It is known that a Feistel Network containing 3 rounds is relatively secure against Chosen Plaintext attacks. Now as a game I was given the task to find a possible attack against a Feistel Network with 3 rounds, but the first encryption with a key has no effect. (So the input in the second function is just $L \oplus R$). It should be possible to find out, with significant probability and only to Chosen Plaintexts, if the network produces the results of the chosen inputs or just a random sequence. I just can't wrap my head around it, can anyone help me there?

Thank you in advance!


If you have three rounds and the encryption in the first round has no effect, then the left side of the third round is

$$ L_3 = R_0~\oplus~F(L_0 \oplus R_0, K_2) $$

and when you exchange the left and right side of the initial block

$$ L_3' = L_0~\oplus~F(R_0 \oplus L_0, K_2) = L_0~\oplus~F(L_0 \oplus R_0, K_2) $$


$$ L_3~\oplus~L_3' = R_0~\oplus~L_0 $$

This property lets you distinguish the output of the Feistel network from random.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.