When I read some articles about cryptography on wikipedia, I took note of the following statements (please, correct me, if any of these are wrong):
- Perfect S-box (based on bent functions) provides maximum possible security against linear (and differential?) cryptanalysis.
- The problem with using perfect S-boxes is that an S-box constructed purely from bent functions can not be invertible.
- F function in Feistel network does not have to be neither balanced nor invertible. One could even make an extremely unbalanced Feistel network, where one side is only one bit, and have a bent function used as F.
From these statements it seems that using perfect S-boxes in F-function of an unbalanced Feistel network is an obvious choice for a simple and secure cipher. I understand, that someone would have come up with this long ago, if it was indeed so simple, but I can not find any information regarding possible downsides of such design.