[ Last changed: 17th October 1996 ]
The expansion permutation in DES duplicates two bits between each neighbouring pair of S-boxes. Before they enter the S-boxes, bits of key are added to them (mod 2 by bit). The difference between plain and cipher is a sum of 8 outputs of S-boxes and can reveal key information.
This attack can give 16 bits of key information but it takes a lot of samples for a reliable result. There could just possibly be applications where it mattered.