Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality .

Can we build authenticated encryption using Feistel Networks ?

share|improve this question
One useful rule of thumb in cryptography is that even the meanest primitive can be used to build virtually everything. For example, you can take a PRG and build a PRF and PRP from that, and so on: pretty much, once you have a one-way function of some kind, you can build almost everything in symmetric cryptography. This is a pretty neat result, actually, since it boils down the whole of secure symmetric cryptography to the existence of one-way functions. – Reid Nov 18 '13 at 17:30
up vote 4 down vote accepted

The simple way to build authenticated encryption using a Feistel Network is to build a Feistel based block cipher, then use one of the many modes of operation that turn a block cipher into an authenticated encryption scheme (eg CCM,OCB,GCM).

For a good survey on the subject of modes-of-operation I would recommend this paper by Rogaway. It does not cover the very most recent designs (such as those discussed at DIAC'13) but covers the more accepted methods in a reasonable amount of detail.

share|improve this answer
@pg1989 - Thanks for the edit, didn't realise I'd put the wrong link up. – figlesquidge Nov 18 '13 at 17:18

Yes, you certainly can. If you want a variable-length authenticated encryption mode, then simply take any Feistel cipher in the OCB mode. If fixed-length is fine, then the following idea should work. Build a wide Feistel-based permutation (fixed-key blockcipher) $G$ and encrypt $$ C = G(P||N||K)\oplus K, $$ where $N$ is nonce, $P$ is plaintext, $C$ is ciphertext, $K$ is key.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.