English

Distinguishing a truncated random permutation from a random function

Probability 2015-08-04 v1 Combinatorics

Abstract

An oracle chooses a function ff from the set of nn bits strings to itself, which is either a randomly chosen permutation or a randomly chosen function. When queried by an nn-bit string ww, the oracle computes f(w)f(w), truncates the mm last bits, and returns only the first nmn-m bits of f(w)f(w). How many queries does a querying adversary need to submit in order to distinguish the truncated permutation from a random function? In 1998, Hall et al. showed an algorithm for determining (with high probability) whether or not ff is a permutation, using O(2m+n2)O(2^{\frac{m+n}{2}}) queries. They also showed that if m<n/7m < n/7, a smaller number of queries will not suffice. For m>n/7m > n/7, their method gives a weaker bound. In this manuscript, we show how a modification of the method used by Hall et al. can solve the porblem completely. It extends the result to essentially every mm, showing that Ω(2m+n2)\Omega(2^{\frac{m+n}{2}}) queries are needed to get a non-negligible distinguishing advantage. We recently became aware that a better bound for the distinguishing advantage, for every m<nm<n, follows from a result of Stam published, in a different context, already in 1978.

Keywords

Cite

@article{arxiv.1508.00462,
  title  = {Distinguishing a truncated random permutation from a random function},
  author = {Shoni Gilboa and Shay Gueron},
  journal= {arXiv preprint arXiv:1508.00462},
  year   = {2015}
}

Comments

arXiv admin note: text overlap with arXiv:1412.5204

R2 v1 2026-06-22T10:25:07.939Z