Full indifferentiable security of the Xor of two or more random permutations using the X2 method

Abstract

The construction XORP (bitwise-xor of outputs of two independent n-bit random permutations) has gained broad attention over the last two decades due to its high security. Very recently, Dai et al. (CRYPTO’17), by using a method which they term the Chi-squared method (X2 method), have shown n-bit security of XORP when the underlying random permutations are kept secret to the adversary. In this work, we consider the case where the underlying random permutations are publicly available to the adversary. The best known security of XORP in this security game (also known as indifferentiable security) is 2n/3-bit, due to Mennink et al. (ACNS’15). Later, Lee (IEEE-IT’17) proved a better (k-1)n/k -bit security for the general construction XORP[k] which returns the xor of k (≥2) independent random permutations. However, the security was shown only for the cases where k is an even integer. In this paper, we improve all these known bounds and prove full, i.e., n-bit (indifferentiable) security of XORP as well as XORP[k] for any k. Our main result is n-bit security of XORP, and we use the X2 method to prove it.