Abstract. In this paper, we describe new results on the security, in the Luby-Rackoff paradigm, of two modified Feistel constructions, namely the L-scheme, a construction used at various levels of the MISTY blockcipher which allows to derive a 2n-bit permutation from several n-bit permutations, and a slightly different construction named the R-scheme. We obtain pseudorandomness and super-pseudorandomness proofs for Lschemes and R-schemes with a sufficient number of rounds, which extend the pseudorandomness and non superpseudorandomness results on the 4-round L-scheme previously established by Sugita [Su96] and Sakurai et al. [Sa97] . In particular, we show that unlike the 3-round L-scheme, the 3-round R-scheme is pseudorandom, and that both the 5-round L scheme and the 5-round R scheme are super pseudorandom (whereas the 4 round versions of both schemes are not super pseudorandom). The security bounds obtained here are close to those established by Luby and Rackoff for the three round version of the original Feistel scheme.
In REF , Gilbert and Minier formalize the standard MISTY structure as the L-scheme and refer the dual structure as the R-scheme and provide the proof of (super) pseudorandomness.
New results on the pseudorandomness of some blockcipher constructions
in Proceedings of Fast Software Encryption (FSE 2001), Lecture Notes in Computer Science, Volume 2355, Pages
Computer Science Mathematics