FEAL was suggested as a software-oriented cryptosystem which can be eas­ily and efficiently implemented on microprocessors. The structure of FEAL is similar to DES with a modified F function, initial and final permutations and key scheduling algorithm. In the F function, the P permutation and the S boxes of DES are replaced by byte rotations and addition operations. The S boxes S0 and S1 of FEAL get two input bytes and calculate one output byte as S i (x, y) = ROL2(x + y + i (mod 256)), where ROL2 rotates its input byte two bits to the left. The F function gets a 32-bit input and a 16-bit subkey and calculates a 32-bit output by applying the S boxes four times sequentially. The initial and the final permutations are replaced by initial and final transformations, in which the whole 64-bit data is XORed with 64-bit subkeys and the right half of the data is XORed with the left half. Figure 6.1 describes the structure of an eight-round FEAL and its F function. The key scheduling algorithm is replaced by a key processing algorithm, which makes the subkeys depend on the key in a more complex way. The key processing algorithm and its F k function are described in Figure 6.2.