
Making an invertible function out of non-invertible parts - chmaynard
https://www.johndcook.com/blog/2020/04/04/feistel-networks/
======
fyp
An unexpected application of feistel network is for creating neural networks
that are invertible!

[https://arxiv.org/abs/1802.07088](https://arxiv.org/abs/1802.07088)

~~~
fvncc
Another example is RealNVP, which has the same structure to enable inversion
(partition, process half, then use the result to mutate the other half in an
invertible way).

Sadly, I gather the computational performance Is pretty bad ..

[https://arxiv.org/abs/1605.08803](https://arxiv.org/abs/1605.08803)

------
thaumasiotes
This is a weird headline. It amounts to the claim that _f_ ( _x_ ) = _x_ \+ 3
is made from non-invertible parts because its "subcomponent" _g_ ( _x_ ) = 3
is non-invertible.

But who cares? Our _f(x)_ is as conceptually simple as an invertible function
can be. If we're going to consider it to have been assembled from non-
invertible parts, then what's interesting about the fact that an invertible
function can be assembled from non-invertible parts? It's impossible to define
any function, invertible or not, without using non-invertible parts -- by this
definition.

~~~
joppy
I think this is pretty dismissive of what the author is trying to explain: the
round functions for ciphers are non-invertible, and there is a construction
which strings them together such that the whole thing is invertible. That’s
pretty interesting!

Your example is also poorly chosen. f(x) = x + 3 is invertible because it is
the composition of two invertible functions, the identity (x => x) and the
add-three function (x => x + 3). If we took your f(x) = x + g(x) example, it
would be non-invertible for many g, for example when g(x) = -x. So I think
there really is something to be said for “assembling an invertible function
out of non-invertible parts”.

~~~
tgv
I think the parent's point is that it's not `f(x) = x + g(x)`, but `f(x) = x +
g(c)` for some c. Addition is invertible if one side is constant, no matter
how that constant is determined: g can be bijective or constant, it doesn't
matter for the invertibility of the addition.

~~~
thaumasiotes
Yes, the inclusion of the Feistel function makes the raw xor (a substitution
cipher) into a Vigenère cipher instead, where the encryption key differs
between locations in the text instead of being constant throughout.

But Vigenère ciphers aren't really an improvement on substitution ciphers.
(And they're not more non-invertible than simple substitution ciphers.) Most
of the work is being done by the transformation that swaps two halves of the
text between rounds.

------
nayuki
The article talks about Feistel networks and the most famous Feistel cipher,
DES. I wrote a spreadsheet where you can examine every bit of the computation
of DES encryption: [https://www.nayuki.io/page/des-cipher-internals-in-
excel](https://www.nayuki.io/page/des-cipher-internals-in-excel)

