How to Construct Pseudo-Random Permutations from Pseudo-Random Functions (Abstract)

Let F ⁿ be the set of all functions from n bits to n bits. Let f ⁿ specify for each key k of a given length a function f _k ⁿ F ⁿ . We say f ⁿ is pseudo-random if the following two properties hold: (1) Given a key k and an input a of length n , the time to evaluate f _k ⁿ ( ) is polynomial in n . (2) If a random key k is chosen, f _k ⁿ "looks like" a random function chosen from f ⁿ to any algorithm which is allowed to evaiuste f _k ⁿ at polynomial in n input values.Let P ²ⁿ be the set of permutations (1-1 onto functions) from 2 n bits to 2 n bits. Let P ²ⁿ specify for each key k of a given length a permutation P _k ²ⁿ P ²ⁿ . We present a simple method for describing P ²ⁿ in terms of f ⁿ . The method has the property that if f ⁿ is pseudo-random then p ²ⁿ is also pseude-random. The method was inspired by a study of the security of the Data Encryption Standard. This result, together with the result of Goldreich, Goldwasser and Micali [GGM], implies that if there is a pseudo-random number generator then there is a pseuderandom invertible permutation generator. We also prove that if two permutation generators which are "slightly secure" are cryptographically composed, the result is more secure than either one alone.