TY - JOUR

T1 - How Many Queries are Needed to Distinguish a Truncated Random Permutation from a Random Function?

AU - Gilboa, Shoni

AU - Gueron, Shay

AU - Morris, Ben

N1 - Publisher Copyright:
© 2017, International Association for Cryptologic Research.

PY - 2018/1/1

Y1 - 2018/1/1

N2 - An oracle chooses a function f from the set of n bits strings to itself, which is either a randomly chosen permutation or a randomly chosen function. When queried by an n-bit string w, the oracle computes f(w), truncates the m last bits, and returns only the first n- m bits of f(w). How many queries does a querying adversary need to submit in order to distinguish the truncated permutation from the (truncated) function? In Hall et al. (Building PRFs from PRPs, Springer, Berlin, 1998) showed an algorithm for determining (with high probability) whether or not f is a permutation, using O(2m+n2) queries. They also showed that if m< n/ 7 , a smaller number of queries will not suffice. For m> n/ 7 , their method gives a weaker bound. In this note, we first show how a modification of the approximation method used by Hall et al. can solve the problem completely. It extends the result to practically any m, showing that Ω(2m+n2) queries are needed to get a non-negligible distinguishing advantage. However, more surprisingly, a better bound for the distinguishing advantage, which we can write, in a simplified form, as O(min{q22n,q2n+m2,1}), can be obtained from a result of Stam published, in a different context, already in 1978. We also show that, at least in some cases, this bound is tight.

AB - An oracle chooses a function f from the set of n bits strings to itself, which is either a randomly chosen permutation or a randomly chosen function. When queried by an n-bit string w, the oracle computes f(w), truncates the m last bits, and returns only the first n- m bits of f(w). How many queries does a querying adversary need to submit in order to distinguish the truncated permutation from the (truncated) function? In Hall et al. (Building PRFs from PRPs, Springer, Berlin, 1998) showed an algorithm for determining (with high probability) whether or not f is a permutation, using O(2m+n2) queries. They also showed that if m< n/ 7 , a smaller number of queries will not suffice. For m> n/ 7 , their method gives a weaker bound. In this note, we first show how a modification of the approximation method used by Hall et al. can solve the problem completely. It extends the result to practically any m, showing that Ω(2m+n2) queries are needed to get a non-negligible distinguishing advantage. However, more surprisingly, a better bound for the distinguishing advantage, which we can write, in a simplified form, as O(min{q22n,q2n+m2,1}), can be obtained from a result of Stam published, in a different context, already in 1978. We also show that, at least in some cases, this bound is tight.

KW - Advantage

KW - Pseudo-random functions

KW - Pseudo-random permutations

UR - http://www.scopus.com/inward/record.url?scp=85017114526&partnerID=8YFLogxK

U2 - 10.1007/s00145-017-9253-0

DO - 10.1007/s00145-017-9253-0

M3 - ???researchoutput.researchoutputtypes.contributiontojournal.article???

AN - SCOPUS:85017114526

SN - 0933-2790

VL - 31

SP - 162

EP - 171

JO - Journal of Cryptology

JF - Journal of Cryptology

IS - 1

ER -