**On the Streaming Indistinguishability of a Random Permutation and a Random Function**

*Itai Dinur*

**Abstract: **An adversary with $S$ bits of
memory obtains a stream of $Q$ elements that are uniformly drawn from the set $\{1,2,\ldots,N\}$, either with or without replacement. This corresponds to sampling $Q$ elements using either a random function or a random permutation. The adversary's goal is to distinguish between these two cases.

This problem was first considered by Jaeger and Tessaro (EUROCRYPT 2019), which proved that the adversary's advantage is upper bounded by $\sqrt{Q \cdot S/N}$. Jaeger and Tessaro used this bound as a streaming switching lemma which allowed proving that known time-memory tradeoff attacks on several modes of operation (such as counter-mode) are optimal up to a factor of $O(\log N)$ if $Q \cdot S \approx N$. However, if $Q \cdot S \ll N$ there is a gap between the upper bound of $\sqrt{Q \cdot S/N}$ and the $Q \cdot S/N$ advantage obtained by known attacks. Moreover, the bound's proof assumed an unproven combinatorial conjecture.

In this paper, we prove a tight upper bound (up to poly-logarithmic factors) of $O(\log Q \cdot Q \cdot S/N)$ on the adversary's advantage in the streaming distinguishing problem. The proof does not require a conjecture and is based on a reduction from communication complexity to streaming.

**Category / Keywords: **secret-key cryptography / Streaming algorithm, time-memory tradeoff, switching lemma, mode of operations, communication complexity.

**Date: **received 22 Apr 2019

**Contact author: **dinuri at cs bgu ac il

**Available format(s): **PDF | BibTeX Citation

**Version: **20190422:185445 (All versions of this report)

**Short URL: **ia.cr/2019/413

[ Cryptology ePrint archive ]