Questions tagged [feistel-network]
A feistel-network or feistel cipher is a structure that has been used to create a number of different block ciphers (e.g., DES, Blowfish, Twofish, RC6).
35
questions
12
votes
1
answer
7k
views
Luby-Rackoff theorem confusion
The Luby-Rackoff theorem states that if a round function is a secure pseudorandom function (PRF)
then 3 rounds are sufficient to make the block cipher a pseudorandom permutation (PRP).
PRPs are ...
- 736
14
votes
1
answer
5k
views
Are there any specific requirements for the function $F$ in a Feistel cipher?
In a Feistel cipher (as shown below), it seems that the security of the cipher would be entirely dependent upon the function $F$. What requirements on $F$ are necessary for a secure Feistel cipher? Is ...
- 38.6k
5
votes
1
answer
1k
views
Increase number of rounds for SPN and Feistel ciphers
Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
- 63
18
votes
1
answer
2k
views
Does unbalancing a feistel cipher always improve security? Does it improve security at all?
So according to Wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state:
The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
user46
8
votes
2
answers
2k
views
Need for 3 rounds in Luby Rackoff theorem
I get that using Feistel network we can create a secure PRP from a secure PRF (in 3 rounds according to theorem).
My question is why not just 2 rounds of Feistel network is sufficient. Is it that ...
- 195
8
votes
2
answers
997
views
How to find fixed points for DES weak keys
Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that:
each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
- 869
8
votes
3
answers
535
views
DES f function injective for no fixed subkey?
Let $f$ be the function used in a round of DES, as defined in FIPS 46-3:
$$\begin{align}
f:\{0,1\}^{32}\times\{0,1\}^{48}&\to\ \{0,1\}^{32}\\
(R,K)\ &\mapsto f(R,K)\underset{\mathsf{def}}=...
- 141k
4
votes
2
answers
923
views
Why is a Feistel Network invertible?
As it is depicted above, the Feistel Network uses random function fi which is not required to be invertible. However, if fi is not invertible, how can fi(Li) == fi(Ri-1)? Furthermore, why Feistel ...
- 61
2
votes
1
answer
7k
views
Exercise: Attack on a Two-Round DES Cipher
Working through the exercises in Cryptography Engineering (Schneier, Ferguson & Kohno) I have stalled on the following exercise:
Consider a new block cipher, DES2, that consists only of two ...
- 193
17
votes
3
answers
21k
views
Why is AES not a Feistel cipher?
I am studying for an exam right now. And I wanted to make sure I got this point correct.
AES is not a Feistel cipher because the operations in AES are not invertible.
Is the above statement correct?...
- 273
15
votes
3
answers
4k
views
Why do Feistel ciphers need round keys?
Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
- 2,389
10
votes
2
answers
4k
views
What is an active S-Box?
I don't understand what an active s-box is (in reference of design criteria 8 of the DES).
Because according to DES, all 8 s-boxes are used every round. But this is not what active means.
So my ...
- 101
8
votes
2
answers
2k
views
What is the definition of Feistel Cipher?
I know how Feistel Network works, but I want to know the exact definition of "Feistel Cipher" to solve several questions below:
question 1: Is it correct to say DES (Data Encryption Standard) is ...
- 477
8
votes
1
answer
430
views
Big block cipher as memory-hard function
I'm wondering, if something like block cipher with big block size is a good memory-hard function?
All memory-hard key derivation functions I've seen look more complex than that, which made me ...
- 1,649
6
votes
1
answer
329
views
On CPA & KPA security of $\boxplus$-Feistel
I am interested to identify the effect of replacing $\oplus$ with $\boxplus$ on basic balanced Feistel structures over $r$-rounds. Given:
$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$ where $f$ is a ...
- 2,126
6
votes
1
answer
498
views
Low complexity implementation of a small blocksize cipher (< 64 bit)
Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE.
This one in particular suggests using AES as the round function of a Feistel network.
The ...
6
votes
1
answer
1k
views
Differential cryptanalysis - breaking the last round of FEAL4?
I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful:
http://theamazingking.com/crypto-feal.php
So far I've been almost successful in breaking FEAL4 ...
- 7,488
6
votes
2
answers
7k
views
What is the diffrence between Feistel networks and SPN?
I recently read about the concept of Feistel Networks and Substitution Permutation Networks but what is exactly the difference between the two ?
- 581
5
votes
3
answers
2k
views
What are the requirements from a Round function in Feistel network?
Let's assume a balanced network with many (dozens?) rounds. And a simple (selecting key bits) key schedule.
What does it take from the round F function to make a secure block cipher? obviously we ...
- 11.8k
5
votes
2
answers
1k
views
Feistel-Network - why wire crossing?
In Feistel-Network, there would be a wire-crossing at the end (for the next round). Which insufficiency would occur, if the wire crossing would be omitted?
- 159
5
votes
2
answers
2k
views
Is this a structural weakness of Feistel networks?
I'm doing a lot of reading about Feistel networks. Something occurred to me a bit ago that I hadn't realized previously, namely that in any Feistel construction there are bits of the plaintext that ...
- 4,636
4
votes
2
answers
2k
views
Disadvantages of the Feistel network
I have read about Feistel network and so far only advantages have been listed. Are there any disadvantages to the design? Please could you explain in fairly basic terms?
- 415
4
votes
1
answer
477
views
PRP vs PRF for the F-function of a Feistel network
A Feistel network is generally defined with a PRF for its F-function, but PRPs have been used as well. What are the theoretical cryptographic implications of using a PRP instead of a PRF? Does it ...
- 15.3k
4
votes
1
answer
900
views
In a Feistel cipher structure, what exactly does the "round function $F$" do?
In a Feistel cipher structure, what exactly does the "round function $F$" do to the right half of the data, before taking XOR of the output with the left half of the data?
- 41
3
votes
4
answers
3k
views
feistel cipher and number of rounds
In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same?
in cryptography and network security by ...
3
votes
1
answer
1k
views
Understanding Meet-in-the-Middle attack on block ciphers
I understand how to implement a Meet-in-the-Middle attack on 2DES/3DES, by computing for one half all possible keys and storing the outcome and then subsequently do the same for the other half but ...
- 33
3
votes
1
answer
4k
views
Is 3 rounds of Feistel enough for making a PRP?
I know that one round of Feistel is not enough for making a PRP (Pseudo Random Permutation). I am also aware that two rounds are not enough. How about three rounds of Feistel?
I did a lot of reading ...
- 33
3
votes
1
answer
2k
views
Can the round function $F$ in a Feistel Network be practically any non-invertible function?
This question might seem silly, but how true is the fact that the round function $F$ does not have to be invertible?
I am curious to know this, because non-invertible functions can be very lossy, i.e....
user17887
2
votes
1
answer
822
views
2-round generalized Feistel network
Write the decryption of a 2-round generalized Feistel network given below.
$P_i$ denotes plaintext blocks of each 32-bits.
$RK_i$ denotes the round keys.
$WK_i$ denotes 32-bit keys applied ...
- 21
2
votes
1
answer
288
views
Using AES for smaller blocks in a Feistel network
I was wondering how decryption would work for FPE in the case of cycled Feistel ciphers. I understand that simply reiterating through the networks with reversed key order will generate the ciphertext ...
- 143
1
vote
1
answer
3k
views
Why does the DES crypto algorithm NOT use 2 rounds?
Now, if we were to go round by round, you could give a distinct reason for not using a single round since after just one round, the right half of the text comes directly, as-is, to form the left half ...
- 13
1
vote
1
answer
858
views
KPA on Feistel cipher?
I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping ...
- 11
1
vote
1
answer
192
views
DES F function never injective?
Now i know that the F function doesn't have to be injective, but is it NEVER injective? or is it possible to have an injective F function?
- 11
0
votes
2
answers
630
views
Is the DES F-function injective for a given subkey?
Is it possible for two different half-block inputs to the DES F-function, with the same round subkey, to produce the same output?
That is, if we feed two different half-block inputs $b_1$ and $b_2$ ...
-1
votes
2
answers
1k
views
What is the output of an r-round Feistel network
What is the output of an r-round Feistel network when the input is (L0, R0) if Each round function is the identity function.
- 29