2
$\begingroup$

I have just seen that there are 3 feistel based FPE schemes which were proposed FF1,FF2 and FF3( There might be many more). Although there have been different attacks on FF1 and FF3 standard that show that it does not preserve 128 bit security they are still used in practice with recommended changes.

What reason made FF2 fail completely and to be rejected from 2015 to be used any further?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ It's explained in a 3 page paper here, which is directly referenced by NIST SP 800 38G as direct reason why it doesn't provide 128 bits of security. It's pretty comprehensive, but please, if anybody can explain it in even fewer words, we would welcome the answer. Apparently NIST got warned by the NSA. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Sep 16, 2021 at 10:24

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.