
Expansion Function, E(R_{i1})

The
8bit output from the previous step is ExclusiveORed with the key K_{i}

The
8bit output is divided into two blocks. The first block consists of
the first 4 bits and the last four bits make the second block. The
first block is the input for the first Sbox (S1) and the second block
is the input for the second Sbox (S2).

The
Sboxes take 4 bits as input and produce 3bits of output.
The first bit of the input is used to select the row from the
Sbox, 0 for the first row and 1 for the second row. The last 3 bits
are used to select the column.
Example:
Let the output from the expander function be 11010010.
So
1101 will be the input for the S1 box and 0010 will be the input
for the S2 box. The output
from the S1 box will be 111, the first of the input is 1 so select the
second row and 101 will
select the 6^{th} column. Similarly the output from the S2 box
will be 110.

The
output from the Sboxes is combined to form a single block of
6 bits. These 6 bits will be the output of the function f(R_{i1},K_{i}).
In
our example we have the S1 output 111 and S2 output 110.
So the output for the function f(R_{i1},K_{i})
will be 111110, the S1 output followed by the S2 output.
The
S1 and S2 boxes are shown below.
S1Box
101

010

001

110

011

100

111

000

001

100

110

010

000

111

101

011

S2Box
100

000

110

101

111

001

011

010

101

011

000

111

110

010

001

100

Example
The
example is explained for two rounds.
Let
Input message be 100010110101 and the key be 111000111.
Encryption
Round
1 (i = 0)

L_{0}=
100010 and R_{0}= 110101; K_{1 }=
11100011.

E(R_{0})
= 11101001.

E(R_{0})_{
} Å
K_{1 } =
11101001 Å
11100011 = 00001010.

S1(0000)
= 101, S2(1010) = 000, è
f(R_{0},K_{1}) = 101000

f(R_{0},K_{1})
Å
L_{0 }= 101000 Å
100010 = 001010.

Now
using the formulas L_{i} = R_{i1} and R_{i}
= L_{i1} Å
f (R_{i1}, K_{i})
we
get L_{1 }= 110101 and R_{1 }= 001010.
Round
2 (i = 1)

L_{1
}= 110101 and R_{1 }= 001010; K_{2 }=
11000111.

E(R_{1})
= 00010110.

E(R_{1})_{
} Å
K_{1 } =
00010110 Å
11000111= 11010001.

S1(1101)
= 111; S2(0001) = 000; è
f(R_{1},K_{2}) = 111000

f(R_{1},K_{2})
Å
L_{1 }= 111000 Å
110101 = 001101.

Now
using the formulas L_{i} = R_{i1} and R_{i}
= L_{i1} Å
f (R_{i1}, K_{i})
we
get L_{2 }= 001010 and R_{2 }= 001101.
So
encrypted message, R_{2} L_{2} =
001101001010
Decryption
Round 1(i = 0)

L_{0}=
001101 and R_{0}= 001010; K_{2 }=
11000111.

E(R_{0})
= 00010110.

E(R_{0})_{
} Å
K_{1 } =
00010110 Å
11000101 = 11010001.

S1(1101)
= 121; S2(0001) = 000; è
f(R_{0},K_{2}) = 111000

f(R_{0},K_{2})
Å
L_{0 }= 111000 Å
001101 = 110101.

Now
using the formulas L_{i} = R_{i1} and R_{i}
= L_{i1} Å
f (R_{i1}, K_{n}_{i})
we
get L_{1 }= 001010 and R_{1 }= 111000.
Round
2 (i = 1)

L_{1
}= 001010 and R_{1 }= 111000; K_{1 }=
11100011.

E(R_{1})
= 00010110.

E(R_{1})_{
} Å
K_{1 } =
11101001 Å
11100011= 00001010.

S1(0000)
= 101; S2(1010) = 000; è
f(R_{1},K_{1}) = 101000

f(R_{1},K_{1})
Å
L_{1 }= 101000 Å
001010 = 100010.

Now
using the formulas L_{i} = R_{i1} and R_{i}
= L_{i1} Å
f (R_{i1}, K_{ni})
we
get L_{2 }= 110101 and R_{2 }= 100010.
So
decrypted message, R_{2} L_{2}
=100010110101, which is the original plaintext message.
