[Paper Review] Equivalence of the Random Oracle Model and the Ideal Cipher Model, Revisited

Thomas Holenstein, Robin Künzler+1 more|arXiv (Cornell University)|Nov 4, 2010

Cryptography and Data Security3 references4 citations

TL;DR

This paper revisits the equivalence between the random oracle model and the ideal cipher model by demonstrating that the six-round Feistel construction—previously claimed to be indifferentiable from an invertible random permutation—fails due to a concrete distinguishing attack. To resolve this, the authors prove that a fourteen-round Feistel construction achieves indifferentiability, using a novel proof strategy that assigns unique roles to each round to avoid vulnerabilities present in shorter constructions.

ABSTRACT

We consider the cryptographic problem of constructing an invertible random permutation from a public random function (i.e., which can be accessed by the adversary). This goal is formalized by the notion of indifferentiability of Maurer et al. (TCC 2004). This is the natural extension to the public setting of the well-studied problem of building random permutations from random functions, which was first solved by Luby and Rackoff (Siam J. Comput., '88) using the so-called Feistel construction. The most important implication of such a construction is the equivalence of the random oracle model (Bellare and Rogaway, CCS '93) and the ideal cipher model, which is typically used in the analysis of several constructions in symmetric cryptography. Coron et al. (CRYPTO 2008) gave a rather involved proof that the six-round Feistel construction with independent random round functions is indifferentiable from an invertible random permutation. Also, it is known that fewer than six rounds do not suffice for indifferentiability. The first contribution (and starting point) of our paper is a concrete distinguishing attack which shows that the indifferentiability proof of Coron et al. is not correct. In addition, we provide supporting evidence that an indifferentiability proof for the six-round Feistel construction may be very hard to find. To overcome this gap, our main contribution is a proof that the Feistel construction with eigthteen rounds is indifferentiable from an invertible random permutation. The approach of our proof relies on assigning to each of the rounds in the construction a unique and specific role needed in the proof. This avoids many of the problems that appear in the six-round case.

Motivation & Objective

• To investigate the validity of the six-round Feistel construction's claimed indifferentiability from an invertible random permutation in the context of the random oracle and ideal cipher models.
• To identify and demonstrate a concrete distinguishing attack against the simulator used in the prior proof by Coron et al. (CRYPTO 2008).
• To establish a correct and robust indifferentiability proof for a Feistel construction under the ideal cipher model, thereby restoring the equivalence between the random oracle and ideal cipher models.
• To develop a new proof technique that assigns specific, unique roles to each round in the Feistel construction to prevent the pathologies seen in shorter constructions.

Proposed method

• Introduces a distinguishing attack that exploits inconsistencies in the simulator's behavior in the six-round Feistel construction, showing that the simulator cannot perfectly emulate the ideal cipher.
• Proposes a 14-round Feistel construction as a secure alternative, where each round is assigned a distinct role in the proof structure to avoid collision and consistency issues.
• Employs a three-stage simulation framework: (1) replacing the permutation with a random function, (2) introducing the Feistel construction, and (3) removing the simulator to compare with the ideal model.
• Uses probabilistic analysis to bound the probability of 'bad' events—such as inconsistent queries or collisions—during simulation, showing they occur with negligible probability.
• Applies a mapping argument between the randomness of the simulator and the uniform distribution over tables, proving statistical distance is bounded by $ \frac{4 \cdot 10^{19} \cdot q^{10}}{2^n} $.
• Leverages lemmas on chain lengths and query sets to bound the number of potential collisions and ensure the simulator's behavior remains statistically indistinguishable from the ideal primitive.

Experimental results

Research questions

• RQ1 Is the six-round Feistel construction truly indifferentiable from an invertible random permutation under the ideal cipher model?
• RQ2 Can a distinguishing attack be constructed against the simulator used in the prior proof of Coron et al.?
• RQ3 What is the minimal number of rounds required for a Feistel construction to achieve indifferentiability from an invertible random permutation?
• RQ4 Can a new proof technique be devised that avoids the flaws in previous approaches by assigning unique roles to each round?

Key findings

• A concrete distinguishing attack is demonstrated against the simulator in the six-round Feistel construction, invalidating the prior proof by Coron et al.
• The 14-round Feistel construction is proven to be indifferentiable from an invertible random permutation, establishing a correct foundation for the equivalence of the random oracle and ideal cipher models.
• The statistical distance between the simulator's output and the ideal model is bounded by $ \frac{8 \cdot 10^{19} \cdot q^{10}}{2^n} $, which is negligible for large $ n $.
• The proof shows that for good inputs, the simulator's behavior is indistinguishable from the ideal cipher, with the probability of failure (bad events) bounded by $ \frac{4 \cdot 10^{19} \cdot q^{10}}{2^n} $.
• The method of assigning unique roles to each round prevents the collision and consistency issues that plague shorter constructions, particularly the six-round variant.