A Proof of Security in O(2n) for the Benes Scheme

In [1], W. Aiello and R. Venkatesan have shown how to construct pseudorandom functions of 2n bits → 2n bits from pseudorandom functions of n bits → n bits. They claimed that their construction, called "Benes" reaches the optimal bound (m ≪ 2n) of security against adversaries with unlimited computing power but limited by m queries in an Adaptive Chosen Plaintext Attack (CPA-2). This result may have many applications in Cryptography (cf [1,19,18] for example). However, as pointed out in [18] a complete proof of this result is not given in [1] since one of the assertions in [1] is wrong. It is not easy to fix the proof and in [18], only a weaker result was proved, i.e. that in the Benes Schemes we have security when m ≪ f(Ɛ)ċ 2n-Ɛ, where f is a function such that limƐ→0 f(Ɛ) = +∞ (f depends only of Ɛ, not of n). Nevertheless, no attack better than in O(2n) was found. In this paper we will in fact present a complete proof of security when m ≪ O(2n) for the Benes Scheme, with an explicit O function. Therefore it is possible to improve all the security bounds on the cryptographic constructions based on Benes (such as in [19]) by using our O(2n) instead of f(Ɛ) ċ2n-Ɛ of [18].