My understanding of the Even-Mansour cipher is the following:

  • We draw a random permutation $P$ from the set of all permutation $P: \{0,1\}^n \rightarrow \{0,1\}^n$. This permutation is public.
  • We generate two random keys $k_1, k_2 \in \{0,1\}^n$.
  • To encrypt a message $m \in \{0,1\}^n$, we compute $E_{k_1, k_2} = P(m \oplus k_1) \oplus k_2$.

What kind of algorithms exists that allow us to efficiently sample (and represent) a permutation $P$ from the set of all permutations from $n$ bit strings to $n$ bit strings?


1 Answer 1


Even-Mansour is a theoretical model to prove security results. One would need to sample permutations of $n$ bits, say for $n=128,$ since the resulting space of $N=2^n$ objects would be too large to store or manipulate. This is similar to the fact that no one uses a purely random equidistributed and i.i.d. sequence of bits as a keystream in OTP mode in modern cryptography. It is too slow.

However, the following algorithm gives a random permutation on $\{1,2,\ldots, N\}.$ No claim of optimal efficiency is made here.


Input: The list $A=[1,2,\ldots, N]$ of $N=2^n$ items.

Task: permute the values in $A$ at random.

Let $S:=\{u: u \in A\}.$ Let $B:=A$

for each $i=1,\ldots,N$ do

$\quad$ Choose a random integer $j \in S$

$\quad$ Change array $B$ via $B[j]:=A[i]$

$\quad$ Remove $j$ from set $S$

end for This algorithm chooses $N,$ then $N-1$, then $N-2$ etc. objects uniformly and can generate each permutation with equal likelihood, since it makes $N\!$ choices. Output: The list $A$ is now random.

There are more efficient ways to sample random permutations, see for example Jens Gustedt, "Efficient sampling of random permutations", Journal of Discrete Algorithms, Vol. 6, Issue 1, 2006. Also take a look at Fisher-Yates shuffle and Knuth Shuffle, google is your friend.

The algorithm below doesn't quite get there, thanks to @kelalaka for the correction

Input: The list $A=\{1,2,\ldots, N\}$ of $N=2^n$ items.

Task: permute the values in $A$ at random.

for each $i=0,\ldots,N-1$ do

$\quad$ Choose a random integer $j$ with $i<j<N.$

$\quad$ Swap the entries $A[i]$ and $A[j].$

end for

Output: The list $A$ is now random.

  • 1
    $\begingroup$ As we know from the comparison sorting bound, one needs around $n \log n$ swaps to turn back the unsorted array into a sorted one. $N$-swap is not enough to sample all permutations, right? $\endgroup$
    – kelalaka
    Apr 11, 2022 at 18:55
  • 1
    $\begingroup$ Fisher-Yates does result in a uniformly random permutation. Consider the number of possibilities for $A[0]$, then $A[1]$, etc: $N\cdot N-1 \cdot \dots \cdot 1$ = $N!$. $\endgroup$ Apr 11, 2022 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.