Why 3 round Feistel cipher are not common Luby and Rackoff showed that 3 rounds are sufficient to make the Feistel networks a pseudorandom permutation.

Question: why are 3 round Feistel Ciphers not common?

My thoughts about the round functions of Luby and Rackoff construction are


They are hard to find one
They are hard to analyze
They are complex to fit small devices.
3 rounds of Luby and Rackofd constructions are slower than 16 rounds non-Luby and Rackoff constructions. Assuming that they have the same security.
The main issue is that this only holds if you start with a PRF. Constructing a secure PRF is just as hard as constructing a secure strong PRP, so haven't gained much. In practice we typically start with constructing a PRP and then turn it in into a PRF, not the other way round.

Feistel based blockciphers use many rounds, because their round functions are individually weak but also faster than a PRF.

In addition we typically want a strong PRP, so you need at least four rounds, not three. Another limitation is that the block size must be big enough for the target security level (IIRC you need 2n-bit blocks for n-bit security while we often target a security level equal or higher than the block size (e.g. AES has 128-bit blocks and 128/192/256-bit keys with the security level matching the key size).



There is one area where Feistel constructions using a small number (two to four) strong round functions are popular: Large and variable width permutations. OAEP is based on a two round feistel structure. There is the EME mode for wide block encryption.