DES is not a Group. - Keith W. Campbell; Michael J. Wiener (CRYPTO, 1992)