Timeline for How to construct a good PRF from a block cipher?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 21, 2018 at 13:17 | vote | accept | fgrieu♦ | ||
| Feb 26, 2014 at 10:31 | vote | accept | fgrieu♦ | ||
| Oct 21, 2018 at 13:17 | |||||
| Nov 22, 2012 at 7:08 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Make it clear that I prefer a construct with a single key, and would like an attack against $E(E(x)⊕x)$
|
| Nov 22, 2012 at 6:51 | comment | added | fgrieu♦ | @Alexandre Yamajako: (fixed) for $F(x)=E(x)$, in the game of distinguishing $F$ from a random function: set $x=y=0$; repeat $⌊2^{b/2}/3⌋$ times: set $x=F(F(x))$, if $x=y$ say "random" and stop, else set $y=F(y)$, if $x=y$ say "random" and stop; say "non-random" with odds 51%, else say "random". For $F(x)=E(x)⊕x$, apply the same distinguisher to $G$ defined by $G(x)=F(x)⊕x$ instead of $F$. | |
| Nov 21, 2012 at 19:03 | history | tweeted | twitter.com/#!/StackCrypto/status/271328049105076225 | ||
| Nov 21, 2012 at 19:01 | answer | added | D.W. | timeline score: 9 | |
| Nov 21, 2012 at 15:02 | answer | added | David Cash | timeline score: 11 | |
| Nov 21, 2012 at 14:55 | answer | added | adam o | timeline score: 5 | |
| Nov 21, 2012 at 13:35 | comment | added | Alexandre Yamajako | Just curious, what is your distinguisher for your first proposal ? | |
| Nov 21, 2012 at 11:35 | comment | added | fgrieu♦ | @Ricky Demer: I amended the definition to allow that. I'm eager to see how that makes a difference. | |
| Nov 21, 2012 at 11:35 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
By request, allow use of $E^{-1}$
|
| Nov 21, 2012 at 10:31 | comment | added | user991 | Is the construction of $F$ allowed to use $E^{-1}$? $\:$ (I can't think of a way to do it in either case, but that might help.) | |
| Nov 21, 2012 at 9:49 | history | asked | fgrieu♦ | CC BY-SA 3.0 |