In this chapter, we will study and prove the so-called “ \(P_i \oplus P_j\) Theorem” of Patarin (2005). More precisely, we will study the case for a wide range of \(\xi _{max}\) values that is sufficient for most cryptographic applications. Then, in Chap.  17 , we will use this result to prove some very strong security bound on generic Feistel ciphers. We also illustrate the usefulness of the result with the case \(\xi _{max}=2\) , which has its own interest from a cryptographic point of view. Indeed, as we will see, it is closely related to the problem of distinguishing \(f(x\Vert 0)\oplus f(x\Vert 1)\) where f is a random permutation on n bits from a random function. The proof presented in this chapter follows the recent work by Cogliati et al. (2023), in which a complete and compact proof of the result is provided. We extend this paper by providing additional explanations and clarifications.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

“ \(P_i \oplus P_j\) Theorem” for a Wide Range of  \(\xi _{max}\)

  • Jacques Patarin,
  • Emmanuel Volte,
  • Benoît Cogliati

摘要

In this chapter, we will study and prove the so-called “ \(P_i \oplus P_j\) Theorem” of Patarin (2005). More precisely, we will study the case for a wide range of \(\xi _{max}\) values that is sufficient for most cryptographic applications. Then, in Chap.  17 , we will use this result to prove some very strong security bound on generic Feistel ciphers. We also illustrate the usefulness of the result with the case \(\xi _{max}=2\) , which has its own interest from a cryptographic point of view. Indeed, as we will see, it is closely related to the problem of distinguishing \(f(x\Vert 0)\oplus f(x\Vert 1)\) where f is a random permutation on n bits from a random function. The proof presented in this chapter follows the recent work by Cogliati et al. (2023), in which a complete and compact proof of the result is provided. We extend this paper by providing additional explanations and clarifications.