Ben Morris

How to Encipher Messages on a Small Domain

We analyze the security of the Thorp shuffle, or, equivalently, a maximally unbalanced Feistel network. Roughly said, the Thorp shuffle on N cards mixes any N 1 ? 1/r of them in

An Enciphering Scheme Based on a Card Shuffle

O(r\lg N)

Improved Bounds for Sampling Contingency Tables

steps. Correspondingly, making O(r) passes of maximally unbalanced Feistel over an n-bit string ensures CCA-security to 2 n(1 ? 1/r) queries. Our results, which employ Markov-chain techniques, enable the construction of a practical and provably-secure blockcipher-based scheme for deterministically enciphering credit card numbers and the like using a conventional blockcipher.

Spectral gap for the zero range process with constant rate

We introduce the swap-or-not shuffle and show that the technique gives rise to a new method to convert a pseudorandom function PRF into a pseudorandom permutation PRP or, alternatively, to directly build a confusion/diffusion blockcipher. We then prove that swap-or-not has excellent quantitative security bounds, giving a Luby-Rackoff type result that ensures security assuming an ideal round function to a number of adversarial queries that is nearly the size of the constructions domain. Swap-or-not provides a direct solution for building a small-domain cipher and achieving format-preserving encryption, yielding the best bounds known for a practical scheme for enciphering credit-card numbers. The analysis of swap-or-not is based on the theory of mixing times of Markov chains.

Evolving sets and mixing

We study the problem of sampling contingency tables (nonnegative integer matrices with specified row and column sums) uniformly at random. We give an algorithm which runs in polynomial time provided that the row sums ri and the column sums cj satisfy ri (n 3/ m log m), and cj (m 3/ n log n). This algorithm is based on a reduction to continuous sampling from a convex set. The same approach was taken by Dyer, Kannan, and Mount in previous work. However, the algorithm we present is simpler and has weaker requirements on the row and column sums.

The mixing time for simple exclusion

We solve an open problem concerning the relaxation time (inverse spectral gap) of the zero range process in Z d /LZ d with constant rate, proving a tight upper bound of O((ρ + 1) 2 L 2 ), where p is the density of particles.

Improved bounds for sampling contingency tables

We show that a new probabilistic technique, recently introduced by the first author, yields the sharpest bounds obtained to date on mixing times in terms of isoperimetric properties of the state space (also known as conductance bounds or Cheeger inequalities). We prove that the bounds for mixing time in total variation obtained by Lovasz and Kannan, can be refined to apply to the maximum relative deviation |pn(x,y)/π(y)-1| of the distribution at time n from the stationary distribution π. Our approach also yields a direct link between isoperimetric inequalities and heat kernel bounds; previously, this link rested on analytic estimates known as Nash inequalities.

Sometimes-Recurse Shuffle

We obtain a tight bound of

How Many Queries are Needed to Distinguish a Truncated Random Permutation from a Random Function

O(L^2\log k)

Improved mixing time bounds for the thorp shuffle

for the mixing time of the exclusion process in