Consider a Feistel cipher with r rounds and n = 128 (half the block length); = 256 (the key bit size). Then M {0, 126 (the plaintext space), C = {0, 13256 (the ciphertext space), and K= {0, 13256 (the key space). A key scheduling algorithm determines subkeys k, k from a key KEK = {0, 13256. Each subkey k, determines a function f {0, 13128 (0,1}128, Encryption takes r rounds: : Plaintext is m = (mo, m) with mo, m {0, 1}128, Round 1: (mo, m) (m, m) with m = mg Round 2: (m, m) (m, ma) with my = my fi(m). fa(m). Round r: (m,-1, m,) (me, me+1) with m41 = mr-1 fr(mr). The ciphertext is c = (mr, mr+1). For the Feistel cipher described above: 1. Describe an algorithm for the decryption process for a ciphertext input c = (m,,mr+1). You should use a notation similar to the encryption procedure as described above. 2. Draw a figure for your decryption algorithm. Exercise 2 (Security of Feistel ciphers (4+4 marks)) 1. Consider the above Feistel cipher with r= 2 rounds. Is this Feistel cipher secure against an exhaustive key search attack, in the known-plaintext attack model? What does the complexity of such an attack depend on? Explain. 2. Consider the above Feistel cipher with r = 2 rounds. Imagine a key scheduling algorithm that works as follows. Given KEK = {0, 1) 256, set k to be the leftmost 128 bits of K, and k to be the rightmost 128 bits of K, then define f(x)=zk. Show that this block cipher is totally insecure that is, given a single plaintext-ciphertext pair (m, c), the secret key K can be easily recovered. Hint: linearity is the problem here.