Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A feistel-network or feistel cipher is a structure that has been used to create a number of different block ciphers (e.g., DES, Blowfish, Twofish, RC6).

0
votes
1answer
81 views

Why 3 round Feistel cipher are not common

Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation. Question: why are 3 round Feistel Ciphers not common? My thoughts about the round ...
2
votes
4answers
64 views

feistel cipher and number of rounds

In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same? in cryptography and network security by ...
1
vote
1answer
27 views

RoR Attacks on modified Feistel Network

It is known that a Feistel Network containing 3 rounds is relatively secure against Chosen Plaintext attacks. Now as a game I was given the task to find a possible attack against a Feistel Network ...
1
vote
1answer
77 views

Is this an example of a Feistel cipher?

Have tried to create simplest example. A,B,C,D are 32-bit unsigned, as is k[4]. P is an expansion type p-box of 256 "random" 32-bit values. Assume key-whitening and multiple rounds/keys ...
4
votes
3answers
164 views

What are the requirements from a Round function in Feistel network?

Let's assume a balanced network with many (dozens?) rounds. And a simple (selecting key bits) key schedule. What does it take from the round F function to make a secure block cipher? obviously we ...
2
votes
1answer
61 views

Unbalanced Feistel network only generates complete permutations with square lengths

I'm generating permutations with a generalized Feistel network which will output integer values $r_j$ in a specified range $[0,period]$ pseudo-randomly, according to the counter input, which will then ...
2
votes
3answers
113 views

Known-plaintext attack on 1-round Feistel networks

Consider a simple, 1-round Feistel network. Because the ciphertext is essentially $(L_1,R_1)$, if one knows the plaintext $(L_0,R_0)$, the only unknown left is $K$. However round functions in ...
5
votes
0answers
118 views

Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
2
votes
2answers
84 views

Why is a Feistel Network able to both encrypt and decrypt just by using the round keys in a different order

Using a feistel network, to encrypt something you can just use the round keys. But to decrypt it, the same order of processes is applied, however the keys are used in reverse. My question is: What ...
0
votes
1answer
112 views

AES and GOST 28147-89 “Magma” Comparison

I am trying to understand how AES is comparable to GOST 28147-89 "Magma". Like for parameters such as bit shifting and addition of the subkey to the input, which are a part of Magma, what is their ...
0
votes
0answers
118 views

Suppose the DES F function mapped every 32-bit input R, regardless of the value of the input K, to bitwise complement of R

Suppose the DES $F$ function mapped every 32-bit input $R$, regardless of the value of the input $K$, to bitwise complement of $R$. What will be result of encryption?
-1
votes
1answer
66 views

What is the result of encryption if Feistel cipher maps every 16 bit input to 0xFFFF regardless of subkey?

Suppose the F function of a 16 round Feistel cipher mapped every 16-bit input R, regardless of the value of the subkey K[r], to 0xFFFF What is the result of running an encryption with this cipher?
-1
votes
2answers
188 views

What is the output of an r-round Feistel network

What is the output of an r-round Feistel network when the input is (L0, R0) if Each round function is the identity function.
3
votes
0answers
168 views

Round function in Feistel

Following situation. We got a Feistel network. And in each round we get following outcome on the left side: $$L^\prime = L_1 \oplus F(K_1, R_1)$$ Is there a possible key to get an unchanged outcome ...
8
votes
1answer
364 views

Can a Feistel network have more than two halves, widening the block width?

Just to help form this question, this is a Feistel network:- To me this looks like:- Why does the generic architecture have to have two halves? We already have asymmetry in some variants. As I ...
2
votes
2answers
90 views

How does the round function in this particular Feistel cipher work?

I have this exercise that I found on the Internet. It is originally in French but it says: Exercise 3: (Feistel scheme). We consider a two-round Feistel cipher defined as follows: The ...
1
vote
0answers
74 views

Luby-Rackoff theorem for Generalized Feistel

I was reading about Luby-Rackoff theorem from various sources: [1], [2], [3], which says you need at least 3 rounds of a $2$-branch Feistel network to get a PRP if the underlying $f$ function is a PRF....
1
vote
2answers
92 views

Are Feistel ciphers subject to the birthday bound?

This paper seems to be saying that a balanced Feistel cipher can be broken when an adversary has $2^{0.5 \cdot n}$ pairs of plaintext and cipher text blocks where $n$ is the block size in bits. Is ...
3
votes
1answer
2k views

Feistel cipher key generation and round function algorithms

I'm getting confused of what is the actual structure of the key generation and the round function algorithms that Feistel cipher uses. I have been reading many resources about block cipher. All ...
1
vote
0answers
294 views

Known plaintext attack against Feistel ciphers

Assuming we have a Feistel cipher, with let's say 2 rounds i.e: Plaintext $P=(L_{0},R_{0})$ $L_{1}=R_{0}$ $R_{1}=L_{0}\oplus f_{{K}_{1}}(R_{0})$ $L_{2}=R_{1}$ $R_{2}=L_{1}\oplus f_{{K}_{2}}(R_{1})...
2
votes
2answers
959 views

Difference between encryption and decryption for Feistel Cipher

I have read that the only difference between enc and dec of a Feistel Cipher is the order of the subkeys. But on the following figure, the harves block are also inverted, no? I don't understand why ...
3
votes
3answers
143 views

Why are the right halves kept unchanged in Feistel networks?

As I'm going through the Feistel network in the DES algorithm. While encryption uses a Feistel Network, the input block is divided into two halves left ($L$) and right half ($R$). In each round, the ...
5
votes
0answers
180 views

A novel encryption method using only a (huge) lookup table. Is this remotely secure? [closed]

So I've come up with an (admittedly impractical) encryption method using a lookup table. The table is a shuffled list of all unsigned 32-bit integers, effectively making it a 32-bit unkeyed PRP. I ...
13
votes
3answers
2k views

Why do Feistel ciphers need round keys?

Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
2
votes
1answer
432 views

In a Feistel cipher structure, what exactly does the “round function $F$” do?

In a Feistel cipher structure, what exactly does the "round function $F$" do to the right half of the data, before taking XOR of the output with the left half of the data?
4
votes
1answer
79 views

Are non bijective sboxes weaker (on feistel networks)?

I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible) Is that ...
3
votes
2answers
591 views

Disadvantages of the Feistel network

I have read about Feistel network and so far only advantages have been listed. Are there any disadvantages to the design? Please could you explain in fairly basic terms?
3
votes
2answers
373 views

Does XOR have diffusion properties?

Does the XOR operator provide diffusion if the right side of plain text is XORed against a round key which is then XORed against the left side to produce that side of cipher text, for example in a ...
3
votes
1answer
775 views

Is 3 rounds Feistel enough for making PRP

I know that one round of Feistel is not enough for making a PRP (Pseudo Random Permutation) even I know that two round is not enough how about three round of Feistel ? I read a lot but not usefull. ...
4
votes
1answer
284 views

Slide attack: creating an actual attack on the Simon Cipher

I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and ...
2
votes
1answer
275 views

2-round generalized Feistel network

Write the decryption of a 2-round generalized Feistel network given below. $P_i$ denotes plaintext blocks of each 32-bits. $RK_i$ denotes the round keys. $WK_i$ denotes 32-bit keys applied ...
0
votes
1answer
188 views

What is the importance of $f_k$ in a feistel network being a permutation

I was doing some cryptography exercises, one of which was an example of a feistel network. It said that the function $f_k$ was a permutation for all k but didn't explain why that makes a difference. ...
0
votes
1answer
283 views

Is a Feistel structure based cipher IND-CPA?

Using the format of the "game" to establish if a cipher is IND-CPA secure: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of them at random ...
5
votes
2answers
1k views

What is the definition of Feistel Cipher?

I know how Feistel Network works, but I want to know the exact definition of "Feistel Cipher" to solve several questions below: question 1: Is it correct to say DES (Data Encryption Standard) is ...
3
votes
1answer
94 views

“open-key model” attacks, why would one be concerned?

In a paper on a Feistel network, I found the line we have made no effort to guard against attacks in the open-key model and then I found this paper at iarc.org on the subject. I found only a ...
5
votes
2answers
666 views

Feistel-Network - why wire crossing?

In Feistel-Network, there would be a wire-crossing at the end (for the next round). Which insufficiency would occur, if the wire crossing would be omitted?
4
votes
1answer
128 views

Can you decrypt with 1 round key?

If one has the last round key in an SP or Feistel network (the 16th round key in DES for example), would that someone be able to decrypt the rest of the encryption?
4
votes
1answer
100 views

Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher? My thought is "yes" because: it already has ...
3
votes
1answer
514 views

How does Feistel cipher create diffusion between blocks?

From what I've read about Feistel ciphers, I can understand that within each block, there is both confusion and diffusion. But it is unclear to me how a Feistel cipher permutates among blocks of data. ...
4
votes
1answer
2k views

What is the diffrence between Feistel networks and SPN?

I recently read about the concept of Feistel Networks and Substitution Permutation Networks but what is exactly the difference between the two ?
5
votes
2answers
631 views

Need for 3 rounds in Luby Rackoff theorem

I get that using Feistel network we can create a secure PRP from a secure PRF (in 3 rounds according to theorem). My question is why not just 2 rounds of Feistel network is sufficient. Is it that ...
-2
votes
1answer
139 views

What is the security gain of applying Two S-boxes in Different Ways?

In a 128-bits Feistel Cipher: I need suggestions about two variations of the Round Function Variation-1 $64$ bit input is divided into $8$ bytes Byte $0,1,2,3$ are substituted with Sbox1 Byte $4,5,...
2
votes
1answer
65 views

reconstructing data on a noisy channel?

I have an interesting situation where I have a block cipher and a noisy channel. The interesting thing is that I happen to know much about the data. The cipher is a balanced Feistel network, and for ...
2
votes
1answer
211 views

Doubling the block length of a given block cipher

IMHO the main essence of a Feistel cipher of block length $n$ is the working of a non-linear function $F$ that is applied to the two halves of the block of length $n/2$. Now suppose a certain block ...
3
votes
0answers
51 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,...
6
votes
1answer
348 views

Big block cipher as memory-hard function

I'm wondering, if something like block cipher with big block size is a good memory-hard function? All memory-hard key derivation functions I've seen look more complex than that, which made me ...
3
votes
1answer
502 views

Can the round function $F$ in a Feistel Network be practically any non-invertible function?

This question might seem silly, but how true is the fact that the round function $F$ does not have to be invertible? I am curious to know this, because non-invertible functions can be very lossy, i.e....
5
votes
0answers
265 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistal ...
1
vote
0answers
78 views

2 round GOST_28147-89 cipher distinguisher

So, here is the scheme of how this will look graphically: The deal is to present distinguisher for this cipher. First of all here is my drafts: Way 1 Assume that distinguisher displays in constant ...
4
votes
1answer
537 views

Using a hash (like SHA-256) vs AES as the source for pseudo-random values in Feistel network?

This question is in relation to Wikipedia article on Format Preserving Encryption It says the following It is also possible to make a FPE algorithm using a Feistel network. A Feistel network ...