Questions tagged [feistel-network]

A feistel-network or feistel cipher is a structure that has been used to create a number of different block ciphers (e.g., DES, Blowfish, Twofish, RC6).

Filter by
Sorted by
Tagged with
1
vote
1answer
38 views

Unbalanced Feistel network function

I am trying to understand how an unbalanced Feistel network works. I came across this image: It says that the function takes $b$ bits to $y$ bits. Which works on the first step, however clearly doesn'...
8
votes
3answers
298 views

DES f function injective for no fixed subkey?

Let $f$ be the function used in a round of DES, as defined in FIPS 46-3: $$\begin{align} f:\{0,1\}^{32}\times\{0,1\}^{48}&\to\ \{0,1\}^{32}\\ (R,K)\ &\mapsto f(R,K)\underset{\mathsf{def}}=...
1
vote
1answer
89 views

DES F function never injective?

Now i know that the F function doesn't have to be injective, but is it NEVER injective? or is it possible to have an injective F function?
2
votes
0answers
29 views

Balanced Feistel networks: Are there any lower bounds on the computational complexity of breaking a $k$-round Feistel cipher?

This paper by Patarin presents an attack (section 9) on balanced Feistel networks with $k$ rounds, where the input is a bit-string is of length $2n$. (Since it is balanced, this means each PRF takes ...
1
vote
1answer
51 views

How many queries can you do (concretely, not asymptotically) for a balanced Feistel network with 7 rounds?

In this paper Patarin says that: "for every $\epsilon > 0$, when $m \ll 2^{n(1 - \epsilon)}$ ... for 7 rounds or more it is secure against all adaptive chosen plaintext attacks" where m is the ...
0
votes
0answers
32 views

Feistel Network - pseudorandomness

I want to ask about proving not pseudorandomness of Feistel network $(i=1)$ by formal definition: $$ |P[D^{F_k(\cdot)}(1^n) = 1] - P[D^{f(\cdot)}(1^n) = 1]| \le negl(n)$$ I understand how this works ...
5
votes
2answers
101 views

How random are permutations generated from Feistel networks with a small number of rounds?

I wrote a toy pseudo-random permutation out of a Feistel network using blake2b. However, looking at the distribution of permutations for small n = 6, it's clearly not uniform unless many rounds are ...
0
votes
0answers
54 views

Cryptanalysis of a Feistel network

I'm having some issues finding keys to a Feistel network. The function is unknown but we can have as many plaintexts and their given ciphertexts as we want. I'm trying to generalize the cryptanalysis ...
0
votes
0answers
28 views

does increasing the number of rounds in feistel increase the security [duplicate]

In feistel cipher , does it matter that number of rounds ? is using more rounds will give the best result? or it's all about the key size ?
4
votes
1answer
87 views

Would using perfect S-boxes in F function of an unbalanced Feistel network produce a simple and secure cipher?

When I read some articles about cryptography on wikipedia, I took note of the following statements (please, correct me, if any of these are wrong): Perfect S-box (based on bent functions) provides ...
3
votes
0answers
122 views

Why are cyclic keys in Feistel Networks insecure?

So everyone seems to agree that recurring round keys in a Feistel network (eg. using the same key for every round) are a massive security leak. When researching this, the only thing I found is the ...
0
votes
0answers
60 views

Constructing Differential Characteristics for Feistel Cipher

I have to construct for every i-round of Feistel cipher, for $i \in \{3,4,5,6,7,8\}$, a differential characteristic with there properties: $Pr[\Delta x = a \overset{f_i}{\rightarrow} \Delta y = b] = ...
4
votes
1answer
201 views

PRP vs PRF for the F-function of a Feistel network

A Feistel network is generally defined with a PRF for its F-function, but PRPs have been used as well. What are the theoretical cryptographic implications of using a PRP instead of a PRF? Does it ...
2
votes
1answer
60 views

1 round Feistel with birthday attack

This is a reprise of an earlier question of mine, and I'm sorry if it's repetitious; I'm going at it with a different strategy. In an exercise I was given a 1-round Feistel network which uses $H(k \...
2
votes
1answer
144 views

Attack on a Feistel Cipher given the key and half of the ciphertext

Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process. Is it possible to reconstruct the original data if half of the ciphered text is given? ...
-1
votes
2answers
372 views

Learning about Feistel Cipher

I'm learning about Feistel Ciphers at the moment, but having issues with the formulae, so I can't move on from it. Encryption: $𝐿𝐸_{𝑖+1} = 𝑅𝐸_𝑖$ $𝑅𝐸_{𝑖+1} = 𝐿𝐸_𝑖 \oplus 𝐹( 𝑅𝐸_𝑖 , 𝐾...
1
vote
1answer
271 views

Final Permutation in Feistel function

As the final permutation of the Feistel function is the inverse of the initial permutation, it undoes the initial permutation.So how is this helpful?
2
votes
1answer
324 views

DES/AES invertibility

My professor has posted a couple of practice questions that so far I haven't been able to find the answer for and I was hoping you could help. DES would remain invertible—it would still be ...
2
votes
1answer
471 views

One-round feistel network (DES) attack

I can't find out how to break 1 round of feistel network (obtaining the key). I understand why this equation takes place: $R_1 \oplus L_0 = f(R_0, k_1)$ EDIT: The function f looks like this: But ...
8
votes
1answer
396 views

How to find fixed points for DES weak keys

Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that: each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
5
votes
2answers
1k views

How can I prove that a Feistel round is its own inverse for DES?

I'm having difficulty on proving the fact that each round of DES algorithm is its own inverse. Can someone put a concise explanation for it please? If a function, say $f$ ,is its own inverse than $f(...
0
votes
1answer
1k views

Why 3 round Feistel cipher are not common

Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation. Question: why are 3 round Feistel Ciphers not common? My thoughts about the round ...
2
votes
4answers
675 views

feistel cipher and number of rounds

In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same? in cryptography and network security by ...
1
vote
1answer
56 views

RoR Attacks on modified Feistel Network

It is known that a Feistel Network containing 3 rounds is relatively secure against Chosen Plaintext attacks. Now as a game I was given the task to find a possible attack against a Feistel Network ...
1
vote
1answer
615 views

Is this an example of a Feistel cipher?

Have tried to create simplest example. A,B,C,D are 32-bit unsigned, as is k[4]. P is an expansion type p-box of 256 "random" 32-bit values. Assume key-whitening and multiple rounds/keys ...
4
votes
3answers
684 views

What are the requirements from a Round function in Feistel network?

Let's assume a balanced network with many (dozens?) rounds. And a simple (selecting key bits) key schedule. What does it take from the round F function to make a secure block cipher? obviously we ...
2
votes
1answer
77 views

Unbalanced Feistel network only generates complete permutations with square lengths

I'm generating permutations with a generalized Feistel network which will output integer values $r_j$ in a specified range $[0,period]$ pseudo-randomly, according to the counter input, which will then ...
2
votes
3answers
584 views

Known-plaintext attack on 1-round Feistel networks

Consider a simple, 1-round Feistel network. Because the ciphertext is essentially $(L_1,R_1)$, if one knows the plaintext $(L_0,R_0)$, the only unknown left is $K$. However round functions in ...
15
votes
0answers
284 views

Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
2
votes
2answers
1k views

Why is a Feistel Network able to both encrypt and decrypt just by using the round keys in a different order

Using a feistel network, to encrypt something you can just use the round keys. But to decrypt it, the same order of processes is applied, however the keys are used in reverse. My question is: What ...
0
votes
1answer
401 views

AES and GOST 28147-89 “Magma” Comparison

I am trying to understand how AES is comparable to GOST 28147-89 "Magma". Like for parameters such as bit shifting and addition of the subkey to the input, which are a part of Magma, what is their ...
-1
votes
1answer
142 views

What is the result of encryption if Feistel cipher maps every 16 bit input to 0xFFFF regardless of subkey?

Suppose the F function of a 16 round Feistel cipher mapped every 16-bit input R, regardless of the value of the subkey K[r], to 0xFFFF What is the result of running an encryption with this cipher?
-1
votes
2answers
706 views

What is the output of an r-round Feistel network

What is the output of an r-round Feistel network when the input is (L0, R0) if Each round function is the identity function.
2
votes
0answers
410 views

Round function in Feistel

Following situation. We got a Feistel network. And in each round we get following outcome on the left side: $$L^\prime = L_1 \oplus F(K_1, R_1)$$ Is there a possible key to get an unchanged outcome ...
8
votes
1answer
444 views

Can a Feistel network have more than two halves, widening the block width?

Just to help form this question, this is a Feistel network:- To me this looks like:- Why does the generic architecture have to have two halves? We already have asymmetry in some variants. As I ...
2
votes
2answers
300 views

How does the round function in this particular Feistel cipher work?

I have this exercise that I found on the Internet. It is originally in French but it says: Exercise 3: (Feistel scheme). We consider a two-round Feistel cipher defined as follows: The ...
4
votes
1answer
201 views

Luby-Rackoff theorem for Generalized Feistel

I was reading about Luby-Rackoff theorem from various sources: [1], [2], [3], which says you need at least 3 rounds of a $2$-branch Feistel network to get a PRP if the underlying $f$ function is a PRF....
1
vote
2answers
125 views

Are Feistel ciphers subject to the birthday bound?

This paper seems to be saying that a balanced Feistel cipher can be broken when an adversary has $2^{0.5 \cdot n}$ pairs of plaintext and cipher text blocks where $n$ is the block size in bits. Is ...
3
votes
1answer
6k views

Feistel cipher key generation and round function algorithms

I'm getting confused of what is the actual structure of the key generation and the round function algorithms that Feistel cipher uses. I have been reading many resources about block cipher. All ...
1
vote
0answers
664 views

Known plaintext attack against Feistel ciphers

Assuming we have a Feistel cipher, with let's say 2 rounds i.e: Plaintext $P=(L_{0},R_{0})$ $L_{1}=R_{0}$ $R_{1}=L_{0}\oplus f_{{K}_{1}}(R_{0})$ $L_{2}=R_{1}$ $R_{2}=L_{1}\oplus f_{{K}_{2}}(R_{1})...
2
votes
2answers
3k views

Difference between encryption and decryption for Feistel Cipher

I have read that the only difference between enc and dec of a Feistel Cipher is the order of the subkeys. But on the following figure, the harves block are also inverted, no? I don't understand why ...
3
votes
3answers
224 views

Why are the right halves kept unchanged in Feistel networks?

As I'm going through the Feistel network in the DES algorithm. While encryption uses a Feistel Network, the input block is divided into two halves left ($L$) and right half ($R$). In each round, the ...
5
votes
0answers
405 views

A novel encryption method using only a (huge) lookup table. Is this remotely secure? [closed]

So I've come up with an (admittedly impractical) encryption method using a lookup table. The table is a shuffled list of all unsigned 32-bit integers, effectively making it a 32-bit unkeyed PRP. I ...
14
votes
3answers
3k views

Why do Feistel ciphers need round keys?

Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
4
votes
1answer
661 views

In a Feistel cipher structure, what exactly does the “round function $F$” do?

In a Feistel cipher structure, what exactly does the "round function $F$" do to the right half of the data, before taking XOR of the output with the left half of the data?
3
votes
1answer
163 views

Are non bijective sboxes weaker (on feistel networks)?

I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible) Is that ...
4
votes
2answers
1k views

Disadvantages of the Feistel network

I have read about Feistel network and so far only advantages have been listed. Are there any disadvantages to the design? Please could you explain in fairly basic terms?
3
votes
2answers
646 views

Does XOR have diffusion properties?

Does the XOR operator provide diffusion if the right side of plain text is XORed against a round key which is then XORed against the left side to produce that side of cipher text, for example in a ...
3
votes
1answer
2k views

Is 3 rounds Feistel enough for making PRP

I know that one round of Feistel is not enough for making a PRP (Pseudo Random Permutation) even I know that two round is not enough how about three round of Feistel ? I read a lot but not usefull. ...
5
votes
1answer
478 views

Slide attack: creating an actual attack on the Simon Cipher

I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and ...