Full indifferentiability of low-round Feistel networks
Where exactly does the Feistel construction start being indifferentiable from a random permutation?
Motivation
The Feistel construction turns public random functions into a public pseudorandom permutation, and is the structural backbone of many block ciphers. Indifferentiability is the standard yardstick for whether such a construction is safe to use as a drop-in ideal-cipher substitute in larger protocols. Pinning down the exact round count at which it starts holding tells implementers precisely how many rounds are structurally necessary, not just sufficient.
Provenance and history
5-round Feistel has a known distinguishing attack (Coron, Patarin & Seurin, CRYPTO 2008), and 8 rounds and above are proven fully indifferentiable (Dai & Steinberger, CRYPTO 2016). Only public/sequential indifferentiability is known for 6 rounds (Mandal, Patarin & Seurin, 2012), leaving full indifferentiability at exactly 6 (and 7) rounds open.
Parameter lattice
Only one variant is stated on the site so far – the round count is the only axis in play, and only \(r=6\) has a statement here (the \(r\le5\) and \(r\ge8\) cases above are cited results, not separate leaves in this archive).
| Round count (\(r\)) | Full indifferentiability |
|---|---|
| \(r = 6\) | c/0001 – open |
| \(r = 7\) | unstated |