Unbalanced Feistel Networks and Block Cipher Design

We examine a generalization of the concept of Feistel networks, which we call Unbalanced Feistel Networks (UFNs). Like conventional Feistel networks, UFNs consist of a series of rounds in which one part of the block operates on the rest of the block. However, in a UFN the two parts need not be of equal size. Removing this limitation on Feistel networks has interesting implications for designing ciphers secure against linear and differential attacks. We describe UFNs and a terminology for discussing their properties, present and analyze some UFN constructions, and make some initial observations about their security. It is notable that almost all the proposed ciphers that are based on Feistel networks follow the same design construction: half the bits operate on the other half. There is no inherent reason that this should be so; as we will demonstrate, it is possible to design Feistel networks across a much wider, richer design space. In this paper, we examine the nature of the structure of Feistel-based ciphers. In particular, we examine the consequences of “unbalanced” structures in which different numbers of bits are used as input and output to the F-function in each round. This paper is organized as follows. Section 2 reviews Feistel networks. Section 3 provides a taxonomy of Feistel networks, and places some previous Feistelbased designs within this taxonomy. Section 3 gives some general analysis of unbalanced Feistel networks in relation to linear and differential cryptanalysis. Section 4 suggests some open problems and areas for future study. An appendix shows a preliminary analysis of a specific block-cipher design based on the general structure of Blowfish [Sch94b].