What is the output of the first round of the DES algorithm when the plaintext and the key are both all zeroes? Remember that it is desirable for good block ciphers that a change in one input bit affects many output bits, a property that is called diffusion or the avalanche effect. We try now to get a feeling for the avalanche property of DES. We apply an input word that has a "1" at bit position 57 and all other bits as well as the key are zero. (Note that the input word has to run through the initial permutation.) a. How many S-boxes get different inputs compared to the case when an all-zero plaintext is provided? b. What is the minimum number of output bits of the S-boxes that will change according to the S-box design criteria? c. What is the output after the first round? d. How many output bit after the first round have actually changed compared to the case when the plaintext is all zero? (Observe that we only consider a single round here. There will be more and more output differences after every new round. Hence the term avalanche effect.) Assume we perform a known plaintext attack against DES with one pair of plaintext and ciphertext. How many keys do we have to test in a worst-case scenario if we apply an exhaustive key search in a straightforward way? How many on average? b. One important property which makes DES secure is that the S-boxes are nonlinear. In this problem we verify this property by computing the output of S_1 for the input pairs x_1 = 111111 and x_2 = 000001