Distinguishing a truncated random permutation from a random function
Abstract
An oracle chooses a function from the set of bits strings to itself, which is either a randomly chosen permutation or a randomly chosen function. When queried by an -bit string , the oracle computes , truncates the last bits, and returns only the first bits of . How many queries does a querying adversary need to submit in order to distinguish the truncated permutation from a random function? In 1998, Hall et al. showed an algorithm for determining (with high probability) whether or not is a permutation, using queries. They also showed that if , a smaller number of queries will not suffice. For , their method gives a weaker bound. In this manuscript, we show how a modification of the method used by Hall et al. can solve the porblem completely. It extends the result to essentially every , showing that queries are needed to get a non-negligible distinguishing advantage. We recently became aware that a better bound for the distinguishing advantage, for every , follows from a result of Stam published, in a different context, already in 1978.
Keywords
Cite
@article{arxiv.1508.00462,
title = {Distinguishing a truncated random permutation from a random function},
author = {Shoni Gilboa and Shay Gueron},
journal= {arXiv preprint arXiv:1508.00462},
year = {2015}
}
Comments
arXiv admin note: text overlap with arXiv:1412.5204