IT lexicon › Security › BEAR and LION

BEAR and LION

Security På svenska → Updated: 2026-10-14

Two block ciphers with arbitrarily large blocks, assembled from a hash function and a stream cipher in three Feistel rounds.

Ross Anderson and Eli Biham presented them at FSE 1996. The block is split into a short half and a long half. BEAR runs keyed hash, stream cipher, keyed hash; LION does the reverse with stream cipher, hash, stream cipher. Security follows from a Luby–Rackoff argument: if the components hold, so does the cipher.

The snag in 1996 was that nobody needed kilobyte-sized blocks, and those who did were unwilling to pay for three passes over the data. The four-round variant LIONESS found a second career in Sphinx, the 2009 mixnet packet format, where each layer must be re-encrypted without its length giving anything away.

← Back to the lexicon