MENU
If the round function is a cryptographically secure pseudorandom function, then ___________ rounds is sufficient to make the block cipher a pseudorandom permutation.
3
https://en.wikipedia.org/wiki/Feistel_cipher
Michael Luby and Charles Rackoff analyzed the Feistel cipher construction, and proved that if the round function is a cryptographically secure pseudorandom function, with Ki used as the seed, then 3 rounds are sufficient to make the block cipher a pseudorandom permutation, while 4 rounds are sufficient to make it a 'strong' pseudorandom permutation (which means that it remains pseudorandom even to an adversary who gets oracle access to its inverse permutation). Because of this very important result of Luby and Rackoff, Feistel ciphers are sometimes called Luby--Rackoff block ciphers.