Editing Data Encryption Standard (section)

=== The Feistel (F) function ===
The F-function, depicted in Figure 2, operates on half a block (32 bits) at a time and consists of four stages:
<imagemap>
File:Data_Encription_Standard_Flow_Diagram.svg|thumb|250px|''[[:File:DES-f-function.png|Figure 2]]''—The Feistel function (F-function) of DES
rect 10 88 322 170 [[DES supplementary material#Expansion function (E)|Expansion function]]
rect 9 340 77 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 1]]
rect 89 340 157 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 2]]
rect 169 340 237 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 3]]
rect 247 340 315 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 4]]
rect 327 340 395 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 5]]
rect 405 340 473 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 6]]
rect 485 340 553 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 7]]
rect 565 340 633 395 [[DES supplementary material#Substitution boxes (S-boxes)|Substitution box 8]]
rect 9 482 630 565 [[DES supplementary material#Permutation (P)|Permutation]]
circle 319 232 21 [[Exclusive or|XOR]]
</imagemap>
# ''Expansion'': the 32-bit half-block is expanded to 48 bits using the ''expansion permutation'', denoted ''E'' in the diagram, by duplicating half of the bits. The output consists of eight 6-bit (8 × 6 = 48 bits) pieces, each containing a copy of 4 corresponding input bits, plus a copy of the immediately adjacent bit from each of the input pieces to either side.
# ''Key mixing'': the result is combined with a ''subkey'' using an XOR operation. Sixteen 48-bit subkeys—one for each round—are derived from the main key using the ''[[key schedule]]'' (described below).
# ''Substitution'': after mixing in the subkey, the block is divided into eight 6-bit pieces before processing by the ''[[Substitution box|S-boxes]]'', or ''substitution boxes''. Each of the eight S-boxes replaces its six input bits with four output bits according to a non-linear transformation, provided in the form of a [[lookup table]]. The S-boxes provide the core of the security of DES—without them, the cipher would be linear, and trivially breakable.
# ''Permutation'': finally, the 32 outputs from the S-boxes are rearranged according to a fixed [[permutation]], the ''P-box''. This is designed so that, after permutation, the bits from the output of each S-box in this round are spread across four different S-boxes in the next round.

The alternation of substitution from the S-boxes, and permutation of bits from the P-box and E-expansion provides so-called "[[confusion and diffusion]]" respectively, a concept identified by [[Claude Shannon]] in the 1940s as a necessary condition for a secure yet practical cipher.