CCA security for contracting (quasi-)Feistel constructions with tight round complexity

Feistel constructions using contracting round functions were introduced in 1990s and generalized by Yun et al. (Des Codes Cryptogr 58(1):45–72, 2011) to a quasigroup-based definition. To our knowledge, the minimal number of rounds sufficient for CCA security remains elusive. We bridge this gap: for the general quasigroup-based contracting Feistel construction using round functions \(F_i: \mathcal {X}^{b-1} \rightarrow \mathcal {X}\) $F_i:{\mathcal{X}}^{b-1}\to \mathcal{X}$ , \(b \ge 3\) $b\ge 3$ , we prove CCA security at \(b+1\) $b+1$ rounds. This matches the attacked rounds of Patarin et al. (in: Lai, Chen (ed) ASIACRYPT, Springer, Heidelberg, 2006). Interestingly, this means 4 rounds are already sufficient for CCA security of the case \(b=3\) $b=3$ , which is the same as the balanced Feistel.