How does the round function in this particular Feistel cipher work?

Question

I have this exercise that I found on the Internet. It is originally in French but it says:

Exercise 3: (Feistel scheme). We consider a two-round Feistel cipher defined as follows:

• The length of the blocks is 8.

• The key $K = [k_1, ..., k_8]$ is of length 8. The two round keys are $K_1 = [k_1, ..., k_4]$ and $K_2 = [k_5, ..., k_8]$, where the $k_i$ are the bits of the key $K$.

• The function $V = f (U, U ')$ is defined by writing the bits $v_i$ of $V = [v_1, ..., v_4]$ as functions of $U = [u_1, u_2, u_3, u_4]$ and $U '= [u'_1, u'_2, u'_3, u'_4]$ as follows:

$$\begin{aligned} v_1 &= u_1 u'_4 ⊕ u_2 u'_3 ⊕ u_4 u'_3, \\ v_2 &= u_1 u'_2 ⊕ u_3 u'_1, \\ v_3 &= u_1 u'_4 ⊕ u_1 u'_3, \\ v_4 &= u_3 u'_3 ⊕ u_1 u'_1. \end{aligned}$$

1. Let the key be $$K = [1,0,1,1,0,0,1,0],$$ and let the message be $$M = [0,1,0,0,0,1,1,1].$$ Calculate the encryption of $M$ using the Feistel scheme above.
2. Decrypt the message $C = [0,1,1,1,0,0,1,1]$ which was encrypted with the same key.

So my question is: I understood that $U$ is actually the right half of the plaintext and that $U'$ is actually $K_1$ in the first round and $K_2$ in the second. And I solved the exercise based on this understanding. But my teacher said that my understanding is wrong and that $U$ has to be the left half of the plaintext, while $U'$ is the right half of the plaintext. She means that the Feistel cipher is changed in this case. She added that her understanding is more logical and that mine could not even be considered as a possible one in this context. I think that if her understanding is logical and correct, mine is more so.

What do you think? I know this might seem like a trivial question but I really want to read other people's opinions and be convinced by the more logical understanding and explanation.

Answer 1

It seems to me that the exercise is missing some context (which is presumably to be found in the textbook it's taken from). Specifically, it defines a function $$f: \{0,1\}^4 \times \{0,1\}^4 \to \{0,1\}^4,$$ but does not explicitly state what role this function is supposed to play in the Feistel encryption process.

That said, the usual way to define a Feistel encryption round (as given e.g. on Wikipedia) is $$\begin{aligned} L_{i+1} &= R_i, \\ R_{i+1} &= L_i \oplus F(R_i, K_i), \end{aligned}$$ where $L_i$ and $R_i$ are the left and right halves of the input block to encryption round $i$, $K_i$ is the $i$-th round subkey, and $F$ is some nonlinear function.

Presumably, the function $f$ defined in the exercise corresponds to the nonlinear round function that I've denoted by $F$ above. Thus, presumably, one of its arguments is supposed to be the round subkey, while the other one is one of the input half-blocks, just like you say. However, what's not obvious from the given definition is which argument is supposed to be the subkey, or whether the other argument is supposed to be the left or the right half-block (since either convention can be used, and they're essentially equivalent).

Anyway, if the exercise comes with an answer sheet, it should be easy enough to verify this just by doing the encryption is each of the possible ways and comparing the results with the expected answer. Even with the small block size, getting the right answer just by change from the wrong encryption process should be pretty unlikely.

Answer 2

This is a convention question, but in the absence of a specific convention, since we read English and formulae left to right, and the question is in English, most people would agree with the teacher.

It's best practice to specify the conventions fully, of course.