Editing Lucifer (cipher) (section)

== Overview ==

Lucifer uses a combination of transposition and substitution crypting as a starting point in decoding ciphers.{{clarify|date=October 2018}} One variant, described by Feistel in 1971,<ref>Horst Feistel. Block Cipher Cryptographic System, US Patent 3,798,359. Filed June 30, 1971. (IBM)</ref> uses a 48-bit [[cryptographic key|key]] and operates on 48-bit blocks.  The cipher is a [[substitution–permutation network]] and uses two 4-bit [[S-box]]es.  The key selects which S-boxes are used. The patent describes the execution of the cipher operating on 24&nbsp;bits at a time, and also a sequential version operating on 8&nbsp;bits at a time. Another variant by John L. Smith from the same year<ref>John Lynn Smith. Recirculating Block Cipher Cryptographic System, US Patent 3,796,830. Filed Nov 2, 1971. (IBM)</ref> uses a 64-bit key operating on a 32-bit block, using one addition mod 4 and a singular 4-bit S-box.  The construction is designed to operate on 4 bits per clock cycle. This may be one of the smallest block-cipher implementations known. 
Feistel later described a stronger variant that uses a 128-bit key and operates on 128-bit blocks.<ref>Horst Feistel, (1973). Cryptography and Computer Privacy". ''Scientific American'',  '''228'''(5), May 1973, pp 15&ndash;23.</ref>

{{harvtxt|Sorkin|1984}} described a later Lucifer as a 16-round [[Feistel network]], also on 128-bit blocks and 128-bit keys.<ref>{{cite journal |first=Arthur |last=Sorkin |date=1984 |title=Lucifer: a cryptographic algorithm |journal=Cryptologia |volume=8 |number=1 |pages=22–35 |doi=10.1080/0161-118491858746}}</ref> This version is susceptible to [[differential cryptanalysis]]; for about half the keys, the cipher can be broken with 2<sup>36</sup> [[chosen plaintext]]s and 2<sup>36</sup> time complexity.<ref>Ishai Ben-Aroya, Eli Biham (1996). Differential Cryptanalysis of Lucifer. ''Journal of Cryptology'' '''9'''(1), pp.&nbsp;21&ndash;34, 1996.</ref>

IBM submitted the Feistel-network version of Lucifer as a candidate for the [[Data Encryption Standard]] (compare the more recent [[Advanced Encryption Standard process|AES process]]).  It became the DES after the [[National Security Agency]] reduced the cipher's key size to 56 bits, reduced the block size to 64 bits, and made the cipher resistant against [[differential cryptanalysis]], which was at the time known only to IBM and the NSA.

The name "Lucifer" was apparently a pun on "Demon". This was in turn a truncation of "Demonstration", the name for a privacy system Feistel was working on. The operating system used [[Filename#Length_restrictions|could not handle the longer name]].<ref>{{citation|title=Computer Security and Cryptography|first=Alan G.|last=Konheim|publisher=John Wiley & Sons|year=2007|isbn=9780470083970|url=https://books.google.com/books?id=YgT74UPmOk4C&pg=PA283|page=283}}.</ref>