Feistel Cipher Structure

• Horst Feistel of IBM, 1973

• Input is plaintext block of length 2w bits (usually 64) and a key K

• Block is divided into two halves, L0 and R0

• Each round i has inputs Li-1 and Ri-1, derived from the previous round, along with subkey Ki

• Substitution is performed on the left half of the data

• Round function F applied to right half and then XOR’d with left