The paper "A Fast New DES Implementation in Software" calculated 64-parallel DES Round across a 64-bit register in 1,040 DEC Alpha instructions. There are 16 rounds per DES, and then another 2,500 clock ticks to convert the bitwise representation back into normal form.

The key to understanding things:

> The full circuit of DES contains about 16000 gates (including the key scheduling, which costs nothing), and thus we can compute DES 64 times in about 16000 instructions on 64-bit processors.

Each logic-gate can be seen as an AND/OR/XOR instruction on a 1-bit computer. Use 64-bit wide AND/OR/XOR to do 64x calculations in parallel. The modern equivalent would be 256x in parallel (AVX2 for Threadripper), AVX512 for Skylake-X, and 1024x in parallel for NVidia Ampere.

I dunno what kind of post-processing would need to be done, so I'll estimate an even 20,000 clock ticks per 64x DES result on the old DEC Alpha.

A modern GPU can probably execute 1024-bit per clock tick (AMD RDNA / NVidia Ampere 32-way x 32-bit), while a modern AVX512 CPU can execute 512-bit at a time. And AVX2 is 256-bit at a time (but probably faster: AVX2 / AVX512 execute XOR / ADDs at a rate of MORE than one clock tick per clock cycle).

The paper was very innovative: the SBox was a 100-instruction long sequence of AND / OR / XOR instructions. Avoiding the cache probably is a good thing, but I do wonder if there's a way to benefit from memory somehow.

* ~80 AVX2 clock ticks per result (20k clock ticks / 256-bits)

* ~40 AVX512 clock ticks per result (20k clocks / 512 bits)

* ~20 GPU clock ticks per result (20k clocks / 1024 bits)

So a 64-core AMD at 4GHz probably could do ~3.2-billion DES attempts per second.

A 216 SM NVidia A100 at 1.4 GHz probably can do ~15-billion DES attempts per second.

---------------

Hmmmmmm.... the results this page claims is ~16-billion DES attempts per second. Which does seem to be approximately what I'd expect a concerted effort on an NVidia A100 would get. I'm doing very "napkin-level" math here with tons of assumptions.

The SBox-lookup (100-AND/OR/XOR gates) might be better run on AVX / AVX512 however, because AMD Threadripper can do 4x simple AND/OR/XOR instructions per clock tick, and IIRC Intel AVX512 can do 3x simple bitwise instructions per clock tick. With the proper "cut dependencies", an SBox probably can be really executed in under 40 clock ticks instead of 100. CPUs could very well cut out hundreds of cycles from the above estimate.

The S-Box is very curious for DES: it is a non-reversible 6-bit lookup with a 4-bit result.