Editing Feistel cipher (section)

===Unbalanced Feistel cipher===
Unbalanced Feistel ciphers use a modified structure where <math>L_0</math> and <math>R_0</math> are not of equal lengths.<ref>{{cite book |last1=Schneier |first1=Bruce |last2=Kelsey |first2=John |title=Fast Software Encryption |chapter=Unbalanced Feistel networks and block cipher design |volume=1039 |date=21 February 1996 |pages=121–144 |doi=10.1007/3-540-60865-6_49 |url=https://www.schneier.com/academic/paperfiles/paper-unbalanced-feistel.ps.gz |access-date=21 November 2017 |language=en |series=Lecture Notes in Computer Science |isbn=978-3-540-60865-3}}</ref> The [[Skipjack (cipher)|Skipjack]] cipher is an example of such a cipher. The [[Texas Instruments]] [[digital signature transponder]] uses a proprietary unbalanced Feistel cipher to perform [[challenge–response authentication]].<ref name="crypto-rfid">{{cite journal |last1=Bono |first1=Stephen |last2=Green |first2=Matthew |last3=Stubblefield |first3=Adam |last4=Juels |first4=Ari |last5=Rubin |first5=Aviel |last6=Szydlo |first6=Michael |title=Security Analysis of a Cryptographically-Enabled RFID Device |journal=Proceedings of the USENIX Security Symposium |date=5 August 2005 |url=https://www.usenix.org/event/sec05/tech/bono/bono.pdf |access-date=21 November 2017}}</ref>

The [[Thorp shuffle]] is an extreme case of an unbalanced Feistel cipher in which one side is a single bit. This has better provable security than a balanced Feistel cipher but requires more rounds.<ref name="thorp">{{cite book |last1=Morris |first1=Ben |last2=Rogaway |first2=Phillip |last3=Stegers |first3=Till |title=Advances in Cryptology - CRYPTO 2009 |chapter=How to Encipher Messages on a Small Domain |volume=5677 |date=2009 |pages=286–302 |doi=10.1007/978-3-642-03356-8_17 |url=http://www.cs.ucdavis.edu/~rogaway/papers/thorp.pdf |access-date=21 November 2017 |language=en |series=Lecture Notes in Computer Science |isbn=978-3-642-03355-1}}</ref>