This story is <i>kind of</i> true, but is missing some detail. The first differential attack on DES broke up to 15 rounds, that is correct [1]. 2 years later, however, the same team broke the full 16 rounds, albeit with a hefty amount of chosen plaintexts [2]. Coppersmith disclosed the DES design choices a year after that, showing that the S-boxes had been changed to increase resistance to differential attacks, in 1994 [3]. Additionally, Matsui&#x27;s linear cryptanalysis of DES didn&#x27;t seem to have been taken into account and also broke through the full DES [4].<p>Another interesting anecdote is the tale of Skipjack, which unlike DES was an entirely NSA-designed block cipher. After it was disclosed in 1998, an impossible differential attack broke exactly 31 out of 32 rounds, and I believe that is still the best known result today [5].<p>[1] <a href="http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-38424-3_1" rel="nofollow">http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-38424-3_1</a><p>[2] <a href="http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-48071-4_34" rel="nofollow">http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-48071-4_34</a><p>[3] <a href="http:&#x2F;&#x2F;simson.net&#x2F;ref&#x2F;1994&#x2F;coppersmith94.pdf" rel="nofollow">http:&#x2F;&#x2F;simson.net&#x2F;ref&#x2F;1994&#x2F;coppersmith94.pdf</a><p>[4] <a href="http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-48285-7_33" rel="nofollow">http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-48285-7_33</a><p>[5] <a href="http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-48910-X_2" rel="nofollow">http:&#x2F;&#x2F;link.springer.com&#x2F;chapter&#x2F;10.1007%2F3-540-48910-X_2</a>