“ \(P_i \oplus P_j\) Theorem” for a Wide Range of \(\xi _{max}\)
摘要
In this chapter, we will study and prove the so-called “ \(P_i \oplus P_j\) Theorem” of Patarin (2005). More precisely, we will study the case for a wide range of \(\xi _{max}\) values that is sufficient for most cryptographic applications. Then, in Chap. 17 , we will use this result to prove some very strong security bound on generic Feistel ciphers. We also illustrate the usefulness of the result with the case \(\xi _{max}=2\) , which has its own interest from a cryptographic point of view. Indeed, as we will see, it is closely related to the problem of distinguishing \(f(x\Vert 0)\oplus f(x\Vert 1)\) where f is a random permutation on n bits from a random function. The proof presented in this chapter follows the recent work by Cogliati et al. (2023), in which a complete and compact proof of the result is provided. We extend this paper by providing additional explanations and clarifications.