What is the output of an r-round Feistel network when the input is $(L_0, R_0)$ and each round function outputs all 0s, regardless of the input?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ I changed the tags. This question has nothing to do with quantum cryptography. I also changed the title. Please make your own change if you're not satisfied with the title now, I wasn't sure how to properly summarize your question. $\endgroup$– NovaCommented Oct 15, 2014 at 7:03
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
If each round function outputs all $0$'s then if $r$ is an even number you get back original string. If $r$ is an odd number you just swap the $(L_0, R_0)$ components of the input. XOR basically has no effect on the string. Just follow the proof given in this answer Luby-Rackoff theorem confusion
$\begingroup$
$\endgroup$
What happens with the output of the round function and the previous half block? Nearly every Feistel networks XOR them. What happens if you XOR any block with an all "0" block? You get the previous block. Example in binary notation with 8-bit blocks: $$ \text{0100 1100} \oplus \text{0000 0000} = \text{0100 1100}$$
So even with a million rounds the output would not change. Now there's the question of the two halves. After every round they get swapped. If the number of round $r$ is even, than the final output of the Feistel network is $(L_0, R_0)$. If $r$ is odd, then the output is swapped: $(R_0, L_0)$. Some Feistel networks don't swap the output after the final round (or swap it two times, which is like swapping it not at all) because it would be cryptographically useless. If this happens then there's no change in the input for an odd $r$. An even $r$ would swap both halves.
