How to Build Optimally Secure PRFs Using Block Ciphers

Proof of Mirror Theory for a Wide Range of $$\xi _{\max }$$

“…The complete proof of this result is exactly the same as the one of [7,Theorem 7.3] where [40,Theorem 6] is replaced with Theorem 1.…”

“…, i k+1 ) such that ⊕ k+1 j=1 S ij = 0; -the largest block of equalities contains at least n + 1 variables. 7 In [7], the authors prove that…”

“…In [7], Cogliati, Jha and Nandi propose several constructions to build optimally secure variable-input-length (VIL) PRFs from secret random permutations. Those schemes combine a diblock almost collision-free universal hash function with a finalization function based on the Benes construction [2].…”

“…The most efficient variant, whose representation can be found in Fig. 2, relies on two independent permutations, and its security proof [7,Theorem 7.3] involves the use of Mirror Theory for a single permutation. First, let us recall the necessary definition for keyed hash function.…”

“…Only a couple of years later, this result was articulated in many follow-up works for analysing the security of the xor of two permutations, and it took a few articles [37,39,40,42] for his result and security argument to evolve. Later, in 2017, this work culminated in a book [32] called Feistel Ciphers: Security Proofs and Cryptanalysis by Nachef et al Unfortunately, some important results were either hard to verify, or stated without proof, which has been reported in multiple works [7,11,15,25,29]. While this has led to some innovations such as the development of the aforementioned χ 2 technique, this state of affairs is unsatisfactory as Mirror Theory is an essential tool for provable security in symmetric cryptography.…”