On the Di culty of Constructing CryptographicallyStrong Substitution