Tag Info

Hot answers tagged

9

DES actually demonstrated that a Feistel structure was not a guarantee against attacks. In "academic" terms, DES is broken by both differential and linear cryptanalysis, because they require, respectively, $2^{47}$ chosen plaintexts and $2^{43}$ known plaintexts, whereas the DES key is (effectively) 56 bits. Of course, for practical attacks, we would brute ...


7

If such a network had only a single round, then you might have a valid concern. This is why there needs to be least three rounds, so that every bit from L can potentially affect every other bit from L (via R from the second round). It isn't a structural flaw, because multiple rounds are assumed. Changing this round structure would mean that it was no longer ...


7

No, this is not a structural weakness of Feistel networks. For instance, we know it can't hurt diffusion properties. Actually, we know that it's not a structural weakness. How do we know that? Because we have a proof of security for Feistel networks (under certain conditions and assumptions). Those proofs imply that there is not a structural weakness in ...


6

Well, AES is not a Feistel cipher because it's a substitution-permutation network instead. If I were taking a test that asked me why AES was not a Feistel cipher, this would be my argument: namely, that the structure of substitution-permutation networks is fundamentally different from that of Feistel networks. (Here one could elaborate on invertibility and ...


4

The simple way to build authenticated encryption using a Feistel Network is to build a Feistel based block cipher, then use one of the many modes of operation that turn a block cipher into an authenticated encryption scheme (eg CCM,OCB,GCM). For a good survey on the subject of modes-of-operation I would recommend this paper by Rogaway. It does not cover the ...


3

By definition, a Feistel network uses a series of rounds that split the input block into two sides, uses one side to permute the other side, then swaps the sides. As always, Wikipedia has a nice diagram. AES doesn't do this. Performing a round necessarily permutes the entire state. Each round consists of the SubBytes, ShiftRows, MixColumns, and AddRoundKey ...


2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...


2

Yes, you certainly can. If you want a variable-length authenticated encryption mode, then simply take any Feistel cipher in the OCB mode. If fixed-length is fine, then the following idea should work. Build a wide Feistel-based permutation (fixed-key blockcipher) $G$ and encrypt $$ C = G(P||N||K)\oplus K, $$ where $N$ is nonce, $P$ is plaintext, $C$ is ...


1

Ff1,2,3 are basically inspired by LubyRack off constructions . At the core they differ in their round functions and key scheduling FF1 supports greater range of lengths and a tweak FF2 generates subkey for each iteration to thwart any side channel attacks FF3 has tweaks is split and used in rounding function, also the reverse the sub-strings of given ...


1

As a page at ibm.com indicates, there could have been a bit of a "contra" attitude against Feistel ciphers thanks to DES having seen the first breaks in it's security etc. Down with the Feistel structure! In most ciphers, the round transformation has the well-known Feistel structure. In this structure typically part of the bits of the intermediate ...


1

A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are talking about not specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes. ...



Only top voted, non community-wiki answers of a minimum length are eligible