
After IBM had invented the DES and the NBS had advertised for proposals,
but before IBM had decided to respond, I argued strenuously that they 
should not; they should keep it proprietary. 

The biggest proponent of proposing was Dr. Lewis Branscomb.  Dr. Branscomb
was the IBM Chief Scientist and had come to IBM from NBS.  Fortunately
for all of us, Dr. Branscomb understood the answer to the above question
much better than I.  He realized how difficult it would be to gain
acceptance for any cryptographic mechanism.  Because of the necessary
complexity, publicity would not be sufficient and neither would 
authority.  In fact, it has taken both of those plus more than 15 
years.

We have also had independence.  The DES was solicited by NBS, invented
and proposed by IBM, and vetted by NBS.  It has also been examined and
vetted by experts like Adi Shamir, who are not subject to influence by
any of these.

Even now, there are still people posting on this list who do not trust
the DES in spite of all the time, all of the analysis, and all of the
public scrutiny.

(Of course, it is just this point that NIST misses when it attempts to 
gain acceptance for a novel mechanism, developed in secret, on the basis
of authority alone.)

We had a long thread here about whether or not the NSA can "break" the
DES.  That is a silly question.  At some cost and in some time they
can "break" anything.  The important question is at what cost and in
what time.

The fundamental strength of the DES and RSA are not nearly so important
as what we know about their strength.  As long as we understand the
cost and duration for an attacker, then we can use them in a safe way.
At this point, we may never replace either because of the inability of
any successor to overcome this knowledge gap.

DES and RSA are among the most significant inventions of the century
and the most important inventions in the history of cryptography.
We are damned lucky to have them.