Question

Give a FORMAL proof for the following two questions regarding one-way permutation: (a) Assume f is a one-way permutation. Define F = f ◦ f as the composition of f with itself, i.e. F(x) = f(f(x)) for all x in the domain of f. Prove that F is a one-way permutation. (b) Assume that g is a permutation and it has a hard-core bit. Prove that g is one-way.

Related to Introduction to Modern Cryptography by Jonathan Katz.

Answer 1

The first question is a special case of the second, so let's deal with the second. Clearly, f∘g

is still bijective (as composition of two bijective functions), so the question is whether it is also one-way.

Assume by contradiction it is not. This means that, given an element y

, there exists an efficient algorithm to find the preimage x of y with regard to f∘g:

f∘g(x)=y.

But by definition of a one-way function, evaluating g can be done efficiently. Therefore, combining the two, one gets an efficient algorithm which, given y, finds the pre image x′ of y with regard to f: namely, x′=g((f∘g)−1(y)). This contradicts the fact that f is one-way.

Therefore, f∘g is also a one-way permutation.

Note that by inspection of the proof, all that is needed is the weaker requirement that (i) f

is a one-way permutation, and (ii) g is a permutation that can be evaluated efficiently (not necessarily one-way).