The advantage of truncated permutations

Constructing a Pseudo Random Function (PRF) is fundamental problem in cryptology. Such construction, implemented by truncating the last m bits of permutations { 0 , 1 } n was suggested Hall et al. (1998). They conjectured that distinguishing advantage an adversary with q queries, Adv ( ) small if = o 2 + ∕ established upper bound on confirms conjecture for < 7 and also declared general lower Ω . The essentially confirmed Bellare Impagliazzo (1999). Nevertheless, estimating remained open. Combining trivial 1, birthday bound, result Stam (1978) leads to O min − In this paper we show tight every ≤ any This, turn, verifies converse correct, i.e., negligible only