Multi-user Security of the Sum of Truncated Random Permutations

Abstract

For several decades, constructing pseudorandom functions from pseudorandom permutations, so-called Luby-Rackoff backward construction, has been a popular cryptographic problem. Two methods are well-known and comprehensively studied for this problem: summing two random permutations and truncating partial bits of the output from a random permutation. In this paper, by combining both summation and truncation, we propose new Luby-Rackoff backward constructions, dubbed $\textsf{SaT 1}$ and $\textsf{SaT 2}$, respectively.

$\textsf{SaT 2}$ is obtained by partially truncating output bits from the sum of two independent random permutations, and $\textsf{SaT 1}$ is its single permutation-based variant using domain separation. The distinguishing advantage against $\textsf{SaT 1}$ and $\textsf{SaT 2}$ is upper bounded by $O({\sqrt{\mu q_{\max }}}/{2^{n-0.5m}})$ and $O({\sqrt{\mu }q_{\max }^{1.5}}/{2^{2n-0.5m}})$, respectively, in the multi-user setting, where n is the size of the underlying permutation, m is the output size of the construction, $\mu$ is the number of users, and $q_{\max }$ is the maximum number of queries per user. We also prove the distinguishing advantage against a variant of $\mathsf {XORP[3]}$ (studied by Bhattacharya and Nandi at Asiacrypt 2021) using independent permutations, dubbed $\mathsf {SoP3\hbox {-} 2}$, is upper bounded by $O({\sqrt{\mu } q_{\max }^2}/{2^{2.5n}})$.

In the multi-user setting with $\mu = O(2^{n-m})$, a truncated random permutation provides only the birthday bound security, while $\textsf{SaT 1}$ and $\textsf{SaT 2}$ are fully secure, i.e., allowing $O(2^n)$ queries for each user. It is the same security level as $\mathsf {XORP[3]}$ using three permutation calls, while $\textsf{SaT 1}$ and $\textsf{SaT 2}$ need only two permutation calls.

W. Choi—Supported by a KIAS Individual Grant CG089501 at Korea Institute for Advanced Study

J. Lee—This work was supported by Institute for Information & communications Technology Planning & Evaluation(IITP) grant funded by the Korea government(MSIT) (No.2022-0-01202 , Regional strategic industry convergence security core talent training business).