4
$\begingroup$

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher?

My thought is "yes" because:

  • it already has good diffusion and confusion
  • it doubles the block size, so the number of rounds can be doubled at no perf cost.
$\endgroup$
  • $\begingroup$ Yes, most feistel functions are some kind of SP network. $\endgroup$ – LightBit May 22 '16 at 8:58
  • $\begingroup$ I already did this, 1 round of AES is not enough, you need 2 for complete mixing of the input $\endgroup$ – Richie Frame May 22 '16 at 20:55
  • $\begingroup$ @RichieFrame how many Feistel rounds did you use? What was the key size and schedule? Was the cipher published anywhere? $\endgroup$ – Demi May 22 '16 at 23:06
3
$\begingroup$

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as asked) a secure mini SPN or even a hash function (Sha3...)

it doubles the block size, so the number of rounds can be doubled at no perf cost

If you meant to use that $n$-bit secure SPN (such as Rijndael) in your Feistel $2n$-block-cipher, then you will have to make a sufficient number of rounds (at least 4 to get full diffusion : see p. 41). Therefore compared to a parallel CTR encryption method just using that $n$-SPN, you are 2 times slower and you don't really have a gain in security in term of key as the space is the same.

$\endgroup$
  • $\begingroup$ I meant using the round function, not the full network. $\endgroup$ – Demi May 22 '16 at 15:27
  • $\begingroup$ @Demetri So with AES as an example, you mean a single application of SubBytes+ShiftRows+MixColumns+AddRoundKey, as opposed to 10 applications like the full cipher would do? $\endgroup$ – Ella Rose May 22 '16 at 16:17
  • $\begingroup$ @EllaRose yes (but with many Feistel rounds, such as 20) $\endgroup$ – Demi May 22 '16 at 16:42
  • $\begingroup$ My goal is to utilize AES-NI, but have a larger block size to avoid birthday attacks. $\endgroup$ – Demi May 22 '16 at 16:48
  • $\begingroup$ @Demetri One round of AES does not necessarily have good (complete) diffusion, if I recall correctly. That's the only immediate problem I can think of, but the number of rounds may influence other effects as well (linear/differential characteristics), and these might be nonobvious. If you go through the work to find an appropriate number of rounds for all these issues, I wouldn't be surprised if you ended up at the number of rounds used in AES. $\endgroup$ – Ella Rose May 22 '16 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.