# on CPA & KPA security of $\boxplus$-Feistel

I am interested to identify the effect of replacing $$\oplus$$ with $$\boxplus$$ on basic balanced Feistel structure over $$r$$-rounds. Given;

$$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$$ where $$f$$ is PRF

$$[L,R] \in \left\{0,1\right\} ^{n}$$

Q1 . In term of CPA and KPA security, does $$\boxplus$$ replacement add security over 3 rounds, with proof?

Q2 . If $$\boxplus$$-Feistel structure have better security bounds that $$\oplus$$-Feistel, why do not we see it common?

• I'm assuming $\oplus$ denotes bitwise XOR here, but what's $\boxplus$? – Ilmari Karonen Nov 2 '18 at 11:28
• @IlmariKaronen I would assume it to mean addition (modulo 2^(blocksize /2)) – SEJPM Nov 2 '18 at 11:49
• You wrote "$F$ is a PRF". Do you mean "$f$ is a PRF"? – Future Security Nov 2 '18 at 16:06
• I modified it to small f – hardyrama Nov 2 '18 at 16:18