# Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher?

My thought is "yes" because:

• it already has good diffusion and confusion
• it doubles the block size, so the number of rounds can be doubled at no perf cost.
• Yes, most feistel functions are some kind of SP network. May 22, 2016 at 8:58
• I already did this, 1 round of AES is not enough, you need 2 for complete mixing of the input May 22, 2016 at 20:55
• @RichieFrame how many Feistel rounds did you use? What was the key size and schedule? Was the cipher published anywhere?
– Demi
May 22, 2016 at 23:06

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as asked) a secure mini SPN or even a hash function (Sha3...)

it doubles the block size, so the number of rounds can be doubled at no perf cost

If you meant to use that $n$-bit secure SPN (such as Rijndael) in your Feistel $2n$-block-cipher, then you will have to make a sufficient number of rounds (at least 4 to get full diffusion : see p. 41). Therefore compared to a parallel CTR encryption method just using that $n$-SPN, you are 2 times slower and you don't really have a gain in security in term of key as the space is the same.

• I meant using the round function, not the full network.
– Demi
May 22, 2016 at 15:27
• @Demetri So with AES as an example, you mean a single application of SubBytes+ShiftRows+MixColumns+AddRoundKey, as opposed to 10 applications like the full cipher would do? May 22, 2016 at 16:17
• @EllaRose yes (but with many Feistel rounds, such as 20)
– Demi
May 22, 2016 at 16:42
• My goal is to utilize AES-NI, but have a larger block size to avoid birthday attacks.
– Demi
May 22, 2016 at 16:48
• @Demetri One round of AES does not necessarily have good (complete) diffusion, if I recall correctly. That's the only immediate problem I can think of, but the number of rounds may influence other effects as well (linear/differential characteristics), and these might be nonobvious. If you go through the work to find an appropriate number of rounds for all these issues, I wouldn't be surprised if you ended up at the number of rounds used in AES. May 22, 2016 at 19:49