Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation.
Question: why are 3 round Feistel Ciphers not common?
My thoughts about the round functions of Luby and Rackoff construction are
The main issue is that this only holds if you start with a PRF. Constructing a secure PRF is just as hard as constructing a secure strong PRP, so haven't gained much. In practice we typically start with constructing a PRP and then turn it in into a PRF, not the other way round.
Feistel based blockciphers use many rounds, because their round functions are individually weak but also faster than a PRF.
In addition we typically want a strong PRP, so you need at least four rounds, not three. Another limitation is that the block size must be big enough for the target security level (IIRC you need 2n-bit blocks for n-bit security while we often target a security level equal or higher than the block size (e.g. AES has 128-bit blocks and 128/192/256-bit keys with the security level matching the key size).
There is one area where Feistel constructions using a small number (two to four) strong round functions are popular: Large and variable width permutations. OAEP is based on a two round feistel structure. There is the EME mode for wide block encryption.
