A Proof of Security in O(2ⁿ) for the Benes Scheme

Abstract

In [1], W. Aiello and R. Venkatesan have shown how to construct pseudorandom functions of 2n bits → 2n bits from pseudorandom functions of n bits → n bits. They claimed that their construction, called “Benes” reaches the optimal bound (m ≪ 2ⁿ) of security against adversaries with unlimited computing power but limited by m queries in an Adaptive Chosen Plaintext Attack (CPA-2). This result may have many applications in Cryptography (cf [1,19,18] for example). However, as pointed out in [18] a complete proof of this result is not given in [1] since one of the assertions in [1] is wrong. It is not easy to fix the proof and in [18], only a weaker result was proved, i.e. that in the Benes Schemes we have security when m ≪ f(ε) ·2^n − ε, where f is a function such that lim _ε→0 f(ε) = + ∞ (f depends only of ε, not of n). Nevertheless, no attack better than in O(2ⁿ) was found. In this paper we will in fact present a complete proof of security when m ≪ O(2ⁿ) for the Benes Scheme, with an explicit O function. Therefore it is possible to improve all the security bounds on the cryptographic constructions based on Benes (such as in [19]) by using our O(2ⁿ) instead of f(ε) ·2^n − ε of [18].