# Feistel cipher vs Substitution-permutation network - number of rounds

So I have been doing for the last couple of days comparison between Feistel cipher and Substitution-permutation network. Now I can say I know a lot about them and their similarities and differences but there is still one more thing I would like to know and I can't find it anywhere.

The thing is I don’t know how many rounds these structures have. I mean simply which structure has more rounds and why?

After searching a lot for this I have a feeling (didn't find any hard proof) that we can customize number of rounds when designing a symmetric algorithm based on one of those structures, if this is true then I want to know on which structure based algorithms has typically more rounds (or how many rounds they need to have to be considered safe)?

• for feistel networks check "patarin's proof" , 7 rounds is what he proved to be good enough. i dont know about SPN – sashank Sep 11 '14 at 0:49

While I can confirm that your “feeling“ is indeed correct, the rest of your question is not that easy to answer. I’ll try to give you some insight nevertheless.

## Generally…

The number of rounds depends on the design and security parameters of the individual ciphers. This makes it rather impossible to generalize things in form of “structure $A$ should use $x$ rounds, and structure $B$ should use $y$ rounds”. While cipher algorithms may share alike structures, their internals differ… and so do their individual round numbers.

Yet, what we can say is that less rounds tend to make a cipher less secure, while more rounds tend to make a cipher more secure. This might sound perfect, but you have to keep in mind that you can’t simply take a random cipher and hope to make it “unbreakable” by throwing enough rounds at it.

## Where increasing rounds doesn’t save the day…

You might have heard about cryptanalysis where people show that some algorithms are breakable when you attack “reduced rounds” of that cipher. That practically means that they took a cipher algorithm, decreased the number of rounds below the recommended minimum, and tried to successfully apply attacks on the reduced-round version of the cipher to learn about potential weaknesses. A potential weaknesses in the reduced-round version might be expandable to the full-round version of the cipher (which uses the originally defined and/or agreed upon number of rounds).

In a worst-case scenario, someone finds a successful attack on a reduced-round cipher and successfully expands that attack to any number of rounds. From that moment on, all hope is lost for the involved cipher as that would be a “total break”… and increasing the number of rounds won’t help.

But as long as we’re not talking about such worst-case scenarios, increasing the number of rounds can help increase (or regain) the safety margin in other cases.

## The “ideal” number of rounds…

In the end, cryptography is all about safety margins. During the design phase, the cipher algorithm designer will try to pinpoint the to-be-expected security his/her cipher offers as exact as he/she possibly can and/or can prove. (Assuming you’ve seen a few reference papers already, you’ll know that cipher designers publish such proofs in the reference papers which describes their individual cipher designs.) Simpler said: while creating the cipher algorithm, the designer tries to identify the minimum number of rounds his cipher needs to be able to meet the security parameters of the cipher, as well as the recommended number of rounds.

Most of the time, there is no maximum number of rounds defined. The reason for this is pretty simple: the cipher designer already provided the *recommended * number of rounds and – if possible – related security proofs. The recommended number of rounds represents the (let’s just call it) “ideal” number of rounds in relation to the cipher’s security.

Increasing the number of rounds beyond that level may increase security, but from a certain level on you will merely be able to detect a minimal security gain, while – at the same time – you’ll notice you’re wasting too many system resources and valuable time… which doesn’t really make sense as the gain is discardable compared to the investment of time and resources. (Think about it: no one will want to wait half an hour for something to encrypt, just because you chose to increase the original number of rounds from 10 to 1.000.0000.000. Besides, the cipher will not be a million times more secure if you do that.)

# tl;dr

There is no perfect answer to the question “which cipher structure” will need “what number of rounds” to be secure, because that depends on the individual cipher algorithms. While cipher structures might be alike, the security margins tend to be different. Simpler said: two ciphers with the same structure might need a totally different number of rounds to make both provide a comparable security.

But, what we can say is:

You can make almost any cipher more secure by adding enough rounds… assuming it’s not totally broken. Also, you can make almost every cipher insecure by reducing enough rounds. (1)

(1) Never reduce rounds unless you can actually prove that your reduced-round version will still provide the expected safety margin. Without such proof, you’re walking on very thin ice.