1

Are there any fast, secure, one-way, unkeyed almost-pseudorandom permutations? I am looking for something that can hide a MAC, without requiring a secret key and while being much faster than public key crypto. It is important that it is a almost-PRP, not a PRF.

By "almost-PRP", I mean "a one-to-one function that is also preimage resistant"

Demi
  • 4,853
  • 1
  • 22
  • 40

2 Answers2

4

There is a misconception here regarding the security of MACs. It is certainly not true that MACs give away the secret key if it is known and the key reused. You are thinking about information-theoretic MACs (or possibly GHASH). However, a secure MAC does not have any problem at all. You can use HMAC or CMAC or even GMAC, and these are secure for many MACs even if the adversary sees many pairs of message/tag (and even if the adversary can choose what messages to get MACed). So, in answer to your question:

  1. It is impossible to have an (almost) pseudorandom permutation without a secret key. You can heuristically use a hash function as a random oracle, but this opens up another big discussion
  2. You do not need such an object for what you want. Just use a normal secure MAC and it is safe.
Yehuda Lindell
  • 28,270
  • 1
  • 69
  • 86
0

Well, no. For something to be a pseudorandom permutation on some domain $\mathcal{D}$, it must be the case that a p.p.t. adversary can't distinguish it from a randomly-chosen permutation on $\mathcal{D}$. If there is no key or if the key is public, the adversary can just make a bunch of encryption queries and check whether they have the same ciphertext as the public permutation's.

You also mention that the function should be "one-way" but also be a permutation, which is a bit confusing. What exactly are you trying to accomplish here?

EDIT: I am still a little bit confused by your question, but let me point you in a potentially useful direction. Page 2 of this paper discusses garbling gates for Yao's garbled circuits in a model where all parties have access to a fixed public random permutation. The table at the top of the page shows a couple different constructions that might do what you want.

pg1989
  • 4,736
  • 25
  • 43