14
votes
Accepted
Can a Feistel network have more than two halves, widening the block width?
There are designs called generalised unbalanced feistel networks which do exactly this.
See the paper by Schneier and Kelsey here. The CAST cipher, an AES competition entry was an early example.
The ...
- 19.9k
13
votes
Accepted
Need for 3 rounds in Luby Rackoff theorem
The simple answer is that fewer than 3 rounds can be easily distinguished from a random permutation. The 2-round Luby-Rackoff cipher on $2n$ bits, using random functions $f_i$ mapping $n$ bits to $n$ ...
- 12.2k
13
votes
Accepted
Why do Feistel ciphers need round keys?
Iterated ciphers need variability between rounds to resist so callad Slide attacks. One common way to thwart this attack is with a key schedule generating different round keys for each round.
Slide ...
- 146
12
votes
Why do Feistel ciphers need round keys?
This is due to Luby and Rackoff's proof about Feistel networks. The proof assumes the PRFs are independent. See sections 4.5 and 5 of How to Construct Pseudorandom Permutations from Pseudorandom ...
- 31.8k
11
votes
Feistel-Network - why wire crossing?
Let's look at a picture of a generic feistel cipher
Notice that no keying material is used during or after that final swap. So, we can conclude that the final swap does not impact security at all.
...
- 38.3k
9
votes
Feistel-Network - why wire crossing?
It's there to facilitate a simple implementation. As there is no key addition applied afterwards, the final swapping of the halves does not contribute towards security.
The Feistel cipher entry on ...
- 19.4k
9
votes
Accepted
Using a hash (like SHA-256) vs AES as the source for pseudo-random values in Feistel network?
A Feistel network is a way of constructing an invertible permutation from a (possibly non-invertible) function. If the function used is pseudorandom and has a large domain, then 3-4 rounds yields a ...
- 27.4k
9
votes
Accepted
Why 3 round Feistel cipher are not common
The main issue is that this only holds if you start with a PRF. Constructing a secure PRF is just as hard as constructing a secure strong PRP, so haven't gained much. In practice we typically start ...
- 24.6k
9
votes
Accepted
How to find fixed points for DES weak keys
I answer in hopefully didactic order.
What does the author mean by the intermediate texts exactly?
The intermediate texts after $n$ rounds are the 64-bit quantities $L_n\mathbin\|R_n$, numbering ...
- 134k
8
votes
Why is AES not a Feistel cipher?
The simple answer is "Because its an SPN cipher".
What is difference between Feistel and SPN?
SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then ...
- 2,377
8
votes
What is an active S-Box?
You run the algorithm with two different plaintexts (whose difference is usually small – just a few bits, everything else being equal).
Wherever these plaintexts lead to different inputs to an S-box ...
- 81
8
votes
In a Feistel cipher structure, what exactly does the "round function $F$" do?
What exactly does the "round function F" do
Pretty much anything it wants, with the proviso that it must be a deterministic function of the right hand data and the keying data; it cannot depend on ...
- 140k
7
votes
Accepted
Slide attack: creating an actual attack on the Simon Cipher
You should read David Wagner's original paper. You can see all of his work here.
He authored the 'Slide Attack', 'Advanced Slide Attacks' and a few more related to the attack.
Wikipedia has a good ...
- 295
7
votes
Accepted
How random are permutations generated from Feistel networks with a small number of rounds?
The Luby-Rackoff theorem says that a 3-4 round Feistel network is a pseudorandom permutation for some sufficiently large block size. As this paper by Patarin on Feistel networks with 5 or more rounds ...
- 14.3k
7
votes
Accepted
Two Round Feistel network
I read that two-round Feistel network is not a secure PRP
That's easily seen:
It holds $P_L\oplus C_L=F_0(P_R)$. That implies a distinguishable property: ...
- 134k
6
votes
Need for 3 rounds in Luby Rackoff theorem
It's required for diffusion and achieving the avalanche effect.
The concept of diffusion and the avalanche effect basically means that each input bit should influence each output bit evenly. Changing ...
- 19.4k
6
votes
Accepted
What is the definition of Feistel Cipher?
According to Definition 7.81 given by Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone's Handbook of Applied Cryptography,
A Feistel cipher is an iterated cipher mapping a $2t$-bit ...
- 134k
6
votes
Accepted
What is the diffrence between Feistel networks and SPN?
In a Feistel networks (from the German IBM cryptographer Horst Feistel), the input is divided into two blocks ($L_0$ and $R_0$) which interact with each other. Main example is DES.
basic construction:...
- 9,909
6
votes
Why do Feistel ciphers need round keys?
It does not make sense to say that any fixed function $F$ "is a good PRF". A distribution on functions can, however, be pseudorandom (indistinguishable from the uniform distribution over the set of ...
- 126
6
votes
Accepted
How can I prove that a Feistel round is its own inverse for DES?
There's a simple way by which "each round of DES algorithm is its own inverse". Consider round $n$ of DES as involving (almost only) a function $g_n$ with
$$g_n(L\mathbin\|R)=\bigl(L\oplus f(R,K_n)\...
- 134k
6
votes
Accepted
DES f function injective for no fixed subkey?
First thing to observe is that a DES-like confusion function can be a permutation, depending on the contents of the S-boxes. DES S-boxes are formally defined as $6\rightarrow 4$ functions, with the ...
- 86.1k
5
votes
What is the importance of $f_k$ in a feistel network being a permutation
I assume that you are referring to the round function. This is false. The whole advantage of a Feistel network is that $f_k$ does not need to be a permutation. Indeed in DES, it is not a permutation. ...
- 27.4k
5
votes
Accepted
Is 3 rounds of Feistel enough for making a PRP?
Wel'll consider a symmetric Feistel cipher with $n$-bit block using ideal independent random functions at each round.
Making it computationally indistinguishable from a random permutation requires ...
5
votes
Accepted
Does XOR have diffusion properties?
Let's take the definition from Wikipedia:
Diffusion means that if we change a single bit of the plaintext, then (statistically) half of the bits in the ciphertext should change, and similarly, if ...
- 90.2k
5
votes
Accepted
Disadvantages of the Feistel network
Well, what are we comparing Feistel networks to? The other major design paradigm is SPN: https://en.wikipedia.org/wiki/Substitution-permutation_network. In comparison to SPN, the cons are:
Not a ...
- 791
5
votes
Accepted
PRP vs PRF for the F-function of a Feistel network
Does it impact Luby and Rackoff's observation regarding 3 and 4-round Feistel networks with ideal F-functions?
No.
What are the theoretical cryptographic implications of using a PRP instead of a ...
- 45.5k
4
votes
Why is a Feistel network not a type of substitution-permutation network?
In the substitution step of a typical Substitution-Permutation Network (e.g. in AES SubBytes), the whole state is broken in parts and each part substituted. That's not the case in (the core of) a ...
- 134k
4
votes
Accepted
Big block cipher as memory-hard function
I've been toying around with your function, and I've come to the conclusion it's not memory hard. The amount of required memory can be reduced to at maximum ...
- 490
4
votes
Accepted
Can the round function $F$ in a Feistel Network be practically any non-invertible function?
Yes you could use a hash function as round function, but if you are using the "same key" over all rounds, you are vulnerable to slide attacks. Using a hash function is not a very good idea.
Your ...
- 188
4
votes
Accepted
How does Feistel cipher create diffusion between blocks?
If a message is longer than the block length, how would changing one
part of the message affect the encryption of other parts of the
message?
That really doesn't depend on the block cipher in use,...
- 45.5k
Only top scored, non community-wiki answers of a minimum length are eligible