Questions tagged [feistel-network]

A feistel-network or feistel cipher is a structure that has been used to create a number of different block ciphers (e.g., DES, Blowfish, Twofish, RC6).

Filter by
Sorted by
Tagged with
0 votes
0 answers
43 views

Unable to encrypt and decrypt using the Generalized-Feistel Cipher from Black & Rogaway paper

I am trying to implement the algorithm suggested in Section 5 of the Black & Rogaway paper titled "Ciphers with Arbitrary Finite Domains" in C++. It is a Feistel cipher that tries to ...
Drew's user avatar
  • 1
1 vote
0 answers
62 views

DES next round key

I don't understand which DES key is used in the next round of Feistel construction. As you can see below, we use our original key that has been inserted in permuted choice 1, where we got 56 bits, ...
joxavy's user avatar
  • 11
1 vote
1 answer
335 views

Does a Feistel cipher structure have to be reversible? [duplicate]

Not sure about this question. Have thought about it, but not entirely sure whether the structure HAS to be reversible or not.
z009's user avatar
  • 11
0 votes
0 answers
58 views

Can a byte/word inserted as an entry in a Feistel S-box be breakable?

Let's suppose I insert these two 4-byte words (32-bits) in a feistel S-box with 1024-bytes of size (256*32-bits), (like Blowfish does): blah bleh What kind of attacks could possible be made to ...
phantomcraft's user avatar
3 votes
0 answers
72 views

In Feistel block ciphers, does using a weak but iterated encryption function result in a cryptographically strong cipher? [duplicate]

There is a Feistel block cipher based on Blowfish called Kaweichel. In one of its papers, there is this affirmation: For the construction of the round function one choses usually parallel ...
phantomcraft's user avatar
3 votes
1 answer
131 views

Devising a Feistel cipher in which the subkeys are constructed badly so that a meet in the middle attack will compromise its security

I'm trying to find a Feistel cipher in which the subkeys are constructed badly so that a meet in the middle attack will compromise its security. I thought about trying out a cipher where all the ...
SVMteamsTool's user avatar
1 vote
1 answer
65 views

Does inserting an entry of 32/64-bits into a Feistel S-box would consume the same cycles per byte as inserting a single byte?

Blowfish splits a 32-bit word into 4 bytes and insert each byte as an entry in a S-box. Let's suppose I do the same but with an entire word, 32 or 64-bits. MARS block cipher does the same with 32-bit ...
phantomcraft's user avatar
0 votes
0 answers
84 views

Security of Blowfish with secret S-boxes

There are similar questions about secret S-box(es), but none of them about secret Blowfish (or any other canonical Feistel cipher) S-Boxes, only about secret AES S-Box. Let's suppose that instead of ...
phantomcraft's user avatar
2 votes
1 answer
77 views

Can the security margin of any Feistel block cipher be multiplied if I just multipy the number of rounds and use different random subkeys each round?

Kaweichel is a port of Blowfish for 64-bit architectures, its key size accepted is 1920-bytes, instead of 16 rounds it has 32 rounds, the double of Blowfish. ICE is a feistel block cipher that has a ...
phantomcraft's user avatar
4 votes
1 answer
431 views

Matsui's linear attack on 5-round DES

I'm trying to understand Mitsuru Matsui's "Linear Cryptanalysis Method for DES Cipher", specifically the attack he describes at the end of section 5, on 5-round DES. I followed the attack on ...
Federico Lebrón's user avatar
3 votes
0 answers
190 views

Is it necessary for a round function $F$ in a Feistel cipher to be pseudorandom?

I stumbled across this question where the questioner asked for specific requirements for the round function $F$ in a Feistel network so that the construction is secure. The answer explained that a ...
trivicious's user avatar
2 votes
1 answer
167 views

Indistinguishability versus Indifferentiability

What is the Indifferentiability of Feistel Network? Why is the concept of Indifferentiability useful and how it is applicable in the real world? How is Indifferentiability compared to ...
Novice_researcher's user avatar
2 votes
1 answer
391 views

Why key reuse is not an issue in a Feistel cipher?

I have a good understanding of stream ciphers and one time pad. I also know the dangers of using the same key in a PRG for a stream cipher. However as far as I can tell, the Feistel block cipher uses ...
Abhisek Dash's user avatar
1 vote
1 answer
97 views

How internal functions are defined for FF3?

I have seen FF1/FF3 being said that they preserve the same format as that of the plaintext. For example, if I encrypt a decimal number 1234 then its encrypted value is also a 4 digit decimal number. ...
Novice_researcher's user avatar
2 votes
0 answers
69 views

Provably Secure FPEs vs Practically Used FPEs

I have just checked a few FPE schemes like "Swap-or-not", "Mix-and-cut" which are provably secure. What techniques do the provably secure FPE scheme provably secure? The FPE ...
Novice_researcher's user avatar
1 vote
0 answers
594 views

FF1 vs FF3 FPE Encryption

FF1 and FF3 both are Feistel-based FPE schemes with r=10 rounds and 8 rounds respectively. The other difference I got to know is that the FF1 considers the right half of the message bigger while FF3 ...
Novice_researcher's user avatar
0 votes
1 answer
281 views

AES and the Feistel Structure Used Together?

In Dual Watermarking in Tele-radiology using DWT for Data Authentication and Security, the authors wrote: The encryption process uses the Feistel structure consisting multiple rounds for processing ...
Nikhil Soni's user avatar
1 vote
0 answers
130 views

Formal security arguments for 3 round feistal network using PRF

There is a proof sketch in Introduction to modern cryptography that a three-round feistel network using pseudorandom round functions is a secure pseudorandom permutation PRP Πk against probabilistic ...
Chulbuli's user avatar
1 vote
0 answers
159 views

Four round Feistel network using pseudo random round function [closed]

I am solving a four-round Feistel network using pseudo-random round function is a strong pseudo-random function for security against adversaries, but I don't understand that how to solve I know 3 ...
Mary's user avatar
  • 11
4 votes
2 answers
848 views

Why is a Feistel Network invertible?

As it is depicted above, the Feistel Network uses random function fi which is not required to be invertible. However, if fi is not invertible, how can fi(Li) == fi(Ri-1)? Furthermore, why Feistel ...
Xinyu Tu's user avatar
0 votes
0 answers
98 views

In Feistel cipher, is it possible to get LE0 from RE16 and RE0?

The notation I'm using here is from my textbook. I'm doing a CTF challenge where I need to know the value of $LE_0$. For now, I only have $RE_0$ and $RE_{16}$. I would like to know if it's possible to ...
Taiyou Kuo's user avatar
0 votes
1 answer
208 views

Problems with Matsui's Linear Cryptanalysis on round reduced DES

I'm trying to understand the known plaintext attack that is briefly explained in the paper Linear Cryptanalysis Method for DES Cipher by Mitsuru Matsui. I've almost understood it (since I'm ...
Cogito's user avatar
  • 3
0 votes
1 answer
157 views

Can we design a block cipher based on SP-network without loss of E/D similarity theoretically?

I understand what SP-network (Substitution-Permutation Network) and Feistel Network look like. And those ciphers based on Feistel (e.g. DES) often achieve so called E/D similarity, which indicates ...
Max1z's user avatar
  • 145
2 votes
1 answer
365 views

Unbalanced numeric Feistel network implementation

After reading a comprehensive paper [1] covering various kinds of generalized Feistel networks, I've tried to implement the Unbalanced Numeric Feistel variant, which relies on modular arithmetic for ...
0x2b3bfa0's user avatar
  • 123
3 votes
1 answer
4k views

Two Round Feistel network

While reading on block ciphers and DES I read that two-round Feistel network is not a secure PRP? Is there any easy to understand proof to explain the intuition behind this statement. I did search ...
Alex's user avatar
  • 321
2 votes
1 answer
335 views

Unbalanced Feistel network function

I am trying to understand how an unbalanced Feistel network works. I came across this image: It says that the function takes $b$ bits to $y$ bits. Which works on the first step, however clearly doesn'...
yolo expectz's user avatar
8 votes
3 answers
528 views

DES f function injective for no fixed subkey?

Let $f$ be the function used in a round of DES, as defined in FIPS 46-3: $$\begin{align} f:\{0,1\}^{32}\times\{0,1\}^{48}&\to\ \{0,1\}^{32}\\ (R,K)\ &\mapsto f(R,K)\underset{\mathsf{def}}=...
fgrieu's user avatar
  • 140k
1 vote
1 answer
186 views

DES F function never injective?

Now i know that the F function doesn't have to be injective, but is it NEVER injective? or is it possible to have an injective F function?
Prawns82's user avatar
2 votes
0 answers
72 views

Balanced Feistel networks: Are there any lower bounds on the computational complexity of breaking a $k$-round Feistel cipher?

This paper by Patarin presents an attack (section 9) on balanced Feistel networks with $k$ rounds, where the input is a bit-string is of length $2n$. (Since it is balanced, this means each PRF takes ...
Daniel-耶稣活着's user avatar
1 vote
1 answer
176 views

How many queries can you do (concretely, not asymptotically) for a balanced Feistel network with 7 rounds?

In this paper Patarin says that: "for every $\epsilon > 0$, when $m \ll 2^{n(1 - \epsilon)}$ ... for 7 rounds or more it is secure against all adaptive chosen plaintext attacks" where m is the ...
Daniel-耶稣活着's user avatar
7 votes
2 answers
616 views

How random are permutations generated from Feistel networks with a small number of rounds?

I wrote a toy pseudo-random permutation out of a Feistel network using blake2b. However, looking at the distribution of permutations for small n = 6, it's clearly not uniform unless many rounds are ...
Arthur B's user avatar
  • 265
0 votes
0 answers
84 views

Cryptanalysis of a Feistel network

I'm having some issues finding keys to a Feistel network. The function is unknown but we can have as many plaintexts and their given ciphertexts as we want. I'm trying to generalize the cryptanalysis ...
rollersg's user avatar
0 votes
0 answers
30 views

does increasing the number of rounds in feistel increase the security [duplicate]

In feistel cipher , does it matter that number of rounds ? is using more rounds will give the best result? or it's all about the key size ?
Nadjib Rahmani's user avatar
4 votes
1 answer
303 views

Would using perfect S-boxes in F function of an unbalanced Feistel network produce a simple and secure cipher?

When I read some articles about cryptography on wikipedia, I took note of the following statements (please, correct me, if any of these are wrong): Perfect S-box (based on bent functions) provides ...
MadCake - Reinstate Monica's user avatar
3 votes
0 answers
510 views

Why are cyclic keys in Feistel Networks insecure?

So everyone seems to agree that recurring round keys in a Feistel network (eg. using the same key for every round) are a massive security leak. When researching this, the only thing I found is the ...
Lukor's user avatar
  • 165
4 votes
1 answer
473 views

PRP vs PRF for the F-function of a Feistel network

A Feistel network is generally defined with a PRF for its F-function, but PRPs have been used as well. What are the theoretical cryptographic implications of using a PRP instead of a PRF? Does it ...
forest's user avatar
  • 15.2k
2 votes
1 answer
117 views

1 round Feistel with birthday attack

This is a reprise of an earlier question of mine, and I'm sorry if it's repetitious; I'm going at it with a different strategy. In an exercise I was given a 1-round Feistel network which uses $H(k \...
Chris's user avatar
  • 141
2 votes
1 answer
398 views

Attack on a Feistel Cipher given the key and half of the ciphertext

Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process. Is it possible to reconstruct the original data if half of the ciphered text is given? ...
Salsifis's user avatar
  • 123
0 votes
2 answers
2k views

Learning about Feistel Cipher

I'm learning about Feistel Ciphers at the moment, but having issues with the formulae, so I can't move on from it. Encryption: $𝐿𝐸_{𝑖+1} = 𝑅𝐸_𝑖$ $𝑅𝐸_{𝑖+1} = 𝐿𝐸_𝑖 \oplus 𝐹( 𝑅𝐸_𝑖 , 𝐾...
terodee's user avatar
  • 13
1 vote
1 answer
640 views

Final Permutation in Feistel function

As the final permutation of the Feistel function is the inverse of the initial permutation, it undoes the initial permutation.So how is this helpful?
Lucifer's user avatar
  • 71
2 votes
1 answer
1k views

DES/AES invertibility

My professor has posted a couple of practice questions that so far I haven't been able to find the answer for and I was hoping you could help. DES would remain invertible—it would still be ...
user avatar
2 votes
1 answer
2k views

One-round feistel network (DES) attack

I can't find out how to break 1 round of feistel network (obtaining the key). I understand why this equation takes place: $R_1 \oplus L_0 = f(R_0, k_1)$ EDIT: The function f looks like this: But ...
user3343396's user avatar
6 votes
1 answer
324 views

On CPA & KPA security of $\boxplus$-Feistel

I am interested to identify the effect of replacing $\oplus$ with $\boxplus$ on basic balanced Feistel structures over $r$-rounds. Given: $F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$ where $f$ is a ...
hardyrama's user avatar
  • 2,074
8 votes
2 answers
979 views

How to find fixed points for DES weak keys

Can someone explain me this please I am a bit confused? It's from a texbook I am reading (block cipher companion) it says that: each weak key has $2^{32}$ fixed points $m$ where $\operatorname{...
esra's user avatar
  • 869
6 votes
2 answers
4k views

How can I prove that a Feistel round is its own inverse for DES?

I'm having difficulty on proving the fact that each round of DES algorithm is its own inverse. Can someone put a concise explanation for it please? If a function, say $f$ ,is its own inverse than $f(...
esra's user avatar
  • 869
2 votes
1 answer
2k views

Why 3 round Feistel cipher are not common

Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation. Question: why are 3 round Feistel Ciphers not common? My thoughts about the round ...
kelalaka's user avatar
  • 48.3k
3 votes
4 answers
3k views

feistel cipher and number of rounds

In feistel cipher , does it matter that number of rounds be 16 ? is using 16 rounds will give the best result ? Or using any number of rounds is the same? in cryptography and network security by ...
Masoud_qashqai's user avatar
1 vote
1 answer
85 views

RoR Attacks on modified Feistel Network

It is known that a Feistel Network containing 3 rounds is relatively secure against Chosen Plaintext attacks. Now as a game I was given the task to find a possible attack against a Feistel Network ...
Leanhope's user avatar
1 vote
1 answer
1k views

Is this an example of a Feistel cipher?

Have tried to create simplest example. A,B,C,D are 32-bit unsigned, as is k[4]. P is an expansion type p-box of 256 "random" 32-bit values. Assume key-whitening and multiple rounds/keys ...
Chris Miller's user avatar
5 votes
3 answers
2k views

What are the requirements from a Round function in Feistel network?

Let's assume a balanced network with many (dozens?) rounds. And a simple (selecting key bits) key schedule. What does it take from the round F function to make a secure block cipher? obviously we ...
Meir Maor's user avatar
  • 11.8k