# Tag Info

## Hot answers tagged feistel-network

9

DES actually demonstrated that a Feistel structure was not a guarantee against attacks. In "academic" terms, DES is broken by both differential and linear cryptanalysis, because they require, respectively, $2^{47}$ chosen plaintexts and $2^{43}$ known plaintexts, whereas the DES key is (effectively) 56 bits. Of course, for practical attacks, we would brute ...

7

If such a network had only a single round, then you might have a valid concern. This is why there needs to be least three rounds, so that every bit from L can potentially affect every other bit from L (via R from the second round). It isn't a structural flaw, because multiple rounds are assumed. Changing this round structure would mean that it was no longer ...

7

No, this is not a structural weakness of Feistel networks. For instance, we know it can't hurt diffusion properties. Actually, we know that it's not a structural weakness. How do we know that? Because we have a proof of security for Feistel networks (under certain conditions and assumptions). Those proofs imply that there is not a structural weakness in ...

6

Well, AES is not a Feistel cipher because it's a substitution-permutation network instead. If I were taking a test that asked me why AES was not a Feistel cipher, this would be my argument: namely, that the structure of substitution-permutation networks is fundamentally different from that of Feistel networks. (Here one could elaborate on invertibility and ...

4

The simple way to build authenticated encryption using a Feistel Network is to build a Feistel based block cipher, then use one of the many modes of operation that turn a block cipher into an authenticated encryption scheme (eg CCM,OCB,GCM). For a good survey on the subject of modes-of-operation I would recommend this paper by Rogaway. It does not cover the ...

4

A family of functions F is a pairwise independent permutation if: Each member of the family is itself a permutation, and For any fixed $A$, $B$ (with $A \ne B$, and both from the input set of the permutation), and $f$ is a random member from the family $F$, then the pair $f(A), f(B)$ is equidistributed over all distinct pairs from the output range of the ...

3

The text quoted in the question: States that in any (finite commutative) field $(A,+,\cdot)$, the distribution of the permutations $f_{(a,b)}$ defined by $f_{(a,b)}(x)=a\cdot x+b$, where $(a,b)$ is uniformly distributed on $A^*\times A$, is pair-wise independent, per the definition now given in the question. Observes that because $GF(2^n)$ is such a field, ...

3

Yes. This is called format-preserving encryption. The most flexible algorithm is FFX, which uses a Feistel network with AES-based round-functions, but performs addition modulo $m$. For certain values of $m$, the range of the round function is extended in order to limit statistical biases to negligible values. When $m$ is very small, this approach isn't ...

3

By definition, a Feistel network uses a series of rounds that split the input block into two sides, uses one side to permute the other side, then swaps the sides. As always, Wikipedia has a nice diagram. AES doesn't do this. Performing a round necessarily permutes the entire state. Each round consists of the SubBytes, ShiftRows, MixColumns, and AddRoundKey ...

2

Yes, you certainly can. If you want a variable-length authenticated encryption mode, then simply take any Feistel cipher in the OCB mode. If fixed-length is fine, then the following idea should work. Build a wide Feistel-based permutation (fixed-key blockcipher) $G$ and encrypt $$C = G(P||N||K)\oplus K,$$ where $N$ is nonce, $P$ is plaintext, $C$ is ...

2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...

1

The standard way to make best advantage of parallelism is to use a parallelizable mode of operation. For instance, counter mode (CTR mode) is highly parallelizable. Parallelism at the level of the mode of operation is typically more effective and easier to implement than parallelism inside the block cipher. The Feistel network approach to block ciphers is ...

1

Ff1,2,3 are basically inspired by LubyRack off constructions . At the core they differ in their round functions and key scheduling FF1 supports greater range of lengths and a tweak FF2 generates subkey for each iteration to thwart any side channel attacks FF3 has tweaks is split and used in rounding function, also the reverse the sub-strings of given ...

1

Luby rackoff results are based on assuming the Round Function to be Secure Pseudo Random Functions. Where as the round functions of DES are not that secure enough which needs more rounds (Triple DES needs 48 rounds )

1

As a page at ibm.com indicates, there could have been a bit of a "contra" attitude against Feistel ciphers thanks to DES having seen the first breaks in it's security etc. Down with the Feistel structure! In most ciphers, the round transformation has the well-known Feistel structure. In this structure typically part of the bits of the intermediate ...

1

A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are talking about not specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes. ...

Only top voted, non community-wiki answers of a minimum length are eligible