Proof of Theorem 4. Before going to the proof of Xxxxxxx 4, we will give a high-level intuition. The core idea is to consider the two terms of (10), and to make a distinction depending on how much freedom the distinguisher has in influencing the rekeying of the σ message-dependent evaluations of E. We consider two cases:
(1) Tweaks have little to no influence on the rekeying of each of the blockciphers. In this case, the lower bound on Advsrkprp( ′) (Proposition 1) will be small and we cannot argue based on this part of the bound. On the other hand, the distinguisher can select a large set of tweaks for which the blockciphers will never be rekeyed. This way, would simply be considering a non-tweak- rekeyable cipher, for which Assumption 1 applies;
(2) Tweaks have a significant influence on the rekeying of some of the blockci- phers. In this case, the lower bound on Advsrkprp( ′) (Proposition 1) will be significant, and imply the impossibility of an optimal security bound. Combining the two cases will imply the lower bound of Theorem 4. This high- level overview omits a few technicalities. Most importantly, case (1) requires an upper bound on the influence of the tweaks while case (2) requires a lower bound. This is resolved using the c-key-uniformity of Definition 3. ˜ Proof (Proof of Theorem 4). Let ka, kb be two fixed secret keys. Recall that E is c-key-uniform for some small c. Let λ∗ = max{λpre ,..., λpre,λ ,...,λ } . ρ'+1 ρ 1 σ We will derive a lower bound on max Advsrkprp(Ð′) + max Advi-s˜prp(Ð′′) (11) D' D'' E˜ by making a case distinction depending on λ∗. Case 2n−λ∗ (ρ +σ) ≥ 2(ρ +σ)n/(ρ +σ+1). For simplicity, we bound (11) as max Advsrkprp(Ð′) + max Advi-s˜prp(Ð′′) ≥ max Advi-s˜prp(Ð′′) , D' D'' E˜ D'' E˜ ˜Ð and argue based on the i-sprp security, where the maximum is taken over any information-theoretic ′′ that makes at most q construction queries and 0 prim- itive evaluations. By maximality of λ∗, there is a set T ′ ⊆ {0, 1}n of size 2n i=ρ'+1 |rng(Bpre(ka, kb, ·))|· σ |rng(B (ka, kb, ·))| ≥ 2n−λ∗(ρ''+σ) such that Bpre(ka, kb, t)= Bpre(ka, kb, t′) and B (ka, kb, t)= B (ka, kb, t′) for all t, t′ ∈T ′. By Assumption 1, applied for this T ′, we obtain xxx Xxxx-sprp( qρ''+σ+1 E˜˜ Ð ≥ 2(ρ''+σ)n .
Proof of Theorem 4. 1
4.4 (index of f ) Let U be a set of size T and let f : U → [−1, 1] be a function. Let further ∆1, . . . , ∆p be a partition of U. Then the index of f with respect to the partition ∆1, . . . , ∆p is defined to be ind(f, (∆i)p , ) = |∆i| |∆i|−1 Σ f (x) . Σ1 x∈∆i
1. For simplicity, from now on we denote the 2-norm of a function f , ||f||2 by ||f||.
Proof of Theorem 4. 2. The works of Xxx ([80],[81]) and Xxxxxxx [2] show that ∆d(n) ≥ 0 when d ≥ 31 and can be easily modified to show that the inequality is strict when n ≥ d + 6. For each remaining 4 ≤ d ≤ 30, we use Theorems 4.3 and 4.6 to compute the smallest n such that our bounds imply ∆d(n) > 0. We denote this n by Ω(d), and a C++ program computed the values of ∆d(n) ≤ Ωd(n), which then confirmed the remaining cases of the Xxxxx-Xxxxxxx Conjecture. As an example, we find that when d = 30, Ω(30) ≤ 9.77·106. To get this, we take δ = 10−10 and s1 = 5·10−11 in Theorem 4.3 and, in Theorem 4.6, s = .16906, s2 = .499999, ξ = .99, c = .375000001, and ν = 1. Other d are similar, and all satisfy Ω(d) ≤ Ω(30).
Proof of Theorem 4. 2
4.2.1 Three lemmas
Proof of Theorem 4. 1.2
1. But the structure is some what different from the proof of Theorem 3.
Proof of Theorem 4. We prove that Z which in turn is greater than or equal to the stated lower Proof of Theorem 2. Fix the probability distribution
Proof of Theorem 4. Before going to the proof of Xxxxxxx 4, we will give a high-level intuition. The core idea is to consider the two terms of (10), and to make a distinction depending on how much freedom the distinguisher has in influencing the rekeying of the σ message-dependent evaluations of E. We consider two cases:
(1) Tweaks have little to no influence on the rekeying of each of the blockciphers. In this case, the lower bound on Advsrkprp( j) (Proposition 1) will be small and we cannot argue based on this part of the bound. On the other hand, the distinguisher can select a large set of tweaks for which the blockciphers will never be rekeyed. This way, would simply be considering a non-tweak- rekeyable cipher, for which Assumption 1 applies;
(2) Tweaks have a significant influence on the rekeying of some of the blockci-
Proof of Theorem 4. 3.1. By Theorem 4.2.1 we have (up to subsequences) ǁµ(n) − µ(∞)ǁL2 = op(1) and ǁµ(n)ǁHs = Op(1). By Xxxxxx’x Theorem and the fact that f∞ is quadratic we have f∞(µ(n)) = f∞ (µ(∞)) + ∂f∞ .µ(∞); µ(n) − µ(∞)Σ + 1 ∂2f 2 ∞ .µ(∞); µ(n) − µ(∞)Σ . Since µ(∞) minimizes f∞ the linear term above must be zero. Hence f∞(µ(n)) = f∞ (µ(∞) .µ(∞); µ(n) − µ(∞)Σ . Similarly, and using Lemma 4.3.5 Yn(µ(n)) = Yn(µ(∞)) + Op .∂Yn .µ(∞); µ(n) − µ(∞)ΣΣ = Yn(µ(∞)) + Op .ǁµ(n) − µ(∞)ǁL2 Σ . From the definition of Yn we also have fn(µ (n) ) = f∞(µ (n) ) + √n Yn(µ (n)). Substituting into the above we obtain fn(µ (n) ) = f∞(µ (∞) ) + ∂ . f∞(µ (∞) ; µ(n) − µ(∞) . ) + √n Yn(µ (∞)) √nǁµ (n) − µ(∞) ǁL2 Σ = fn(µ (∞) 2 ) + ∂ 2 f∞(µ (∞) ; µ(n) − µ(∞) ) + Op √nǁµ (n) − µ(∞) ǁL2 Σ . Rearranging for ∂2f∞ and using fn(µ(n)) ≤ fn(µ(∞)) we have ∂ f∞(µ (∞) ; µ(n) − µ(∞) ) = 2 .fn(µ (n) ) − fn(µ (∞))Σ + Op( √nǁµ (n) − µ(∞) ǁL2 ) ≤ Op( √nǁµ (n) − µ(∞) ǁL2 ). Recall that by Lemma 4.3.4 we have that ∂2f∞ is positive definite at µ(∞). Therefore:
