13

The Luby-Rackoff theorem states that if a round function is a secure pseudorandom function (PRF) then 3 rounds are sufficient to make the block cipher a pseudorandom permutation (PRP).

PRPs are invertible whereas PRFs are not. How come 3 rounds of a PRF will make an invertible block cipher out of a non-invertible function?

SEJPM
  • 46,697
  • 9
  • 103
  • 214
BlaX
  • 746
  • 8
  • 18

1 Answers1

12

The proof is loosely as below.

Lets assume a one round Feistel network, where $2n$ bits are divided into $n$ bits each $L_0, R_0$

The encryption is defined as

$L_{1} = R_{0}, \\ R_{1} = L_0 \oplus f(R_0) $

where f is any random function (PRF) and $\oplus$ is XOR operation

Now the cipher text is $L_{2} = R_{1}, R_{2} = L_1 $

Decryption is same as encryption circuit as defined above.

The input to decryption is $L_2, R_2$.

So decryption is defined as below

$ L_{3} = R_{2} \\ R_{3} = L_{2} \oplus f(R_2) $

Where the plain text should be considered $R_3, L_3$

Now lets substitute from $ L_{3} = L_{1}, \\ R_{3} = R_{1} \oplus f(L_1) $

Now lets substitute further to get the plain text is $R_3, L_3$ which is $L_0, R_0$ as shown below $ L_{3} = R_{0}, \\ R_{3} = L_0 \oplus f(R_0) \oplus f(R_{0}) ,\\ R_{3} = L_0 $

So it does not really matter if $f(R_0)$ is reversible or not. And the same holds good for any number of rounds.

There is also an intuitive explanation here

sashank
  • 6,234
  • 4
  • 36
  • 68