
 The Inner Structure of the Feistel Round 
  And here is the tableau for a Feistel round, which, for this example, is two rounds of a cipher that operates on four bit values with the Sbox (3,1,0,2) as the ffunction. 
  In other words, with a tworound Feistel cipher, the ffunction output is always the plaintext XOR the ciphertext, and so the subkey is found by inverting the ffunction, and comparing the result to the input, which is visible in the ciphertext for the second round, and visible in the plaintext for the first round. 
  What would be of concern in connection with the general security of block ciphers would be if one could easily take two known plaintexts, and solve a fourround Feistel cipher by imposing the constraint (essentially, on the result after the second round) that both sets of equations simultaneously have the same subkeys. 
 www.quadibloc.com /crypto/co040906.htm (3035 words) 
