We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [feistel-network]

A feistel-network or feistel cipher is a structure that has been used to create a number of different block ciphers (e.g., DES, Blowfish, Twofish, RC6).

Filter by
Sorted by
Tagged with
0
votes
0answers
43 views

Constructing Differential Characteristics for Feistel Cipher

I have to construct for every i-round of Feistel cipher, for $i \in \{3,4,5,6,7,8\}$, a differential characteristic with there properties: $Pr[\Delta x = a \overset{f_i}{\rightarrow} \Delta y = b] = ...
3
votes
1answer
124 views

PRP vs PRF for the F-function of a Feistel network

A Feistel network is generally defined with a PRF for its F-function, but PRPs have been used as well. What are the theoretical cryptographic implications of using a PRP instead of a PRF? Does it ...
2
votes
1answer
45 views

1 round Feistel with birthday attack

This is a reprise of an earlier question of mine, and I'm sorry if it's repetitious; I'm going at it with a different strategy. In an exercise I was given a 1-round Feistel network which uses $H(k \...
2
votes
1answer
77 views

Attack on a Feistel Cipher given the key and half of the ciphertext

Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process. Is it possible to reconstruct the original data if half of the ciphered text is given? ...
-1
votes
2answers
177 views

Learning about Feistel Cipher

I'm learning about Feistel Ciphers at the moment, but having issues with the formulae, so I can't move on from it. Encryption: $𝐿𝐸_{𝑖+1} = 𝑅𝐸_𝑖$ $𝑅𝐸_{𝑖+1} = 𝐿𝐸_𝑖 \oplus 𝐹( 𝑅𝐸_𝑖 , 𝐾...
0
votes
1answer
177 views

Final Permutation in Feistel function

As the final permutation of the Feistel function is the inverse of the initial permutation, it undoes the initial permutation.So how is this helpful?
2
votes
1answer
273 views

One-round feistel network (DES) attack

I can't find out how to break 1 round of feistel network (obtaining the key). I understand why this equation takes place: $R_1 \oplus L_0 = f(R_0, k_1)$ EDIT: The function f looks like this: But ...
7
votes
1answer
283 views

How to find fixed points for DES weak keys

Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that: each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
4
votes
2answers
778 views

How can I prove that a Feistel round is its own inverse for DES?

I'm having difficulty on proving the fact that each round of DES algorithm is its own inverse. Can someone put a concise explanation for it please? If a function, say $f$ ,is its own inverse than $f(...
0
votes
1answer
809 views

Why 3 round Feistel cipher are not common

Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation. Question: why are 3 round Feistel Ciphers not common? My thoughts about the round ...
2
votes
4answers
378 views

feistel cipher and number of rounds

In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same? in cryptography and network security by ...
1
vote
1answer
42 views

RoR Attacks on modified Feistel Network

It is known that a Feistel Network containing 3 rounds is relatively secure against Chosen Plaintext attacks. Now as a game I was given the task to find a possible attack against a Feistel Network ...
1
vote
1answer
343 views

Is this an example of a Feistel cipher?

Have tried to create simplest example. A,B,C,D are 32-bit unsigned, as is k[4]. P is an expansion type p-box of 256 "random" 32-bit values. Assume key-whitening and multiple rounds/keys ...
4
votes
3answers
491 views

What are the requirements from a Round function in Feistel network?

Let's assume a balanced network with many (dozens?) rounds. And a simple (selecting key bits) key schedule. What does it take from the round F function to make a secure block cipher? obviously we ...
2
votes
1answer
76 views

Unbalanced Feistel network only generates complete permutations with square lengths

I'm generating permutations with a generalized Feistel network which will output integer values $r_j$ in a specified range $[0,period]$ pseudo-randomly, according to the counter input, which will then ...
2
votes
3answers
408 views

Known-plaintext attack on 1-round Feistel networks

Consider a simple, 1-round Feistel network. Because the ciphertext is essentially $(L_1,R_1)$, if one knows the plaintext $(L_0,R_0)$, the only unknown left is $K$. However round functions in ...
7
votes
0answers
177 views

Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
2
votes
2answers
879 views

Why is a Feistel Network able to both encrypt and decrypt just by using the round keys in a different order

Using a feistel network, to encrypt something you can just use the round keys. But to decrypt it, the same order of processes is applied, however the keys are used in reverse. My question is: What ...
0
votes
1answer
284 views

AES and GOST 28147-89 “Magma” Comparison

I am trying to understand how AES is comparable to GOST 28147-89 "Magma". Like for parameters such as bit shifting and addition of the subkey to the input, which are a part of Magma, what is their ...
-1
votes
1answer
119 views

What is the result of encryption if Feistel cipher maps every 16 bit input to 0xFFFF regardless of subkey?

Suppose the F function of a 16 round Feistel cipher mapped every 16-bit input R, regardless of the value of the subkey K[r], to 0xFFFF What is the result of running an encryption with this cipher?
-1
votes
2answers
520 views

What is the output of an r-round Feistel network

What is the output of an r-round Feistel network when the input is (L0, R0) if Each round function is the identity function.
2
votes
0answers
355 views

Round function in Feistel

Following situation. We got a Feistel network. And in each round we get following outcome on the left side: $$L^\prime = L_1 \oplus F(K_1, R_1)$$ Is there a possible key to get an unchanged outcome ...
8
votes
1answer
411 views

Can a Feistel network have more than two halves, widening the block width?

Just to help form this question, this is a Feistel network:- To me this looks like:- Why does the generic architecture have to have two halves? We already have asymmetry in some variants. As I ...
2
votes
2answers
201 views

How does the round function in this particular Feistel cipher work?

I have this exercise that I found on the Internet. It is originally in French but it says: Exercise 3: (Feistel scheme). We consider a two-round Feistel cipher defined as follows: The ...
1
vote
0answers
122 views

Luby-Rackoff theorem for Generalized Feistel

I was reading about Luby-Rackoff theorem from various sources: [1], [2], [3], which says you need at least 3 rounds of a $2$-branch Feistel network to get a PRP if the underlying $f$ function is a PRF....
1
vote
2answers
117 views

Are Feistel ciphers subject to the birthday bound?

This paper seems to be saying that a balanced Feistel cipher can be broken when an adversary has $2^{0.5 \cdot n}$ pairs of plaintext and cipher text blocks where $n$ is the block size in bits. Is ...
3
votes
1answer
5k views

Feistel cipher key generation and round function algorithms

I'm getting confused of what is the actual structure of the key generation and the round function algorithms that Feistel cipher uses. I have been reading many resources about block cipher. All ...
1
vote
0answers
550 views

Known plaintext attack against Feistel ciphers

Assuming we have a Feistel cipher, with let's say 2 rounds i.e: Plaintext $P=(L_{0},R_{0})$ $L_{1}=R_{0}$ $R_{1}=L_{0}\oplus f_{{K}_{1}}(R_{0})$ $L_{2}=R_{1}$ $R_{2}=L_{1}\oplus f_{{K}_{2}}(R_{1})...
2
votes
2answers
2k views

Difference between encryption and decryption for Feistel Cipher

I have read that the only difference between enc and dec of a Feistel Cipher is the order of the subkeys. But on the following figure, the harves block are also inverted, no? I don't understand why ...
3
votes
3answers
187 views

Why are the right halves kept unchanged in Feistel networks?

As I'm going through the Feistel network in the DES algorithm. While encryption uses a Feistel Network, the input block is divided into two halves left ($L$) and right half ($R$). In each round, the ...
5
votes
0answers
343 views

A novel encryption method using only a (huge) lookup table. Is this remotely secure? [closed]

So I've come up with an (admittedly impractical) encryption method using a lookup table. The table is a shuffled list of all unsigned 32-bit integers, effectively making it a 32-bit unkeyed PRP. I ...
14
votes
3answers
2k views

Why do Feistel ciphers need round keys?

Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
3
votes
1answer
615 views

In a Feistel cipher structure, what exactly does the “round function $F$” do?

In a Feistel cipher structure, what exactly does the "round function $F$" do to the right half of the data, before taking XOR of the output with the left half of the data?
3
votes
1answer
138 views

Are non bijective sboxes weaker (on feistel networks)?

I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible) Is that ...
4
votes
2answers
930 views

Disadvantages of the Feistel network

I have read about Feistel network and so far only advantages have been listed. Are there any disadvantages to the design? Please could you explain in fairly basic terms?
3
votes
2answers
565 views

Does XOR have diffusion properties?

Does the XOR operator provide diffusion if the right side of plain text is XORed against a round key which is then XORed against the left side to produce that side of cipher text, for example in a ...
3
votes
1answer
1k views

Is 3 rounds Feistel enough for making PRP

I know that one round of Feistel is not enough for making a PRP (Pseudo Random Permutation) even I know that two round is not enough how about three round of Feistel ? I read a lot but not usefull. ...
5
votes
1answer
431 views

Slide attack: creating an actual attack on the Simon Cipher

I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and ...
2
votes
1answer
424 views

2-round generalized Feistel network

Write the decryption of a 2-round generalized Feistel network given below. $P_i$ denotes plaintext blocks of each 32-bits. $RK_i$ denotes the round keys. $WK_i$ denotes 32-bit keys applied ...
1
vote
1answer
296 views

What is the importance of $f_k$ in a feistel network being a permutation

I was doing some cryptography exercises, one of which was an example of a feistel network. It said that the function $f_k$ was a permutation for all k but didn't explain why that makes a difference. ...
0
votes
1answer
339 views

Is a Feistel structure based cipher IND-CPA?

Using the format of the "game" to establish if a cipher is IND-CPA secure: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of them at random ...
5
votes
2answers
1k views

What is the definition of Feistel Cipher?

I know how Feistel Network works, but I want to know the exact definition of "Feistel Cipher" to solve several questions below: question 1: Is it correct to say DES (Data Encryption Standard) is ...
3
votes
1answer
103 views

“open-key model” attacks, why would one be concerned?

In a paper on a Feistel network, I found the line we have made no effort to guard against attacks in the open-key model and then I found this paper at iarc.org on the subject. I found only a ...
5
votes
2answers
750 views

Feistel-Network - why wire crossing?

In Feistel-Network, there would be a wire-crossing at the end (for the next round). Which insufficiency would occur, if the wire crossing would be omitted?
5
votes
1answer
174 views

Can you decrypt with 1 round key?

If one has the last round key in an SP or Feistel network (the 16th round key in DES for example), would that someone be able to decrypt the rest of the encryption?
4
votes
1answer
127 views

Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher? My thought is "yes" because: it already has ...
3
votes
1answer
631 views

How does Feistel cipher create diffusion between blocks?

From what I've read about Feistel ciphers, I can understand that within each block, there is both confusion and diffusion. But it is unclear to me how a Feistel cipher permutates among blocks of data. ...
5
votes
1answer
2k views

What is the diffrence between Feistel networks and SPN?

I recently read about the concept of Feistel Networks and Substitution Permutation Networks but what is exactly the difference between the two ?
5
votes
2answers
1k views

Need for 3 rounds in Luby Rackoff theorem

I get that using Feistel network we can create a secure PRP from a secure PRF (in 3 rounds according to theorem). My question is why not just 2 rounds of Feistel network is sufficient. Is it that ...
-2
votes
1answer
180 views

What is the security gain of applying Two S-boxes in Different Ways?

In a 128-bits Feistel Cipher: I need suggestions about two variations of the Round Function Variation-1 $64$ bit input is divided into $8$ bytes Byte $0,1,2,3$ are substituted with Sbox1 Byte $4,5,...