The advantage of truncated permutations

Constructing a Pseudo Random Function (PRF) from a pseudorandom permutation is a fundamental problem in cryptology. Such a construction, implemented by truncating the last m bits of permutations of (formula presented) was suggested by Hall et al. (1998). They conjectured that the distinguishing advantage of an adversary with q quesires, (formula presented), is small if (formula presented), established an upper bound on (formula presented) that confirms the conjecture for (formula presented), and also declared a general lower bound (formula presented). The conjecture was essentially confirmed by Bellare and Impagliazzo in 1999. Nevertheless, the problem of estimating (formula presented) remained open. Combining the trivial bound 1, the birthday bound, and a result by Stam (1978) leads to the following upper bound: (formula presented) This upper bound shows that the number of times that a truncated permutation can be used as a PRF can exceed the birthday bound by at least a factor of (formula presented). In this paper we show that this upper bound is tight for every (formula presented) and (formula presented). This, in turn, verifies that the converse to the conjecture of Hall et al. is also correct, i.e., that (formula presented) is negligible only for (formula presented).