In a previous question, we explored various security definitions of encryption schemes, such as IND-CPA, IND-CCA{1,2,3,etc.}

These indistinguishability games can roughly translate to blockciphers, as both data encryption and block encryption involve keys - a hidden parameter unknown to the adversary.

What I'm curious about, is how do we mount a distinguishing attack against a permutation? And how does it differ from one against blockciphers? I assume it involve some "capacity" bits of the permutation block being unknown to the adversary, am I correct?

  • $\begingroup$ I see public random permutations as somewhat equivalent to random oracles with restrictions. I don't think notions of capacity are inherent to the security of a random permutation, though it can be a distinguishing strategy. Other attacks would be slides attacks or the 0-sum distinguisher. Other attacks are given in the keccak design document (keccak.team/files/KeccakDIAC2012.pdf). Alternatively, I would imagine that we would need an indifferentiability type of notion for public PRPs. $\endgroup$ Jun 5 at 9:54


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.