Also known as: Feistel cipher
A Feistel network is a way of building a block cipher by splitting each block into two halves and, round after round, mixing one half into the other through a round function.1 Its defining property is that the same structure both encrypts and decrypts — the round function never has to be inverted, so it can be an arbitrary nonlinear mapping. The design is named for IBM cryptographer Horst Feistel and became the template for DES.
How it works
Write the block as a left half L and a right half R. One round computes
L' = R and R' = L ⊕ F(R, Kᵢ): the right half is fed through the round function F with a
round key Kᵢ, that output is XORed into the left half, and the halves swap. The elegance is
in the decryption. Given the round output (L', R'), the untouched half tells you R = L'
directly, so you can recompute F(R, Kᵢ) and undo the XOR to recover L = R' ⊕ F(L', Kᵢ).
Decryption is therefore the identical round machinery run with the round keys in reverse
order — you never need F⁻¹.
That is the key freedom the construction buys. Because F is never inverted, it can be any
mapping the designer likes, including a strongly nonlinear one built from
S-boxes, expansion, and bit permutations. The same silicon or code path
serves both directions, which historically saved gates in hardware.
A single round provides little security — half the block passes through untouched — so a real Feistel cipher repeats many rounds (DES uses 16), each with a different round key derived from the master key by a key schedule, until every output bit depends on every input and key bit. The Luby–Rackoff result gives the theoretical backing: with enough rounds and a good round function, a Feistel network is provably a secure pseudo-random permutation.
In practice
DES is the canonical Feistel cipher, and its lineage — Triple-DES, Blowfish, Twofish, Camellia, and the GOST cipher — kept the structure for decades. The main contrast is with the substitution-permutation network chosen for AES, which transforms the entire block every round (needing invertible layers) rather than carrying half of it forward unchanged. Feistel designs trade a little diffusion speed — it takes at least two rounds to touch every bit — for the convenience of a free-form, non-invertible round function.
Relevance to SDR
The classic Feistel cipher is DES, one of the algorithms used to encrypt P25 voice, so the construction sits behind some of the encrypted traffic GopherTrunk encounters. As with any strong cipher, the relevance is honest but bounded: GopherTrunk can identify an encrypted call but cannot recover its audio without the key.
The structure is also useful as an analysis template. The clean-room study of the Motorola P25 talker-alias obfuscation in issue #773 tested whether the scheme’s byte updates followed a Feistel-shaped split-and-mix pattern; that hypothesis was evaluated and ruled out from public on-air data alone, with no third-party source involved.
Sources
-
Feistel cipher — Wikipedia, for the split-half round structure, the non-invertible round function, and the fact that decryption reuses the same rounds in reverse. ↩