The H-Coefficient Method

Abstract

The “H-coefficient technique” was introduced in 1990 and 1991 in Patarin (Pseudorandom permutations based on the DES scheme, Springer, Heidelberg, 1990, pp. 193–204; Étude des Générateurs de Permutations Pseudo-aléatoires basés sur le schéma du D.E.S., PhD, November 1991). Since then, it has been used many times to prove various results on pseudo-random functions and pseudo-random permutations (Chen et al., Minimizing the Two-round Even-Mansour Cipher Advances in Cryptology – CRYPTO 2014, vol. 8616, Springer, Heidelberg, 2014, pp. 39–56; Gilbert and Minier, New results on the pseudorandomness of some blockcipher constructions, Springer, Heidelberg, 2001, pp. 248–266; Pieprzyk, How to construct pseudorandom permutations from single pseudorandom functions, Springer, Heidelberg, 1991, pp. 140–150; Yun et al., Des. Codes Cryptography 58:45–72, 2011). Recently, it has also been used on key-alternating ciphers (Even-Mansour), cf. (Chen and Steinberger, Tight security bounds for key-alternating ciphers, Springer, Heidelberg, 2014, pp. 327–350) for example. We will use this technique in Chap. 4 for the specific cases of Ψ ³, Ψ ⁴, and then in many proofs of security of this book. In this chapter, in Sect. 3.1, we will present the “H-coefficient technique”, in a general way (not only for Ψ ^k), with different formulations when we study different cryptographic attacks (known-plaintext attacks, chosen-plaintext attacks, etc.). In Sect. 3.4, we will present an example with the exact values of the H coefficient on Ψ ^k with q = 2 plaintext/ciphertext pairs. Finally, in Sect. 3.5, we will present two simple and powerful composition theorems based on H-coefficient method in CCA.