FF3

FF3 is based on the 2010 BPS construction: an eight-round Feistel network with a fixed 64-bit tweak that is split in half and alternated between rounds. Fewer rounds than FF1 made it faster, which was rather the point.

In 2017 Durak and Vaudenay showed the tweak handling could be exploited: by combining pairs of tweaks an attacker could recover encrypted values in small domains with a practical amount of data. NIST responded with FF3-1, shrinking the tweak to 56 bits. In 2021 Tim Beyne published a linear attack on FF3-1, and a 2025 draft from NIST proposed dropping the mode from the standard altogether. That leaves FF1, the slower and more boring candidate — which in cryptography tends to be a compliment.