# On CPA & KPA security of $\boxplus$-Feistel

I am interested to identify the effect of replacing $$\oplus$$ with $$\boxplus$$ on basic balanced Feistel structures over $$r$$-rounds. Given:

$$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$$ where $$f$$ is a PRF

$$[L,R] \in \left\{0,1\right\} ^{n}$$

Q1 . In terms of CPA and KPA security, does $$\boxplus$$ replacement add security over 3 rounds, with proof?

Q2 . If $$\boxplus$$-Feistel structures have better security bounds than $$\oplus$$-Feistel, why are they not commonly used?

• I'm assuming $\oplus$ denotes bitwise XOR here, but what's $\boxplus$? Nov 2 '18 at 11:28
• @IlmariKaronen I would assume it to mean addition (modulo 2^(blocksize /2))
– SEJPM
Nov 2 '18 at 11:49

In term of CPA and KPA security, does $$\boxplus$$ replacement add security over 3 rounds, with proof?
No. There's nothing special about $$\oplus$$ in the Feistel struture. In fact any group operation $$\boxplus$$ over $$\{0,1\}^n$$ will do just fine. The main point of these random functions is to "blind" the previous rounds' other halves and for that a group operation is sufficient.
In fact Maurer and Pietrzak proved the more general security bounds for the Feistel construction beyond 4 rounds using an arbitrary group operation $$\oplus$$.
If $$\boxplus$$-Feistel structure have better security bounds that $$\oplus$$-Feistel, why do not we see it common?
• The other nice thing about XOR is that it is a self-inverse. Hence, it makes it more convenient to share the same circuitry with encryption and decryption, with the only change being in the key scheduling. Yes, you can do the same with other group operations (e.g. make the even rounds $\boxplus$ and the odd rounds $\boxminus$), but that is more complicated. Jul 15 '20 at 13:10