# Tag Info

5

The simple answer is that fewer than 3 rounds can be easily distinguished from a random permutation. The 2-round Luby-Rackoff cipher on $2n$ bits, using random functions $f_i$ mapping $n$ bits to $n$ bits, consists of $$F(L, R) = (A, B),$$ where $A = L \oplus f_1(R)$ and $B = R \oplus f_2(L \oplus f_1(R))$. Now consider an attacker that wants to ...

5

If a message is longer than the block length, how would changing one part of the message affect the encryption of other parts of the message? That really doesn't depend on the block cipher in use, which may be a feistel cipher like DES or a SP network like AES, but on the mode of operation. Now the answer to this really depends on the actual mode ...

3

It depends on the block cipher in question - specifically its key schedule. Knowing any round key of AES-128 would let you calculate the key, because the schedule is reversible. OTOH, e.g. TEA would retain secrecy of most of the key and might remain secure, because its round keys are small enough parts of the key. In the case of DES, it is weak enough to be ...

3

In a Feistel networks (from the German IBM cryptographer Horst Feistel), the input is divided into two blocks ($L_0$ and $R_0$) which interact with each other. Main example is DES. basic construction: In a SPN (Substitution Permutation Network), the input is divided into multiple small blocks, applied to a S-box (substitution), then the bits positions ...

3

It's required for diffusion and achieving the avalanche effect. The concept of diffusion and the avalanche effect basically means that each input bit should influence each output bit evenly. Changing one input bit should flip, on average, half the output bits. Due to the nature of the Feistel construction, how it is split up into halves, only one side ...

2

About the security of your first variation, it is sort of answered here. This is your 1st variation. This is your 2nd variation (your $8 \times 8$ matrix idea is equivalent to apply a permutation). In your first variation, the application of the matrix is useless, one can consider the $S1$ (or $S2$) and the matrix as a single S-box. Hence you have no ...

1

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as asked) a secure mini SPN or even a hash function (Sha3...) it doubles the block size, so the number of rounds can be doubled at no perf cost If you meant ...

Only top voted, non community-wiki answers of a minimum length are eligible