We examine a generalization of the concept of Feistel net works, whichwe call
Unbalanced Feistel Networks (UFNs). Like conventional Feistel networks, UFNs
consist of a series of rounds in which one part of the block operates on the rest
of the block. However, in a UFN the two parts need not be of equal size. Removing
this limitation on Feistel networks has interesting implications for designing ciphers
secure against linear and differential attacks. We describe UFNs and a terminology
for discussing their properties, present and analyze some UFN constructions, and
make some initial observations about their security.
It is notable that almost all the proposed ciphers that are based on Feistel
networks follow the same design construction: half the bits operate on the other
half. There is no inherent reason that this should be so; as we will demonstrate,
it is possible to design Feistel networks across a much wider, richer design space.
In this paper, we examine the nature of the structure of Feistel-based ciphers.
In particular, we examine the consequences of ``unbalanced'' structures in which
differentnumbers of bits are used as input and output to the F-function in each
round.
This paper is organized as follows. Section 2 reviews Feistel networks. Section
3 provides a taxonomy of Feistel networks, and places some previous Feistel-
based designs within this taxonomy. Section 3 gives some general analysis of
unbalanced Feistel networks in relation to linear and differential cryptanalysis.
Section 4 suggests some open problems and areas for future study. An appendix
shows a preliminary analysis of a specific block-cipher design based on the general
structure of Blowfish.
