4
$\begingroup$

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher?

My thought is "yes" because:

  • it already has good diffusion and confusion
  • it doubles the block size, so the number of rounds can be doubled at no perf cost.
Improve this question
$\endgroup$
3
  • $\begingroup$ Yes, most feistel functions are some kind of SP network. $\endgroup$
    – LightBit
    Commented May 22, 2016 at 8:58
  • $\begingroup$ I already did this, 1 round of AES is not enough, you need 2 for complete mixing of the input $\endgroup$
    – Richie Frame
    Commented May 22, 2016 at 20:55
  • $\begingroup$ @RichieFrame how many Feistel rounds did you use? What was the key size and schedule? Was the cipher published anywhere? $\endgroup$
    – Demi
    Commented May 22, 2016 at 23:06

1 Answer 1

Reset to default
3
$\begingroup$

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as asked) a secure mini SPN or even a hash function (Sha3...)

it doubles the block size, so the number of rounds can be doubled at no perf cost

If you meant to use that $n$-bit secure SPN (such as Rijndael) in your Feistel $2n$-block-cipher, then you will have to make a sufficient number of rounds (at least 4 to get full diffusion : see p. 41). Therefore compared to a parallel CTR encryption method just using that $n$-SPN, you are 2 times slower and you don't really have a gain in security in term of key as the space is the same.

Improve this answer
$\endgroup$
6
  • $\begingroup$ I meant using the round function, not the full network. $\endgroup$
    – Demi
    Commented May 22, 2016 at 15:27
  • $\begingroup$ @Demetri So with AES as an example, you mean a single application of SubBytes+ShiftRows+MixColumns+AddRoundKey, as opposed to 10 applications like the full cipher would do? $\endgroup$
    – Ella Rose
    Commented May 22, 2016 at 16:17
  • $\begingroup$ @EllaRose yes (but with many Feistel rounds, such as 20) $\endgroup$
    – Demi
    Commented May 22, 2016 at 16:42
  • $\begingroup$ My goal is to utilize AES-NI, but have a larger block size to avoid birthday attacks. $\endgroup$
    – Demi
    Commented May 22, 2016 at 16:48
  • $\begingroup$ @Demetri One round of AES does not necessarily have good (complete) diffusion, if I recall correctly. That's the only immediate problem I can think of, but the number of rounds may influence other effects as well (linear/differential characteristics), and these might be nonobvious. If you go through the work to find an appropriate number of rounds for all these issues, I wouldn't be surprised if you ended up at the number of rounds used in AES. $\endgroup$
    – Ella Rose
    Commented May 22, 2016 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.