# Tag Info

11

Let's look at a picture of a generic feistel cipher Notice that no keying material is used during or after that final swap. So, we can conclude that the final swap does not impact security at all. So, why include it? It is so that all rounds will be identical. This could help with some implementations. That is all.

9

It's there to facilitate a simple implementation. As there is no key addition applied afterwards, the final swapping of the halves does not contribute towards security. The Feistel cipher entry on tutorialspoint explains: Decryption Process The process of decryption in Feistel cipher is almost similar. Instead of starting with a block of plaintext,...

8

A Feistel network is a way of constructing an invertible permutation from a (possibly non-invertible) function. If the function used is pseudorandom and has a large domain, then 3-4 rounds yields a pseudorandom permutation (3 rounds suffice if the adversary can only ask "compute" queries, and 4 rounds are needed if the adversary can ask "invert" queries). ...

5

It depends on the block cipher in question - specifically its key schedule. Knowing any round key of AES-128 would let you calculate the key, because the schedule is reversible. OTOH, e.g. TEA would retain secrecy of most of the key and might remain secure, because its round keys are small enough parts of the key. In the case of DES, it is weak enough to be ...

5

If a message is longer than the block length, how would changing one part of the message affect the encryption of other parts of the message? That really doesn't depend on the block cipher in use, which may be a feistel cipher like DES or a SP network like AES, but on the mode of operation. Now the answer to this really depends on the actual mode ...

5

The simple answer is that fewer than 3 rounds can be easily distinguished from a random permutation. The 2-round Luby-Rackoff cipher on $2n$ bits, using random functions $f_i$ mapping $n$ bits to $n$ bits, consists of $$F(L, R) = (A, B),$$ where $A = L \oplus f_1(R)$ and $B = R \oplus f_2(L \oplus f_1(R))$. Now consider an attacker that wants to ...

5

Yes you could use a hash function as round function, but if you are using the "same key" over all rounds, you are vulnerable to slide attacks. Using a hash function is not a very good idea. Your round function should not introduce biases, should not lead to special differences (attack: differential cryptanalysis), and it should also not be writable as a ...

4

The simple answer is "Because its an SPN cipher". What is difference between Feistel and SPN? SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then operate upon X parts where 0 In balanced, data is divided in Two parts i.e N = 2, and X=1 (example is camellia cipher) In Unbalanced, data is divided in more ...

3

I've been toying around with your function, and I've come to the conclusion it's not memory hard. The amount of required memory can be reduced to at maximum digestsize * 3 * rounds. The first problem is that the entropy does not avalanche throughout the state, but stays localized. For example, after 1 round the state of the 2nd block only depends on the ...

3

It's required for diffusion and achieving the avalanche effect. The concept of diffusion and the avalanche effect basically means that each input bit should influence each output bit evenly. Changing one input bit should flip, on average, half the output bits. Due to the nature of the Feistel construction, how it is split up into halves, only one side ...

3

In a Feistel networks (from the German IBM cryptographer Horst Feistel), the input is divided into two blocks ($L_0$ and $R_0$) which interact with each other. Main example is DES. basic construction: In a SPN (Substitution Permutation Network), the input is divided into multiple small blocks, applied to a S-box (substitution), then the bits positions ...

2

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as asked) a secure mini SPN or even a hash function (Sha3...) it doubles the block size, so the number of rounds can be doubled at no perf cost If you meant ...

2

About the security of your first variation, it is sort of answered here. This is your 1st variation. This is your 2nd variation (your $8 \times 8$ matrix idea is equivalent to apply a permutation). In your first variation, the application of the matrix is useless, one can consider the $S1$ (or $S2$) and the matrix as a single S-box. Hence you have no ...

2

Use a Hadamard code via the fast Walsh Hadamard transform, it can correct up to $2^{n-2}$ errors for block length $2^n$ and is also locally decidable so you may not need too many code word coordinates.

Only top voted, non community-wiki answers of a minimum length are eligible