ABC
令 L D i , R D i {LD_i,RD_i} LDi,RDi代表解密过程的各状态, L E i , R E i {LE_i,RE_i} LEi,REi代表加密过程各状态
已知 L D 0 = R E 16 , R D 0 = L E 16 {LD_0=RE_{16}, RD_0=LE_{16}} LD0=RE16,RD0=LE16
假设 R D i − 1 = L E 16 − i + 1 , L D i − 1 = R E 16 − i + 1 , L D i = R D i − 1 = L E 16 − i + 1 = R E 16 − i {RD_{i-1}=LE_{16-i+1}, LD_{i-1}=RE_{16-i+1},LD_i=RD_{i-1}=LE_{16-i+1}=RE_{16-i}} RDi−1=LE16−i+1,LDi−1=RE16−i+1,LDi=RDi−1=LE16−i+1=RE16−i
R D i = L D i − 1 ⊕ f ( R D i − 1 , K 16 − i + 1 ) = {RD_{i}=LD_{i-1}\oplus f(RD_{i-1}, K_{16-i+1})=} RDi=LDi−1⊕f(RDi−1,K16−i+1)=
R E 16 − i + 1 ⊕ f ( R E 16 − i , K 16 − i + 1 ) = {RE_{16-i+1}\oplus f(RE_{16-i},K_{16-i+1})=} RE16−i+1⊕f(RE16−i,K16−i+1)=
[ L E 16 − i ⊕ f ( R E 16 − i , K 16 − i + 1 ) ] ⊕ f ( R E 16 − i , K 16 − i + 1 ) = L E 16 − i {[LE_{16-i}⊕f(RE_{16-i},K_{16-i+1})]⊕f(RE_{16-i},K_{16-i+1})=LE_{16-i}} [LE16−i⊕f(RE16−i,K16−i+1)]⊕f(RE16−i,K16−i+1)=LE16−i
则 L D i = R E 16 − i , R D i = L E 16 − i {LD_i=RE_{16-i} , RD_i=LE_{16-i}} LDi=RE16−i,RDi=LE16−i 因此 L D 16 = R E 0 , R D 16 = L E 0 {LD_{16}=RE_0, RD_{16}=LE_0} LD16=RE0,RD16=LE0