Scribed by Siu-Man Chan
Summary
Given one way permutations (of which discrete logarithm is a candidate), we know how to construct pseudorandom functions. Today, we are going to construct pseudorandom permutations (block ciphers) from pseudorandom functions.
1. Pseudorandom Permutations
Recall that a pseudorandom function ![{F}]( "{F}")
is an efficient function ![{\colon\{0,1\}^k\times\{0,1\}^n\rightarrow\{0,1\}^n}]( "{\colon\{0,1\}^k\times\{0,1\}^n\rightarrow\{0,1\}^n}")
, such that every efficient algorithm ![{A}]( "{A}")
cannot distinguish well ![{F_K(\cdot)}]( "{F_K(\cdot)}")
from ![{R(\cdot)}]( "{R(\cdot)}")
, for a randomly chosen key ![{K\in\{0,1\}^k}]( "{K\in\{0,1\}^k}")
and a random function ![{R\colon\{0,1\}^n\rightarrow \{0,1\}^n}]( "{R\colon\{0,1\}^n\rightarrow \{0,1\}^n}")
. That is, we want that ![{A^{F_K(\cdot)}}]( "{A^{F_K(\cdot)}}")
behaves like ![{A^{R(\cdot)}}]( "{A^{R(\cdot)}}")
.
![]()
A pseudorandom permutation ![{P}]( "{P}")
is an efficient function ![{\colon\{0,1\}^k\times \{0,1\}^n\rightarrow\{0,1\}^n}]( "{\colon\{0,1\}^k\times \{0,1\}^n\rightarrow\{0,1\}^n}")
, such that for every key ![{K}]( "{K}")
, the function ![{P_K}]( "{P_K}")
mapping ![{x\mapsto P_K(x)}]( "{x\mapsto P_K(x)}")
is a bijection. Moreover, we assume that given ![{K}]( "{K}")
, the mapping ![{x\mapsto P_K(x)}]( "{x\mapsto P_K(x)}")
is efficiently invertible (i.e. ![{P_K^{-1}}]( "{P_K^{-1}}")
is efficient). The security of ![{P}]( "{P}")
states that every efficient algorithm ![{A}]( "{A}")
cannot distinguish well ![{\langle P_K(\cdot), P_K^{-1}(\cdot)\rangle}]( "{\langle P_K(\cdot), P_K^{-1}(\cdot)\rangle}")
from ![{\langle \Pi(\cdot), \Pi^{-1}(\cdot)\rangle}]( "{\langle \Pi(\cdot), \Pi^{-1}(\cdot)\rangle}")
, for a randomly chosen key ![{K\in\{0,1\}^k}]( "{K\in\{0,1\}^k}")
and a random permutation ![{\Pi\colon\{0,1\}^n\rightarrow\{0,1\}^n}]( "{\Pi\colon\{0,1\}^n\rightarrow\{0,1\}^n}")
. That is, we want that ![{A^{P_K(\cdot),P_K^{-1}(\cdot)}}]( "{A^{P_K(\cdot),P_K^{-1}(\cdot)}}")
behaves like ![{A^{\Pi(\cdot),\Pi^{-1}(\cdot)}}]( "{A^{\Pi(\cdot),\Pi^{-1}(\cdot)}}")
.
![]()
We note that the algorithm ![{A}]( "{A}")
is given access to both an oracle and its (supposed) inverse.
2. Feistel Permutations
Given any function ![{F\colon\{0,1\}^m\rightarrow\{0,1\}^m}]( "{F\colon\{0,1\}^m\rightarrow\{0,1\}^m}")
, we can construct a permutation ![{D_F\colon\{0,1\}^{2m}\rightarrow\{0,1\}^{2m}}]( "{D_F\colon\{0,1\}^{2m}\rightarrow\{0,1\}^{2m}}")
using a technique named after Horst Feistel. The definition of ![{D_F}]( "{D_F}")
is given by
![\displaystyle D_F(x,y)\mathrel{:}= y,F(y)\oplus x, \ \ \ \ \ (1)]( "\displaystyle D_F(x,y)\mathrel{:}= y,F(y)\oplus x, \ \ \ \ \ (1)")
where ![{x}]( "{x}")
and ![{y}]( "{y}")
are ![{m}]( "{m}")
-bit strings. Note that this is an injective (and hence bijective) function, because its inverse is given by
![\displaystyle D_F^{-1}(z,w)\mathrel{:}= F(z)\oplus w, z. \ \ \ \ \ (2)]( "\displaystyle D_F^{-1}(z,w)\mathrel{:}= F(z)\oplus w, z. \ \ \ \ \ (2)")
![]()
Also, note that ![{D_F}]( "{D_F}")
and ![{D^{-1}_F}]( "{D^{-1}_F}")
are efficiently computable given ![{F}]( "{F}")
.
However, ![{D_F}]( "{D_F}")
needs not be a pseudorandom permutation even if ![{F}]( "{F}")
is a pseudorandom function, because the output of ![{D_F(x,y)}]( "{D_F(x,y)}")
must contain ![{y}]( "{y}")
, which is extremely unlikely for a truly random permutation.
To avoid the above pitfall, we may want to repeat the construction twice. We pick two independent random keys ![{K_1}]( "{K_1}")
and ![{K_2}]( "{K_2}")
, and compose the permutations ![{P(\cdot)\mathrel{:}= D_{F_{K_2}}(D_{F_{K_1}}(\cdot))}]( "{P(\cdot)\mathrel{:}= D_{F_{K_2}}(D_{F_{K_1}}(\cdot))}")
.
![]()
Indeed, the output does not always contain part of the input. However, this construction is still insecure, no matter whether ![{F}]( "{F}")
is pseudorandom or not, as the following example shows.
![]()
Here, ![{\overline0}]( "{\overline0}")
denotes the all-zero string of length ![{m}]( "{m}")
, ![{\overline1}]( "{\overline1}")
denotes the all-one string of length ![{m}]( "{m}")
, and ![{F(\cdot)}]( "{F(\cdot)}")
is ![{F_{K_1}(\cdot)}]( "{F_{K_1}(\cdot)}")
. This shows that, restricting to the first half, ![{P(\overline0\overline0)}]( "{P(\overline0\overline0)}")
is the complement of ![{P(\overline1\overline0)}]( "{P(\overline1\overline0)}")
, regardless of ![{F}]( "{F}")
.
What happens if we repeat the construction three times? We still do not get a pseudorandom permutation.
Exercise 1 (Not Easy) Show that there is an efficient oracle algorithm ![{A}]( "{A}")
such that
![\displaystyle \mathop{\mathbb P}_{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m} } [ A^{\Pi,\Pi^{-1} } = 1] = 2^{-\Omega(m) }]( "\displaystyle \mathop{\mathbb P}_{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m} } [ A^{\Pi,\Pi^{-1} } = 1] = 2^{-\Omega(m) }")
where ![{\Pi}]( "{\Pi}")
is a random permutation, but for every three functions ![{F_1,F_2,F_3}]( "{F_1,F_2,F_3}")
, if we define ![{P(x) := D_{F_3} (D_{F_2} ( D_{F_1} (x )))}]( "{P(x) := D_{F_3} (D_{F_2} ( D_{F_1} (x )))}")
we have
![\displaystyle A^{P,P^{-1} } = 1]( "\displaystyle A^{P,P^{-1} } = 1")
Finally, however, if we repeat the construction four times, with four independent pseudorandom functions, we get a pseudorandom permutation.
3. The Luby-Rackoff Construction
Let ![{F: \{ 0,1 \}^k \times \{ 0,1 \}^m \rightarrow \{ 0,1 \}^m}]( "{F: \{ 0,1 \}^k \times \{ 0,1 \}^m \rightarrow \{ 0,1 \}^m}")
be a pseudorandom function, we define the following function ![{P: \{ 0,1 \}^{4k} \times \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m}}]( "{P: \{ 0,1 \}^{4k} \times \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m}}")
: given a key ![{\overline K=\langle K_1,\dotsc,K_4\rangle}]( "{\overline K=\langle K_1,\dotsc,K_4\rangle}")
and an input ![{x}]( "{x}")
,
![\displaystyle P_{\overline K}(x)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_{K_2}}(D_{F_{K_1}}(x)))). \ \ \ \ \ (3)]( "\displaystyle P_{\overline K}(x)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_{K_2}}(D_{F_{K_1}}(x)))). \ \ \ \ \ (3)")
![]()
It is easy to construct the inverse permutation by composing their inverses backwards.
Theorem 1 (Pseudorandom Permutations from Pseudorandom Functions) If ![{F}]( "{F}")
is a ![{(O(tr),\epsilon)}]( "{(O(tr),\epsilon)}")
-secure pseudorandom function computable in time ![{r}]( "{r}")
, then ![{P}]( "{P}")
is a ![{(t, 4\epsilon + t^2 \cdot 2^{-m} + t^2 \cdot 2^{-2m} )}]( "{(t, 4\epsilon + t^2 \cdot 2^{-m} + t^2 \cdot 2^{-2m} )}")
secure pseudorandom permutation.
4. Analysis of the Luby-Rackoff Construction
Given four random functions ![{\overline R = \langle R_1,\ldots,R_4\rangle}]( "{\overline R = \langle R_1,\ldots,R_4\rangle}")
, ![{R_i: \{ 0,1 \}^m \rightarrow \{ 0,1 \}^m}]( "{R_i: \{ 0,1 \}^m \rightarrow \{ 0,1 \}^m}")
, let ![{P_{\overline R}}]( "{P_{\overline R}}")
be the analog of Construction (3) using the random function ![{R_i}]( "{R_i}")
instead of the pseudorandom functions ![{F_{K_i}}]( "{F_{K_i}}")
,
![\displaystyle P_{\overline{R}} (x) = D_{{R_4}} ( D_{{R_3}} ( D_{{R_2}} (D_{{R_1}} (x )))) \ \ \ \ \ (4)]( "\displaystyle P_{\overline{R}} (x) = D_{{R_4}} ( D_{{R_3}} ( D_{{R_2}} (D_{{R_1}} (x )))) \ \ \ \ \ (4)")
We prove Theorem 1 by showing that
-
![{P_{\overline K}}]( "{P_{\overline K}}")
is indistinguishable from ![{P_{\overline R}}]( "{P_{\overline R}}")
or else we can break the pseudorandom function
-
![{P_{\overline R}}]( "{P_{\overline R}}")
is indistinguishable from a random permutation
The first part is given by the following lemma, which we prove via a standard hybrid argument.
Lemma 2 If ![{F}]( "{F}")
is a ![{(O(tr),\epsilon)}]( "{(O(tr),\epsilon)}")
-secure pseudorandom function computable in time ![{r}]( "{r}")
, then for every algorithm ![{A}]( "{A}")
of complexity ![{\leq t}]( "{\leq t}")
we have
![\displaystyle \left | \mathop{\mathbb P}_{\overline {K} } [ A^{P_{\overline{K}}, P^{-1} _{\overline{K}} } () =1 ] \right. \ \ \ \ \ (5)]( "\displaystyle \left | \mathop{\mathbb P}_{\overline {K} } [ A^{P_{\overline{K}}, P^{-1} _{\overline{K}} } () =1 ] \right. \ \ \ \ \ (5)")
And the second part is given by the following lemma:
Lemma 3 For every algorithm ![{A}]( "{A}")
of complexity ![{\leq t}]( "{\leq t}")
we have
![\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2^{2m}} + \frac {t^2}{ 2^{m}}]( "\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2^{2m}} + \frac {t^2}{ 2^{m}}")
where ![{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m}}]( "{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m}}")
is a random permutation.
We now prove Lemma 2 using a hybrid argument.
Proof: Consider the following five algorithms from ![{\{0,1\}^{2m}}]( "{\{0,1\}^{2m}}")
to ![{\{0,1\}^{2m}}]( "{\{0,1\}^{2m}}")
:
-
![{H_0}]( "{H_0}")
: pick random keys ![{K_1}]( "{K_1}")
, ![{K_2}]( "{K_2}")
, ![{K_3}]( "{K_3}")
, ![{K_4}]( "{K_4}")
,
![{H_0(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_{K_2}}(D_{F_{K_1}}(\cdot))));}]( "{H_0(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_{K_2}}(D_{F_{K_1}}(\cdot))));}")
-
![{H_1}]( "{H_1}")
: pick random keys ![{K_2}]( "{K_2}")
, ![{K_3}]( "{K_3}")
, ![{K_4}]( "{K_4}")
and a random function ![{F_1\colon\{0,1\}^m\rightarrow\{0,1\}^m}]( "{F_1\colon\{0,1\}^m\rightarrow\{0,1\}^m}")
,
![{H_1(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_{K_2}}(D_{F_1}(\cdot))));}]( "{H_1(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_{K_2}}(D_{F_1}(\cdot))));}")
-
![{H_2}]( "{H_2}")
: pick random keys ![{K_3}]( "{K_3}")
, ![{K_4}]( "{K_4}")
and random functions ![{F_1,F_2\colon\{0,1\}^m\rightarrow\{0,1\}^m}]( "{F_1,F_2\colon\{0,1\}^m\rightarrow\{0,1\}^m}")
,
![{H_2(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_2}(D_{F_1}(\cdot))));}]( "{H_2(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_{K_3}}(D_{F_2}(D_{F_1}(\cdot))));}")
-
![{H_3}]( "{H_3}")
: pick a random key ![{K_4}]( "{K_4}")
and random functions ![{F_1,F_2,F_3\colon\{0,1\}^m\rightarrow\{0,1\}^m}]( "{F_1,F_2,F_3\colon\{0,1\}^m\rightarrow\{0,1\}^m}")
,
![{H_3(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_3}(D_{F_2}(D_{F_1}(\cdot))));}]( "{H_3(\cdot)\mathrel{:}= D_{F_{K_4}}(D_{F_3}(D_{F_2}(D_{F_1}(\cdot))));}")
-
![{H_4}]( "{H_4}")
: pick random functions ![{F_1,F_2,F_3,F_4 \colon\{0,1\}^m\rightarrow\{0,1\}^m}]( "{F_1,F_2,F_3,F_4 \colon\{0,1\}^m\rightarrow\{0,1\}^m}")
,
![{H_4(\cdot)\mathrel{:}= D_{F_4}(D_{F_3}(D_{F_2}(D_{F_1}(\cdot)))).}]( "{H_4(\cdot)\mathrel{:}= D_{F_4}(D_{F_3}(D_{F_2}(D_{F_1}(\cdot)))).}")
Clearly, referring to (5), ![{H_0}]( "{H_0}")
gives the first probability of using all pseudorandom functions in the construction, and ![{H_4}]( "{H_4}")
gives the second probability of using all completely random functions. By triangle inequality, we know that
![\displaystyle \exists i\quad\Bigl\lvert\mathop{\mathbb P}[A^{H_i,H_i^{-1}}=1]- \mathop{\mathbb P}[A^{H_{i+1},H_{i+1}^{-1}}=1]\Bigr\rvert>\epsilon. \ \ \ \ \ (6)]( "\displaystyle \exists i\quad\Bigl\lvert\mathop{\mathbb P}[A^{H_i,H_i^{-1}}=1]- \mathop{\mathbb P}[A^{H_{i+1},H_{i+1}^{-1}}=1]\Bigr\rvert>\epsilon. \ \ \ \ \ (6)")
We now construct an algorithm ![{A'^{G(\cdot)}}]( "{A'^{G(\cdot)}}")
of complexity ![{O(tr)}]( "{O(tr)}")
that distinguishes whether the oracle ![{G(\cdot)}]( "{G(\cdot)}")
is ![{F_K(\cdot)}]( "{F_K(\cdot)}")
or a random function ![{R(\cdot)}]( "{R(\cdot)}")
.
- The algorithm
![{A'}]( "{A'}")
picks ![{i}]( "{i}")
keys ![{K_1,K_2,\dotsc,K_i}]( "{K_1,K_2,\dotsc,K_i}")
and initialize ![{4-i-1}]( "{4-i-1}")
data structures ![{S_{i+2},\dotsc,S_4}]( "{S_{i+2},\dotsc,S_4}")
to ![{\emptyset}]( "{\emptyset}")
to store pairs.
- The algorithm
![{A'}]( "{A'}")
simulates ![{A^{O,O^{-1}}}]( "{A^{O,O^{-1}}}")
. Whenever ![{A}]( "{A}")
queries ![{O}]( "{O}")
(or ![{O^{-1}}]( "{O^{-1}}")
), the simulating algorithm ![{A'}]( "{A'}")
uses the four compositions of Feistel permutations, where
- On the first
![{i}]( "{i}")
layers, run the pseudorandom function ![{F}]( "{F}")
using the ![{i}]( "{i}")
keys ![{K_1,K_2,\dotsc,K_i}]( "{K_1,K_2,\dotsc,K_i}")
;
- On the
![{i}]( "{i}")
-th layer, run an oracle ![{G}]( "{G}")
;
- On the remaining
![{4-i-1}]( "{4-i-1}")
layers, simulate a random function: when a new value for ![{x}]( "{x}")
is needed, use fresh randomness to generate the random function at ![{x}]( "{x}")
and store the key-value pair into the appropriate data structure; otherwise, simply return the value stored in the data structure.
When ![{G}]( "{G}")
is ![{F_K}]( "{F_K}")
, the algorithm ![{A'^{G}}]( "{A'^{G}}")
behaves like ![{A^{H_i,H_i^{-1}}}]( "{A^{H_i,H_i^{-1}}}")
; when ![{G}]( "{G}")
is a random function ![{R}]( "{R}")
, the algorithm ![{A'^{G}}]( "{A'^{G}}")
behaves like ![{A^{H_{i+1}, H_{i+1}^{-1}}}]( "{A^{H_{i+1}, H_{i+1}^{-1}}}")
. Rewriting (6),
![\displaystyle \Bigl\lvert\mathop{\mathbb P}_K[A'^{F_K(\cdot)}=1]-\mathop{\mathbb P}_R[A'^{R(\cdot)}=1] \Bigr\rvert>\epsilon,]( "\displaystyle \Bigl\lvert\mathop{\mathbb P}_K[A'^{F_K(\cdot)}=1]-\mathop{\mathbb P}_R[A'^{R(\cdot)}=1] \Bigr\rvert>\epsilon,")
and ![{F}]( "{F}")
is not ![{(O(tr),\epsilon)}]( "{(O(tr),\epsilon)}")
-secure. ![\Box]( "\Box")
We say that an algorithm ![{A}]( "{A}")
is non-repeating if it never makes an oracle query to which it knows the answer. (That is, if ![{A}]( "{A}")
is interacting with oracles ![{g,g^{-1}}]( "{g,g^{-1}}")
for some permutation ![{g}]( "{g}")
, then ![{A}]( "{A}")
will not ask twice for ![{g(x)}]( "{g(x)}")
for the same ![{x}]( "{x}")
, and it will not ask twice for ![{g^{-1}(y)}]( "{g^{-1}(y)}")
for the same ![{y}]( "{y}")
; also, after getting the value ![{y=g(x)}]( "{y=g(x)}")
in an earlier query, it will not ask for ![{g^{-1} (y)}]( "{g^{-1} (y)}")
later, and after getting ![{w=g^{-1} (z)}]( "{w=g^{-1} (z)}")
it will not ask for ![{g(w)}]( "{g(w)}")
later. )
We shall prove Lemma 3 for non-repeating algorithms. The proof can be extended to arbitrary algorithms with some small changes. Alternatively, we can argue that an arbitrary algorithm can be simulated by a non-repeating algorithm of almost the same complexity in such a way that the algorithm and the simulation have the same output given any oracle permutation.
In order to prove Lemma 3 we introduce one more probabilistic experiment: we consider the probabilistic algorithm ![{S(A)}]( "{S(A)}")
that simulates ![{A()}]( "{A()}")
and simulates every oracle query by providing a random answer. (Note that the simulated answers in the computation of ![{SA}]( "{SA}")
may be incompatible with any permutation.)
We first prove the simple fact that ![{S(A)}]( "{S(A)}")
is close to simulating what really happen when ![{A}]( "{A}")
interacts with a truly random permutation.
Lemma 4 Let ![{A}]( "{A}")
be a non-repeating algorithm of complexity at most ![{t}]( "{t}")
. Then
![\displaystyle \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2 \cdot 2^{2m}} \ \ \ \ \ (7)]( "\displaystyle \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2 \cdot 2^{2m}} \ \ \ \ \ (7)")
where ![{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m}}]( "{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m}}")
is a random permutation.
Finally, it remains to prove:
Lemma 5 For every non-repating algorithm ![{A}]( "{A}")
of complexity ![{\leq t}]( "{\leq t}")
we have
![\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P} [ S(A) = 1] \right| \leq \frac{t^2}{ 2\cdot 2^{2m}} + \frac {t^2}{ 2^{m}}]( "\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P} [ S(A) = 1] \right| \leq \frac{t^2}{ 2\cdot 2^{2m}} + \frac {t^2}{ 2^{m}}")
It is clear that Lemma 3 follows Lemma 4 and Lemma 5.
We now prove Lemma 4.
![\displaystyle \begin{array}{rcl} && \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \\ &\leqslant & \mathop{\mathbb P}[\mbox{when simulating }S \mbox{, get answers inconsistent with any permutation}]\\ &\leqslant & \frac1{2^{2m}}(1+2+\cdots+t-1)\\ &= & \binom t2\frac1{2^{2m}}\\ &\leqslant & \frac{t^2}{2\cdot2^{2m}}. \end{array}]( "\displaystyle \begin{array}{rcl} && \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \\ &\leqslant & \mathop{\mathbb P}[\mbox{when simulating }S \mbox{, get answers inconsistent with any permutation}]\\ &\leqslant & \frac1{2^{2m}}(1+2+\cdots+t-1)\\ &= & \binom t2\frac1{2^{2m}}\\ &\leqslant & \frac{t^2}{2\cdot2^{2m}}. \end{array}")
We shall prove Lemma 5 next time.
![]()
![]()
![\displaystyle \mathop{\mathbb P}_{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m} } [ A^{\Pi,\Pi^{-1} } = 1] = 2^{-\Omega(m) }](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle++%5Cmathop%7B%5Cmathbb+P%7D_%7B%5CPi+%3A+%5C%7B+0%2C1+%5C%7D%5E%7B2m%7D+%5Crightarrow+%5C%7B+0%2C1+%5C%7D%5E%7B2m%7D+%7D+%5B+A%5E%7B%5CPi%2C%5CPi%5E%7B-1%7D+%7D+%3D+1%5D+%3D+2%5E%7B-%5COmega%28m%29+%7D+&bg=ffffff&fg=000000&s=0 "\displaystyle \mathop{\mathbb P}_{\Pi : \{ 0,1 \}^{2m} \rightarrow \{ 0,1 \}^{2m} } [ A^{\Pi,\Pi^{-1} } = 1] = 2^{-\Omega(m) }")
is a random permutation, but for every three functions 
, if we define 
we have
, then 
secure pseudorandom permutation. 
is indistinguishable from 
we have![\displaystyle \left | \mathop{\mathbb P}_{\overline {K} } [ A^{P_{\overline{K}}, P^{-1} _{\overline{K}} } () =1 ] \right. \ \ \ \ \ (5)](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle+++%5Cleft+%7C+%5Cmathop%7B%5Cmathbb+P%7D_%7B%5Coverline+%7BK%7D+%7D+%5B+A%5E%7BP_%7B%5Coverline%7BK%7D%7D%2C+P%5E%7B-1%7D+_%7B%5Coverline%7BK%7D%7D+%7D+%28%29+%3D1+%5D+%5Cright.+%5C+%5C+%5C+%5C+%5C+%285%29&bg=ffffff&fg=000000&s=0 "\displaystyle \left | \mathop{\mathbb P}_{\overline {K} } [ A^{P_{\overline{K}}, P^{-1} _{\overline{K}} } () =1 ] \right. \ \ \ \ \ (5)")
![\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2^{2m}} + \frac {t^2}{ 2^{m}}](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle++%5Cleft%7C+%5Cmathop%7B%5Cmathbb+P%7D_%7B%5Coverline+%7BR%7D+%7D+%5B+A%5E%7BP_%7B%5Coverline%7BR%7D%7D%2C+P%5E%7B-1%7D+_%7B%5Coverline%7BR%7D%7D+%7D+%28%29+%3D1+%5D+-+%5Cmathop%7B%5Cmathbb+P%7D_%7B%5CPi%7D+%5B+A%5E%7B%5CPi%2C+%5CPi%5E%7B-1%7D+%7D+%28%29+%3D+1%5D+%5Cright%7C+%5Cleq+%5Cfrac%7Bt%5E2%7D%7B+2%5E%7B2m%7D%7D+%2B+%5Cfrac+%7Bt%5E2%7D%7B+2%5E%7Bm%7D%7D+&bg=ffffff&fg=000000&s=0 "\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2^{2m}} + \frac {t^2}{ 2^{m}}")
is a random permutation. 
, 
,
: pick random keys 
,
: pick random keys 
,
: pick a random key 
,
,
![\displaystyle \exists i\quad\Bigl\lvert\mathop{\mathbb P}[A^{H_i,H_i^{-1}}=1]- \mathop{\mathbb P}[A^{H_{i+1},H_{i+1}^{-1}}=1]\Bigr\rvert>\epsilon. \ \ \ \ \ (6)](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle+++%5Cexists+i%5Cquad%5CBigl%5Clvert%5Cmathop%7B%5Cmathbb+P%7D%5BA%5E%7BH_i%2CH_i%5E%7B-1%7D%7D%3D1%5D-+%5Cmathop%7B%5Cmathbb+P%7D%5BA%5E%7BH_%7Bi%2B1%7D%2CH_%7Bi%2B1%7D%5E%7B-1%7D%7D%3D1%5D%5CBigr%5Crvert%3E%5Cepsilon.+%5C+%5C+%5C+%5C+%5C+%286%29&bg=ffffff&fg=000000&s=0 "\displaystyle \exists i\quad\Bigl\lvert\mathop{\mathbb P}[A^{H_i,H_i^{-1}}=1]- \mathop{\mathbb P}[A^{H_{i+1},H_{i+1}^{-1}}=1]\Bigr\rvert>\epsilon. \ \ \ \ \ (6)")
picks 
keys 
and initialize 
data structures 
to 
to store pairs.
. Whenever 
(or 
), the simulating algorithm 
![\displaystyle \Bigl\lvert\mathop{\mathbb P}_K[A'^{F_K(\cdot)}=1]-\mathop{\mathbb P}_R[A'^{R(\cdot)}=1] \Bigr\rvert>\epsilon,](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle+%5CBigl%5Clvert%5Cmathop%7B%5Cmathbb+P%7D_K%5BA%27%5E%7BF_K%28%5Ccdot%29%7D%3D1%5D-%5Cmathop%7B%5Cmathbb+P%7D_R%5BA%27%5E%7BR%28%5Ccdot%29%7D%3D1%5D+%5CBigr%5Crvert%3E%5Cepsilon%2C&bg=ffffff&fg=000000&s=0 "\displaystyle \Bigl\lvert\mathop{\mathbb P}_K[A'^{F_K(\cdot)}=1]-\mathop{\mathbb P}_R[A'^{R(\cdot)}=1] \Bigr\rvert>\epsilon,")
. Then![\displaystyle \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2 \cdot 2^{2m}} \ \ \ \ \ (7)](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle++%5Cleft%7C+%5Cmathop%7B%5Cmathbb+P%7D+%5B+S%28A%29+%3D1+%5D+-+%5Cmathop%7B%5Cmathbb+P%7D_%7B%5CPi%7D+%5B+A%5E%7B%5CPi%2C+%5CPi%5E%7B-1%7D+%7D+%28%29+%3D+1%5D+%5Cright%7C+%5Cleq+%5Cfrac%7Bt%5E2%7D%7B+2+%5Ccdot+2%5E%7B2m%7D%7D+%5C+%5C+%5C+%5C+%5C+%287%29&bg=ffffff&fg=000000&s=0 "\displaystyle \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \leq \frac{t^2}{ 2 \cdot 2^{2m}} \ \ \ \ \ (7)")
![\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P} [ S(A) = 1] \right| \leq \frac{t^2}{ 2\cdot 2^{2m}} + \frac {t^2}{ 2^{m}}](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle++%5Cleft%7C+%5Cmathop%7B%5Cmathbb+P%7D_%7B%5Coverline+%7BR%7D+%7D+%5B+A%5E%7BP_%7B%5Coverline%7BR%7D%7D%2C+P%5E%7B-1%7D+_%7B%5Coverline%7BR%7D%7D+%7D+%28%29+%3D1+%5D+-+%5Cmathop%7B%5Cmathbb+P%7D+%5B+S%28A%29+%3D+1%5D+%5Cright%7C+%5Cleq+%5Cfrac%7Bt%5E2%7D%7B+2%5Ccdot+2%5E%7B2m%7D%7D+%2B+%5Cfrac+%7Bt%5E2%7D%7B+2%5E%7Bm%7D%7D+&bg=ffffff&fg=000000&s=0 "\displaystyle \left| \mathop{\mathbb P}_{\overline {R} } [ A^{P_{\overline{R}}, P^{-1} _{\overline{R}} } () =1 ] - \mathop{\mathbb P} [ S(A) = 1] \right| \leq \frac{t^2}{ 2\cdot 2^{2m}} + \frac {t^2}{ 2^{m}}")
![\displaystyle \begin{array}{rcl} && \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \\ &\leqslant & \mathop{\mathbb P}[\mbox{when simulating }S \mbox{, get answers inconsistent with any permutation}]\\ &\leqslant & \frac1{2^{2m}}(1+2+\cdots+t-1)\\ &= & \binom t2\frac1{2^{2m}}\\ &\leqslant & \frac{t^2}{2\cdot2^{2m}}. \end{array}](http://s0.wp.com/latex.php?latex=%5Cdisplaystyle++%5Cbegin%7Barray%7D%7Brcl%7D++%26%26+%5Cleft%7C+%5Cmathop%7B%5Cmathbb+P%7D+%5B+S%28A%29+%3D1+%5D+-+%5Cmathop%7B%5Cmathbb+P%7D_%7B%5CPi%7D+%5B+A%5E%7B%5CPi%2C+%5CPi%5E%7B-1%7D+%7D+%28%29+%3D+1%5D+%5Cright%7C+%5C%5C+%26%5Cleqslant+%26+%5Cmathop%7B%5Cmathbb+P%7D%5B%5Cmbox%7Bwhen+simulating+%7DS+%5Cmbox%7B%2C+get+answers+inconsistent+with+any+permutation%7D%5D%5C%5C+%26%5Cleqslant+%26+%5Cfrac1%7B2%5E%7B2m%7D%7D%281%2B2%2B%5Ccdots%2Bt-1%29%5C%5C+%26%3D+%26+%5Cbinom+t2%5Cfrac1%7B2%5E%7B2m%7D%7D%5C%5C+%26%5Cleqslant+%26+%5Cfrac%7Bt%5E2%7D%7B2%5Ccdot2%5E%7B2m%7D%7D.+%5Cend%7Barray%7D+&bg=ffffff&fg=000000&s=0 "\displaystyle \begin{array}{rcl} && \left| \mathop{\mathbb P} [ S(A) =1 ] - \mathop{\mathbb P}_{\Pi} [ A^{\Pi, \Pi^{-1} } () = 1] \right| \\ &\leqslant & \mathop{\mathbb P}[\mbox{when simulating }S \mbox{, get answers inconsistent with any permutation}]\\ &\leqslant & \frac1{2^{2m}}(1+2+\cdots+t-1)\\ &= & \binom t2\frac1{2^{2m}}\\ &\leqslant & \frac{t^2}{2\cdot2^{2m}}. \end{array}")
