Editing Block cipher (section)

===Feistel ciphers===
[[File:Feistel cipher diagram en.svg|thumb|right|265px|Many block ciphers, such as DES and Blowfish utilize structures known as ''[[Feistel cipher]]s'']]
{{Main|Feistel cipher}}
In a ''[[Feistel cipher]]'', the block of plain text to be encrypted is split into two equal-sized halves. The round function is applied to one half, using a subkey, and then the output is XORed with the other half. The two halves are then swapped.{{sfn|Katz|Lindell|2008|pp=170–172}}

Let <math>{\rm F}</math> be the round function and let
<math>K_0,K_1,\ldots,K_{n}</math> be the sub-keys for the rounds <math>0,1,\ldots,n</math> respectively.

Then the basic operation is as follows:{{sfn|Katz|Lindell|2008|pp=170–172}}

Split the plaintext block into two equal pieces, (<math>L_0</math>, <math>R_0</math>)

For each round <math>i =0,1,\dots,n</math>, compute

:<math>L_{i+1} = R_i\,</math>
:<math>R_{i+1}= L_i \oplus {\rm F}(R_i, K_i)</math>.

Then the ciphertext is <math>(R_{n+1}, L_{n+1})</math>.

The decryption of a ciphertext <math>(R_{n+1}, L_{n+1})</math> is accomplished by computing for <math>i=n,n-1,\ldots,0</math>

:<math>R_{i} = L_{i+1}\,</math>
:<math>L_{i} = R_{i+1} \oplus {\rm F}(L_{i+1}, K_{i})</math>.

Then <math>(L_0,R_0)</math> is the plaintext again.

One advantage of the Feistel model compared to a [[substitution–permutation network]] is that the round function <math>{\rm F}</math> does not have to be invertible.{{sfn|Katz|Lindell|2008|p=171}}