# Known plaintext attack against Feistel ciphers

Assuming we have a Feistel cipher, with let's say 2 rounds i.e:

Plaintext $P=(L_{0},R_{0})$

$L_{1}=R_{0}$

$R_{1}=L_{0}\oplus f_{{K}_{1}}(R_{0})$

$L_{2}=R_{1}$

$R_{2}=L_{1}\oplus f_{{K}_{2}}(R_{1})$

With the keys $K_{1}, K_{2}$

With a known plaintext attack, assume we have some $x$ amount of pairs of $(P_{i}, C_{i})$ for the attack.

How would you proceed about the attack to find both keys and how long would it take? In my limited understanding, if we have $k$ as the size of each key, the first key would take $2^{k}$ evaluations and the 2nd key would take the same amount as well given that they are independent keys but assuming that's right, wouldn't that be the same cost as an exhaustive key search?

• You have computed the effort to find the key correctly. Have you tried to compute how many keys there are for the Feistel cipher? – K.G. Oct 24 '17 at 19:26
• Actually, if the two subkeys are independent, a straight-forward brute force search would take $2^{2k}$ time (as there are a total of $2k$ key bits...) – poncho Oct 24 '17 at 19:50
• @K.G Wouldn't that be just a total of $2k$ keys? – echoeida Oct 24 '17 at 20:34