As the final permutation of the Feistel function is the inverse of the initial permutation, it undoes the initial permutation.So how is this helpful?

  • 4
    $\begingroup$ You need to mention the cipher and i guess you mean DES $\endgroup$ – hardyrama Feb 24 '19 at 14:04
  • $\begingroup$ Wikipedia IP and FP have no cryptographic significance, but were included in order to facilitate loading blocks in and out of mid-1970s 8-bit based hardware. $\endgroup$ – kelalaka Feb 24 '19 at 14:07
  • 1
    $\begingroup$ @Lucifer: unfortunately, the question being part of an assignment is not an assurance that it is consistent and self-contained enough. Somme assignments are poorly worded, or make the assumption that the audience knows conventions set in the course, or some particular text, when in fact that convention is far from universal. That even happens for national exams. Here: according to many texts, there is no IP or FP in a generic Feistel cipher. Texts that present IP and FP typically are DES-centric. $\endgroup$ – fgrieu Feb 24 '19 at 15:36

In DES we must distinguish the Initial Permutation; the Final Permutation, which by definition is IP-1; and the final swap (or lack thereof), which makes the last round different from the others. The final swap is formally in the specification of DES as a definition of the preoutput block as R16L16, when input and intermediary blocks are LiRi.

The rationale of making a Final Permutation parallels that of the Initial Permutation: in the original 8-bit-hardware implementation of DES, IP allows loading the plaintext as eight byte-wide accesses, with each of 8 bit of the IC's data bus line leading to the input of 8 shift registers in the IC, holding L and R. FP allows unloading the ciphertext by the same mechanism (the output of the 8 shift registers leads to the data bus). IP of decryption undoes FP of encryption, while FP of decryption undoes IP of encryption, because FP is IP-1.

The final swap consists in making an additional exchange of Left and Right registers after the last round (or, to the same effect, not doing in the last round the exchange of Left and Right registers performed in the other rounds). The rationale is that, combined with FP being IP-1, it makes encryption and decryption identical except for preparing subkeys in reverse order. That identity simplifies hardware and software that must adapt to both roles (when subkeys are precomputed as is standard practice for speed-optimized software implementations, the exact same code does encryption and decryption). Without final swap, in order for decryption to undo encryption, we'd have to move the exchange of Left and Right registers at the beginning of a decryption round, rather than at end in an encryption round.

IP and FP do not exist in all Feistel ciphers; they are rather specific to DES. On the other hand, the final swap technique works for any symmetric Feistel cipher, and is often considered an integral part of that design pattern.

Note: in some implementations or descriptions of DES (but not the standard), FP is taken to include final swap then IP-1.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.