# on CPA & KPA security of $\boxplus$-Feistel

I am interested to identify the effect of replacing $$\oplus$$ with $$\boxplus$$ on basic balanced Feistel structure over $$r$$-rounds. Given;

$$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$$ where $$f$$ is PRF

$$[L,R] \in \left\{0,1\right\} ^{n}$$

Q1 . In term of CPA and KPA security, does $$\boxplus$$ replacement add security over 3 rounds, with proof?

Q2 . If $$\boxplus$$-Feistel structure have better security bounds that $$\oplus$$-Feistel, why do not we see it common?

• I'm assuming $\oplus$ denotes bitwise XOR here, but what's $\boxplus$? – Ilmari Karonen Nov 2 '18 at 11:28
• @IlmariKaronen I would assume it to mean addition (modulo 2^(blocksize /2)) – SEJPM Nov 2 '18 at 11:49

In term of CPA and KPA security, does $$\boxplus$$ replacement add security over 3 rounds, with proof?
No. There's nothing special about $$\oplus$$ in the Feistel struture. In fact any group operation $$\boxplus$$ over $$\{0,1\}^n$$ will do just fine. The main point of these random functions is to "blind" the previous rounds' other halves and for that a group operation is sufficient.
In fact Maurer and Pietrzak proved the more general security bounds for the Feistel construction beyond 4 rounds using an arbitrary group operation $$\oplus$$.
If $$\boxplus$$-Feistel structure have better security bounds that $$\oplus$$-Feistel, why do not we see it common?