# feistel cipher and number of rounds

In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same?

in cryptography and network security by william stallings we have : "The essence of the Feistel cipher is that a single round
offers inadequate security but that multiple rounds offer increasing security.
A typical size is 16 rounds."

a typical is 16 but what's the efficient number ?

In feistel cipher , does it matter that number of subkeys be 16 ?

Each round gets its own subkey, and so you'd have the same number of subkeys as you would have rounds. If you've only looked as ciphers with 16 rounds, well, yes, they'd all have 16 subkeys.

• well yes , every round gets its own subkey ! but what's the efficient number of rounds ? is it 16? – Masoud_qashqai Oct 2 '18 at 21:07
• @Masoud_qashqai: depends on what's the round function; do you go with a fast weak round function (and use a large number of rounds), or do you go with a slow strong one (and use a fewer number of rounds); the choice isn't obvious... – poncho Oct 2 '18 at 21:46
• Twofish uses 16 rounds and it has more than 16 subkeys (for whitening, etc). – forest Jan 4 at 5:58

There is a minimal number of rounds for theoretical security. 4 rounds are required to construct a strong pseudo random permutation (PRP) from a pseudo-random function (PRF).

In practice, cryptographers don't tend to design ciphers with a heavy PRF for the f-function but instead apply more rounds with a weaker f-function to get the requisite strength.

For this reason, there is no typical or default choice for the number of rounds in a Fiestel cipher. The optimal choice depends entirely on the internal security properties of the key schedule and F-function for the specific cipher in question.

• could you elaborate the tend part. – kelalaka Oct 11 '18 at 8:00

The number of rounds determines the security. Linear and differential attacks can succeed or fail according to the number of rounds.

The designer calculates the success rates the attacks and determine the rounds. If you look at the DES history, you will see that people believe that NSA knew the differential attack, and the S-Boxes designed to protect from this attack.

• so there is no fix number of rounds ? it depends on complexity of S-boxes ? there is no number that beyond that efficiency of cipher would not be more different? – Masoud_qashqai Oct 2 '18 at 21:26
• Well, AES ( though not feistel) is 10 round. First security than performance. – kelalaka Oct 2 '18 at 21:28
• well imagine i want to use feistel cipher only to encrypt my message :) not AES – Masoud_qashqai Oct 2 '18 at 21:30
• @Masoud_qashqai; if you consider the speed not the full security the use RC4. Many new CPU uses AES-NI – kelalaka Oct 2 '18 at 21:37
• encryption method is not the issue here now ! i have to work with this cipher particularly and i want to see is there any fix number of rounds exists that beyond that secutity measure wont be much more different from previous number of rounds – Masoud_qashqai Oct 2 '18 at 21:43

Viet Tung Hoang and Phillip Rogaway authored a paper entitled "On Generalized Feistel Networks" that provides a good place to explore the security of various Feistel Network structures. You can find their paper here https://eprint.iacr.org/2010/301.pdf. Page 3 of the paper summarizes CCA bounds for the various architectures as a function that includes the number of rounds.