in any good basic cryptography book, such as Schneier's book. Some DES keys are known to produce only four subkeys. Each subkey is used only four times in a DES run (16 rounds). They are not as weak as the semi-weak keys, but they are not as strong as typ- ical keys; hence, they are possibly weak keys. A lot of cryptanalysis has been done on the safety of using complement keys (replacing 1s with Os and Os with 1s) and determining what can occur if plaintext is encrypted with a key and subsequently with its complement. Under these conditions, specific relationships can be identified between ciphertext and its logical complement. This can lead to specific types of attacks. It is recommended that the use of complement keys be avoided. A sophisticated security coprocessor that uses internal random number sources to generate sym- metric keys must have the ability to verify whether the random bit sequences that it generates satisfy any of these unfortunate and dangerous profiles. If they pass the test, they can be used and are formally issued and transmitted to the other party. If they fail, the RNG must be consulted again for a new random bit sequence. As the number of weak keys is usually not large, it just takes a small lookup table (such as in the case of DES with 64 entries with 64 bits in each slot) and a small checkup routine. For complement keys, the system should keep a copy of all previously generated keys in a buffer and check if any new generated key during the session happens to be the complement of a previous one. Incidentally, this is obviously not a requirement when the same symmetric key is used through- out a session (in other words, when no rekeying occurs). The cost of implementing this kind of verification is negligible, but the cost of loss due to an attack can be significant if it is not implemented. It is surprising how many DES-encrypting systems in the market do not check for weakness when they produce a new key. Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineering