Feistel Networks: Indifferentiability at 10 Rounds

We prove that a (balanced) 10-round Feistel network is indifferentiable from a random permutation. In a previous seminal result, Holenstein et al. [17] had established indifferentiability of Feistel at 14 rounds. Our simulator achieves security O(q/2) and query complexity O(q), where n is half the block length, similarly to the 14-round simulator of [17], so that our result is a strict (and also the first) improvement of [17]. Our simulator is very similar to a 10-round simulator of Seurin [29] that was subsequently found to be flawed [17,30]. Indeed, the main change of our simulator is to switch to “FIFO” path completion from “LIFO” path completion. This relatively minor change results in an overall significant paradigm shift, including a conceptually simpler proof.