Indifferentiability of Truncated Random Permutations

Choi, Wonseok; Lee, Byeonghak; Lee, Jooyoung

doi:10.1007/978-3-030-34578-5_7

Cited by 10 publications

(9 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Probability of bad 3 . The event is very similar to bad event E 2 of Choi et al [12], and we adopt their reasoning. This event happens if a query Y = y y to…”

Section: Upper Bound On Distance Between W I and W R (Lemma 1)mentioning

confidence: 93%

“…Dodis et al [18] proved that this compression function is hard to distinguish from random. Choi et al [12] recently derived an improved bound and proved that (3) is indifferentiable from a random function up to around min 2…”

Section: State Of the Art On Compression Function Designmentioning

confidence: 99%

“…As our goal is to apply the chi-squared method, our first step is to introduce an intermediate world W I = (C[H , P ], H , P ), which has the same oracle interface as W S and W R . The idea is that the world W I behaves closely to W R , and that W I is in the support of W S , and this world reminds of the intermediate world introduced by Choi et al [12], though it is more involved as a hash function interface is added. These functions maintain initially empty sets to store inputoutput tuples C H , C P and C C , in a similar vein as in Sect.…”

Section: Proof Of Theoremmentioning

confidence: 99%

See 2 more Smart Citations

Security of Truncated Permutation Without Initial Value

Grassi

Mennink

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Indifferentiability is a powerful notion in cryptography. If a construction is proven to be indifferentiable from an ideal object, it can under certain assumptions instantiate that ideal object in higher-level constructions. Indifferentiability is a particularly useful model for cryptographic hash functions, and myriad results are known proving that a hash function behaves like a random oracle under the assumption that the underlying primitive (typically a compression function, a block cipher, or a permutation) is random. Recently, advances have been made in proving indifferentiability of one-way functions with fixed input length. One such example is truncation of a permutation. If one evaluates a random permutation on an input value concatenated with a fixed initial value, and truncates the output, one obtains a construction that is indifferentiable from a random function up to a certain bound (Dodis et al., FSE 2009; Choi et al., ASIACRYPT 2019). Security of this construction, however, is in part determined by the length of the initial value; omission of this fixed value yields an insecure construction.In this paper, we reconsider truncation of a permutation, and prove that the construction is indifferentiable from a random oracle, even if this fixed initial value is replaced by a randomized value. This randomized value may be the same for different evaluations of the construction, or freshly generated, up to the discretion of the adversary. The security level is the same as that of truncation with fixed initial value, up to collisions in the randomized value.We show that our construction has immediate implications in the context of parallel variable-length digest generation. In detail, we describe Cascade-MGF, that operates on top of any cryptographic hash function and uses the hash function output as randomized initial value in truncation. We demonstrate that Cascade-MGF compares favorably over earlier parallel variable-length digest generation constructions, namely Counter-MGF and Chained-MGF, in almost all settings.

show abstract

“…Probability of bad 3 . The event is very similar to bad event E 2 of Choi et al [12], and we adopt their reasoning. This event happens if a query Y = y y to…”

Section: Upper Bound On Distance Between W I and W R (Lemma 1)mentioning

confidence: 93%

Section: State Of the Art On Compression Function Designmentioning

confidence: 99%

Section: Proof Of Theoremmentioning

confidence: 99%

See 1 more Smart Citation

Security of Truncated Permutation Without Initial Value

Grassi

Mennink

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…As a matter of fact, when one message block is absorbed and the digest is extracted in one squeeze call, the sponge boils down to a truncated permutation. Choi et al [CLL19] proved that a truncated random permutation is indifferentiable from a RO up to ≈ min 2 b+cs 3…”

Section: Contributionmentioning

confidence: 99%

“…Thanks to the construction oracle, D it has access to the r s upper bits of q C different nodes. Let u ∈ {0, 1} rs , we define, similarly to Choi et al [CLL19], the random variable F u as follows:…”

Section: Probability Of Badmentioning

confidence: 99%

Indifferentiability of the Sponge Construction with a Restricted Number of Message Blocks

Lefevre

2023

ToSC

View full text Add to dashboard Cite

The sponge construction is a popular method for hashing. Quickly after its introduction, the sponge was proven to be tightly indifferentiable from a random oracle up to ≈ 2c/2 queries, where c is the capacity. However, this bound is not tight when the number of message blocks absorbed is restricted to ℓ < ⌈ c / 2(b−c) ⌉ + 1 (but still an arbitrary number of blocks can be squeezed). In this work, we show that this restriction leads to indifferentiability from a random oracle up to ≈ min { 2b/2, max { 2c/2, 2b−ℓ×(b−c) }} queries, where b > c is the permutation size. Depending on the parameters chosen, this result allows to have enhanced security or to absorb at a larger rate for applications that require a fixed-length input hash function.

show abstract

Luby-Rackoff Backwards with More Users and More Security

Bhattacharya¹,

Nandi

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Indifferentiability of Truncated Random Permutations

Cited by 10 publications

References 20 publications

Security of Truncated Permutation Without Initial Value

Security of Truncated Permutation Without Initial Value

Indifferentiability of the Sponge Construction with a Restricted Number of Message Blocks

Luby-Rackoff Backwards with More Users and More Security

Contact Info

Product

Resources

About